Abnormal number ai risk diagnosis method and system based on multi-dimensional feature fusion

Abstract

The application relates to the technical field of communication network security and artificial intelligence risk control, and discloses an abnormal number AI risk diagnosis method and system based on multi-dimensional feature fusion, which comprises the following steps: acquiring heterogeneous feature data and identification data of a target data node corresponding to a to-be-diagnosed number; adopting a preset feature extraction network to perform feature extraction and fusion processing on the heterogeneous feature data, and generating feature representation; inputting the feature representation into a preset gate router, outputting corresponding risk probability, and realizing hierarchical diagnosis through threshold judgment; for a fuzzy risk result in a threshold interval, triggering a large language model to perform deep diagnosis, mapping the feature representation into a soft prompt vector sequence which is orthogonal to an original semantic space of the large language model; mapping the identification data into a query feature, taking the soft prompt vector sequence as a key feature and a value feature, obtaining a target association feature through cross attention, and outputting a final diagnosis result through a classification head. The application improves the accuracy of the overall risk diagnosis result.

Description

Technical Field

[0001] This invention relates to the fields of communication network security and artificial intelligence risk control technology, specifically to an AI risk diagnosis method and system for abnormal phone numbers based on multi-dimensional feature fusion. Background Technology

[0002] Abnormal number risk identification is a common technical means in communication security and business risk control. It usually requires analysis of the correlation, behavioral rhythm and business trigger characteristics of the numbers, and to determine whether the numbers have abnormal risks such as high-frequency outbound calls, batch registration, equipment reuse or gang association. It has strong requirements for real-time performance and identification accuracy. As the scale of communication services expands and the level of disguise for abnormal behavior increases, existing risk diagnosis methods often suffer from insufficient feature utilization, inadequate ability to identify complex samples, and limited processing efficiency in high-concurrency scenarios when faced with multi-source heterogeneous information such as topological data and time series data. This results in low diagnostic stability and refined classification ability for numbers with ambiguous boundaries, making it difficult to simultaneously achieve both real-time screening efficiency and risk identification accuracy. Summary of the Invention

[0003] In order to overcome the shortcomings of the existing technology, the present invention aims to provide an AI risk diagnosis method and system for abnormal numbers based on multi-dimensional feature fusion, so as to solve the technical problems of insufficient feature utilization, insufficient ability to identify complex samples, and limited processing efficiency in high-concurrency scenarios in the existing technology.

[0004] This invention is achieved through the following technical solution: In a first aspect, the present invention provides an AI-based risk diagnosis method for abnormal phone numbers based on multi-dimensional feature fusion, comprising: Obtain heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed; A preset feature extraction network is used to extract and fuse features from the heterogeneous feature data to generate feature representations. The feature representation is input into a preset gated router, which outputs the corresponding risk probability. A graded diagnosis is achieved by judging through a threshold. For ambiguous risk results within the threshold range, the large language model is triggered to perform deep diagnosis, mapping the feature representation into a soft cue vector sequence orthogonal to the original semantic space of the large language model; The identifier data is mapped to query features, and the soft cue vector sequence is used as the key and value features. The target association features are calculated through cross-attention, and the final diagnosis result is output through the classification head. The final diagnosis result represents the abnormal risk category or risk probability of the number to be diagnosed.

[0005] Preferably, the heterogeneous feature data includes topological structure data and time series data, and the identification data includes device fingerprint digest, account number or encoding vector.

[0006] Furthermore, the specific process of using a preset feature extraction network to extract and fuse features from the heterogeneous feature data to generate feature representations includes: The topological structure data is input into a preset graph convolutional network to extract spatial topological features and generate spatial feature vectors. Time series data is input into a pre-defined one-dimensional convolutional network to extract temporal rhythm features and generate temporal feature vectors. By fusing spatial feature vectors and temporal feature vectors, feature representations are generated.

[0007] Furthermore, the feature representation is input into a preset gated router, which outputs the corresponding risk probability. In the graded diagnosis, a threshold judgment is performed, where the thresholds include a preset first threshold and a preset second threshold, and the first threshold is less than the second threshold. The specific process includes: In response to a risk probability that is lower than a preset first threshold or higher than a preset second threshold, the risk probability is output as the final diagnostic result. In response to a risk probability greater than or equal to the first threshold and less than or equal to the second threshold, a pre-defined large language model is triggered to perform a deep diagnostic operation.

[0008] Preferably, for ambiguous risk results within the threshold range, a deep diagnosis is triggered using the large language model. This involves mapping the feature representations to a soft cue vector sequence orthogonal to the original semantic space of the large language model, and then using a projection matrix to project the feature representations onto a subspace orthogonal to the original semantic space of the large language model. This includes: Obtain the lexical representation parameter matrix of the pre-defined large language model; The lexical representation parameter matrix is ​​orthogonalized based on the singular value decomposition algorithm to determine the orthogonal basis of the original semantic space. The projection matrix is ​​constrained based on orthogonal basis so that the space containing the soft cue vector sequence remains orthogonal to the original semantic space.

[0009] Furthermore, constraints are applied to the projection matrix based on orthogonal basis, including: An orthogonal penalty term is constructed in the loss function used to train the projection matrix; where the orthogonal penalty term is the square of the Frobenius norm of the matrix product of the matrix consisting of the soft cue vector sequence and the transpose of the lexical representation parameter matrix; The network parameters of the projection matrix are iteratively updated with the goal of minimizing the loss function, thereby constraining the projection matrix.

[0010] Preferably, the identifier data is mapped to query features, and the soft cue vector sequence is used as the key and value features. Target association features are calculated through cross-attention, including: Extract the identifier data and map it into a dense vector through a pre-defined embedding layer or encoder, which serves as the query feature; Calculate the dot product of the transpose matrices of the query features and the key features; Divide the dot product by the square root of the feature dimension of the key feature to generate the attention weight matrix; After normalizing the attention weight matrix using an exponential function, matrix multiplication is performed with the value features to calculate the target association features.

[0011] Preferably, before the heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed, the following is also included: Obtain the original timestamp sequence and original associated identifier list corresponding to the target data node; The original timestamp sequence is subjected to frequency domain periodic feature extraction based on the Fast Fourier Transform algorithm to generate time series data; Based on the original list of association identifiers, an adjacency matrix of the local subgraph is constructed to generate topological structure data.

[0012] Preferably, a loss function is constructed using the final diagnostic result as a pseudo-label, and the network parameters of the gated router are adaptively updated based on the loss function.

[0013] Secondly, the present invention also provides an AI risk diagnosis system for abnormal phone numbers based on multi-dimensional feature fusion, comprising: The data acquisition module is used to acquire heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed; The feature extraction module is used to perform feature extraction and fusion processing on the heterogeneous feature data using a preset feature extraction network to generate feature representations; The routing diagnostic module is used to input the feature representation into a preset gated router, output the corresponding risk probability, and achieve hierarchical diagnosis through threshold judgment; The deep diagnostic module is used to trigger deep diagnostics of the large language model for ambiguous risk results within the threshold range, mapping the feature representation into a soft cue vector sequence orthogonal to the original semantic space of the large language model; The calculation output module is used to map the identification data into query features, using the soft cue vector sequence as key features and value features, and calculates the target association features through cross attention. The final diagnostic result is output through the classification head, where the final diagnostic result represents the abnormal risk category or risk probability of the number to be diagnosed.

[0014] Compared with the prior art, the present invention has the following beneficial technical effects: This invention provides an AI-based risk diagnosis method for abnormal phone numbers based on multi-dimensional feature fusion. It processes feature representations and outputs risk probabilities through a pre-defined gated router. When the risk probability is below a first threshold or above a second threshold, the result is directly output. Only ambiguous risk samples within the threshold range are triggered for deep diagnosis using a large language model. This hierarchical processing mechanism enables rapid and lightweight interception of low-risk and high-risk samples, reducing unnecessary computational overhead of large models and effectively improving processing efficiency in high-concurrency real-time screening scenarios. Simultaneously, the gated router parameters are adaptively updated based on the final diagnostic results output by the large language model, allowing for dynamic optimization of the risk judgment boundary and improving the long-term stability of ambiguous number diagnosis. By fusing two types of heterogeneous features—topological structure data and time series data—to generate a unified feature representation, multi-dimensional risk feature information is fully explored and utilized, solving the problem of insufficient feature utilization. In the deep diagnosis process, the feature representation is mapped to a subspace orthogonal to the original semantic space of the large language model using a projection matrix, avoiding mutual interference between structured risk control features and text semantic space. Then, the identifier data is mapped to query features and cross-attention is calculated with the soft cue vector sequence, enabling the model to accurately focus on abnormal structures and time series features related to the current data node. This significantly enhances the ability to identify and classify complex abnormal samples with high camouflage and gang-related characteristics, thereby improving the accuracy of the overall risk diagnosis results. Attached Figure Description

[0015] Figure 1 This is a flowchart of the abnormal number AI risk diagnosis method in an embodiment of the present invention; Figure 2 This is a schematic diagram of the abnormal number AI risk diagnosis system in an embodiment of the present invention; In the diagram: 1. Data acquisition module; 2. Feature extraction module; 3. Route diagnosis module; 4. Deep diagnosis module; 5. Calculation output module; 6. Adaptive feedback module. Detailed Implementation

[0016] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0017] The purpose of this invention is to provide an AI-based risk diagnosis method and system for abnormal phone numbers based on multi-dimensional feature fusion, in order to solve the technical problems of insufficient feature utilization, inadequate recognition capability of complex samples, and limited processing efficiency in high-concurrency scenarios in the prior art.

[0018] The present invention will now be described in further detail with reference to the accompanying drawings: Example 1 See Figure 1 In one embodiment of the present invention, an AI-based risk diagnosis method for abnormal phone numbers based on multi-dimensional feature fusion is provided, comprising: Step 1: Obtain the heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed.

[0019] Specifically, the heterogeneous feature data includes topological structure data and time series data, and the identification data includes device fingerprint digest, account number or encoding vector.

[0020] The scenario involves a carrier's risk control center conducting real-time screening of numbers entering the core business network that are awaiting diagnosis. These numbers may be involved in abnormal behaviors such as high-frequency outbound calls, bulk registration, spoofed callbacks, or associated redirects. The system completes lightweight discrimination, in-depth diagnosis, and feedback updates within a unified data processing chain, thus balancing processing timeliness and diagnostic accuracy. The specific processing procedure is as follows: The system acquires heterogeneous feature data and identification data corresponding to the target data node; the target data node is a computing unit corresponding to the number to be diagnosed at the current time; the heterogeneous feature data includes at least two types: one is topology data, which is used to characterize the association between the number and other numbers, device identifiers, IP addresses or accounts; the other is time series data, which is used to characterize the call interval, login rhythm, request frequency fluctuation or session triggering beat of the number within a predetermined time window; the identification data can be the number itself, device fingerprint digest, account number or the encoding vector corresponding to the number.

[0021] In this embodiment, assuming that the number N1 to be diagnosed has contacted 3 associated objects in the last 10 minutes, denoted as A, B, and C respectively, the local association relationship can be abstracted as a 4×4 adjacency matrix, where the first row and second column being 1 indicates that N1 is connected to A, the first row and third column being 1 indicates that N1 is connected to B, and the first row and fourth column being 1 indicates that N1 is connected to C; if A and C have a transfer relationship, then the second row and fourth column are also denoted as 1; at the same time, the number of outbound calls of N1 in 6 consecutive time slices can be represented as the sequence 2, 2, 9, 2, 10, 2, which reflects obvious periodic pulse characteristics; the system uses the matrix and the sequence as inputs to the subsequent feature extraction network.

[0022] Step 2: Use a preset feature extraction network to extract and fuse features from the heterogeneous feature data to generate feature representations.

[0023] Specifically, the process is as follows: The topological structure data is input into a preset graph convolutional network to extract spatial topological features and generate spatial feature vectors. Time series data is input into a pre-defined one-dimensional convolutional network to extract temporal rhythm features and generate temporal feature vectors. By fusing spatial feature vectors and temporal feature vectors, feature representations are generated.

[0024] In this embodiment, the system processes the heterogeneous feature data based on a preset feature extraction network to generate a unified feature representation. This feature representation can be a fixed-length vector, such as a representation vector (F) of length 8 = [0.12, 0.85, 0.31, 0.77, 0.09, 0.63, 0.41, 0.58]. Here, the original data is not required to be directly concatenated into the deep model. Instead, it is first compressed and expressed with high fidelity through a gated router to control the input scale of subsequent processing links.

[0025] Step 3: Input the feature representation into the preset gated router, output the corresponding risk probability, and realize hierarchical diagnosis by threshold judgment.

[0026] Specifically, the threshold includes a preset first threshold and a preset second threshold, and the first threshold is less than the second threshold; the specific process includes: In response to a risk probability that is lower than a preset first threshold or higher than a preset second threshold, the risk probability is output as the final diagnostic result. In response to a risk probability greater than or equal to the first threshold and less than or equal to the second threshold, a pre-defined large language model is triggered to perform a deep diagnostic operation.

[0027] In this embodiment, the system inputs feature representations into a preset gating router and outputs risk probabilities. The gating router can be a small-scale multilayer perceptron, whose input is a vector (F) and output is a value between 0 and 1. Taking the thresholds set as the first threshold of 0.25 and the second threshold of 0.75 as an example, if the output result is 0.08, it indicates that the number is in the low-risk range, and the system directly outputs 0.08 as the final diagnostic result. If the output result is 0.91, it indicates that the number is highly abnormal, and the system directly outputs 0.91 or outputs the high-risk category, without entering the subsequent deep diagnosis link. Only when the output result is greater than or equal to 0.25 and less than or equal to 0.75 does the system consider the number to be in the ambiguous range and further trigger deep diagnosis, so that the deep diagnosis link mainly works on difficult-to-determine samples.

[0028] Step 4: For ambiguous risk results within the threshold range, trigger the large language model to perform deep diagnosis, and map the feature representation into a soft cue vector sequence orthogonal to the original semantic space of the large language model.

[0029] Specifically, a projection matrix is ​​used to project the feature representations onto a subspace orthogonal to the original semantic space of the pre-defined large language model, including: Obtain the lexical representation parameter matrix of the pre-defined large language model; The lexical representation parameter matrix is ​​orthogonalized based on the singular value decomposition algorithm to determine the orthogonal basis of the original semantic space. The projection matrix is ​​constrained based on orthogonal basis so that the space containing the soft cue vector sequence remains orthogonal to the original semantic space.

[0030] Among them, the constraints on the projection matrix based on orthogonal basis include: An orthogonal penalty term is constructed in the loss function used to train the projection matrix; where the orthogonal penalty term is the square of the Frobenius norm of the matrix product of the matrix consisting of the soft cue vector sequence and the transpose of the lexical representation parameter matrix; The network parameters of the projection matrix are iteratively updated with the goal of minimizing the loss function, thereby constraining the projection matrix.

[0031] In this embodiment, when deep diagnostics is triggered, the system does not convert the original graph data and time-series data into long text descriptions. Instead, it uses a projection matrix to map the feature representation into a sequence of soft cue vectors. Following the above embodiment, if the length of vector (F) is 8, the system can map it into 4 soft cue vectors through the projection matrix, each with a length of 6, thus forming a 4×6 soft cue sequence (P). For example, after mapping, the first cue vector is 0.11, -0.08, 0. The first vector is 35, 0.04, 0.52, -0.10; the second vector is 0.07, 0.14, -0.21, 0.33, 0.29, 0.05; the third vector is -0.16, 0.22, 0.18, -0.09, 0.40, 0.12; and the fourth vector is 0.09, -0.03, 0.27, 0.31, -0.06, 0.20. These vectors serve as non-textual structural feature carriers and are used for subsequent cross-association with the identified data.

[0032] Step 5: Map the identifier data to query features, use the soft cue vector sequence as key features and value features, calculate the target association features through cross attention, and output the final diagnosis result through the classification head. The final diagnosis result represents the abnormal risk category or risk probability of the number to be diagnosed.

[0033] Specifically, the specific process includes: Extract the identifier data and map it into a dense vector through a pre-defined embedding layer or encoder, which serves as the query feature; Calculate the dot product of the transpose matrices of the query features and the key features; Divide the dot product by the square root of the feature dimension of the key feature to generate the attention weight matrix; After normalizing the attention weight matrix using an exponential function, matrix multiplication is performed with the value features to calculate the target association features.

[0034] The system extracts identifier data as query features and inputs the soft suggestion vector sequence as key and value features into a pre-defined large language model. Identifier data as query features refers to the identity encoding vector (Q) of the number to be diagnosed, which is obtained by looking up the original string identifier or number identifier through a pre-defined word embedding matrix. It is used to retrieve the part of the soft suggestion sequence that is most relevant to the risk of the number. To illustrate with a simplified example, if (Q) = [0.2, 0.6, 0.1, 0.5, 0.3, 0.4], the system calculates the relevance of (Q) to the four suggestion vectors respectively. Assuming that the weights are approximately 0.10, 0.15, 0.55, 0.20, this means that the third suggestion vector contributes the most to the current diagnosis. Based on this, the model aggregates the target association features, for example, a vector of length 6 (R) = [0.03, 0.17, 0.12, 0.01, 0.36, 0.08].

[0035] The system inputs the target association features into the classification head and outputs the final diagnostic result. This result can be either a risk probability, such as 0.82, or a discrete risk category, such as anomalies such as fake human outbound calls, device pool rotation anomalies, or normal business fluctuations. In actual deployment, the classification head can output both risk category and risk score at the same time. The risk category is used for handling strategy selection, and the risk score is used for ranking and threshold linkage.

[0036] After the final result is output, the system adaptively updates the network parameters of the gated router based on the result. The update logic is as follows: if the gated router judges a number as intermediate risk and triggers deep diagnosis, and the deep diagnosis ultimately confirms that the number is high risk with a risk probability greater than a preset threshold, then the gated router should enhance its sensitivity to such feature combinations in subsequent training, so that similar numbers can be directly identified in the initial screening stage of the gated router; conversely, if the deep diagnosis confirms that it is only a normal business peak fluctuation, then the router should reduce the probability of false triggering of similar patterns; in this way, the lightweight router will gradually conform to the real risk boundary as the business environment changes.

[0037] Step 6: Construct a loss function using the final diagnosis result as a pseudo-label, and adaptively update the network parameters of the gated router based on the loss function.

[0038] This embodiment further sets up processing branches for the following abnormal situations: If one type of heterogeneous feature data is missing, for example, if topological structure data cannot be obtained temporarily, the system can generate a downgraded feature representation based only on the acquired time series data. When performing feature fusion, a zero vector or a preset default mean vector is used to fill the missing spatial feature vector positions to maintain the consistency of the input dimension, and the diagnosis is marked as a partial feature pattern. If the identification data is empty or the encoding fails, the system does not trigger deep diagnosis, but falls back to the gated router result and adds a low confidence mark. If the risk probability is exactly equal to one of the two thresholds, it will proceed with deep diagnosis to avoid premature truncation on boundary samples. If the model times out during deep diagnosis, the gated router output is directly used as a temporary result, and the sample is placed in the offline review queue.

[0039] For example, in a nighttime anti-harassment scenario for operators, number N1 is associated with multiple new device identifiers within 20 minutes and exhibits a roughly fixed 3-second dialing interval. After the gating router generates a representation, it outputs 0.57, which is in the fuzzy range, thus triggering deep diagnostics. The large language model, combining the number's encoding vector with the soft cue sequence, identifies a composite pattern of multi-device sharing and fixed-rhythm outbound calls, ultimately outputting a high-risk category and a risk probability of 0.89. This result is then used to adjust the router parameters, enabling the system to more quickly and accurately route calls when the next batch of similar numbers arrives.

[0040] When the risk score is interpreted as a continuous output, it corresponds to the risk probability. Both are used to characterize the continuous risk level of the number to be diagnosed, without changing the limitation that the final diagnosis result can be an abnormal risk category or a risk probability. The purpose of this step is to process the vast majority of low-entropy samples in a lightweight process through a hierarchical diagnostic architecture that first quickly screens and then focuses on in-depth analysis, while only using a deep model for a small number of high-entropy samples. This achieves a balance between processing timeliness and diagnostic accuracy, while maintaining the ability to identify complex and abnormal numbers.

[0041] Heterogeneous feature data is processed based on a pre-defined feature extraction network to generate feature representations, including: The topological structure data is input into a preset graph convolutional network to extract spatial topological features and generate spatial feature vectors. Time series data is input into a pre-defined one-dimensional convolutional network to extract temporal rhythm features and generate temporal feature vectors. By fusing spatial feature vectors and temporal feature vectors, feature representations are generated.

[0042] In this embodiment, under the unified scenario of the aforementioned operator risk control center, if the topology matrix and time series are simply spliced ​​together, the following technical defects exist: First, the connection strength in the graph structure and the numerical amplitude in the time series are in different distribution spaces, and direct splicing will produce modal bias; Second, the potential gang relationships in the topology may be masked by the time series peaks; Therefore, in this embodiment, the two types of data are processed by different networks and then fused.

[0043] The topological data is input into a graph convolutional network for spatial topological feature extraction. Taking number N1 as an example, its local subgraph contains four nodes: N1, device D1, number N2, and IP1. The initial node features can be simple binary or counting forms. For example, the initial vector of N1 is 1, 0, 3, representing the current diagnostic node, non-device, and 3-time association; the initial vector of D1 is 0, 1, 5, representing non-number, device node, and 5-time reuse; N2 and IP1 also have their own vectors. The graph convolutional network aggregates these node features based on adjacency relationships. If N1 is connected to D1, N2, and IP1, then after one graph convolution, the new representation of N1 will integrate its own features and the features of its neighbors.

[0044] In this embodiment, after one layer of aggregation, the spatial feature vector (Gs) of N1 can be obtained as [0.62, 0.18, 0.74, 0.33]. This vector reflects information such as its centrality, reuse density, and cross-domain jump degree in the local relation graph. Time series data is input into a one-dimensional convolutional network for temporal rhythm feature extraction. Assume the request counts for number N1 over eight equal-length time slices are 1, 4, 1, 4, 1, 5, 1, 4. The system sets a one-dimensional convolutional kernel of length 3 and performs sliding extraction on the sequence. If the kernel is 1, -1, 1, the convolution result of the first window (1, 4, 1) is -2, and the result of the second window (4, 1, 4) is 7, thus obtaining a set of intermediate response values. After activation and pooling, the temporal feature vector (Gt) = [0.21, 0.80, 0.15, 0.66] is extracted. This vector can effectively preserve rhythmic features such as short-period repetition, impulsive bursts, and non-natural smoothness. The spatial feature vector and the temporal feature vector are fused to generate a unified feature representation. The fusion method can be either concatenation with a fully connected transformation or weighted fusion.

[0045] First, concatenate (Gs) and (Gt) into a vector of length 8: 0.62, 0.18, 0.74, 0.33, 0.21, 0.80, 0.15, 0.66; The input linear layer is then compressed into a final feature representation of length 6 (F2) = [0.55, 0.12, 0.69, 0.44, 0.37, 0.58]. If the system detects that the gang topology is more stable than the time rhythm during a certain period, a higher fusion weight can be assigned to the spatial vector. If a sudden anomaly of a single number is encountered, the weight of the time vector can be increased.

[0046] As an anomaly handling branch, if the number of nodes in a local subgraph is less than a preset threshold, such as having only N1 single nodes without effective associated edges, the graph convolutional network can degenerate into a linear projection of the node's own features to avoid computational failure due to empty adjacencies. If the time series length is less than the convolutional kernel length, it can be padded with zeros or repeated last values. If the quality of a certain modality is lower than a preset quality threshold, such as the graph data coming from a short-term cache and the proportion of missing edges exceeding a preset range, the system can reduce the weight of that modality during fusion to prevent low-quality features from affecting the accuracy of the final representation.

[0047] In this embodiment, in the aforementioned nighttime anti-harassment link, although the total number of outbound calls of number N1 did not exceed the preset benchmark value, its associated device D1 was used by multiple numbers in rotation within a short period of time. The graph convolutional network can encode this shared device feature into a spatial vector. At the same time, the one-dimensional convolutional network detects that N1 has an approximately fixed rhythmic fluctuation. After the two are fused, a stable representation of the group-controlled spoofed number is formed for subsequent routing and deep diagnosis.

[0048] The purpose of this step is to achieve modal extraction and unified encoding of heterogeneous data without destroying the original graph structure and time rhythm, thereby improving the basis for subsequent risk routing and deep diagnosis.

[0049] The projection matrix projects the feature representations onto a subspace orthogonal to the original semantic space of the predefined large language model, including: Obtain the lexical representation parameter matrix of the pre-defined large language model; The lexical representation parameter matrix is ​​orthogonalized based on the singular value decomposition algorithm to determine the orthogonal basis of the original semantic space. The projection matrix is ​​constrained based on orthogonal basis so that the space containing the soft cue vector sequence remains orthogonal to the original semantic space.

[0050] In this embodiment, directly mapping the number risk control features to the original word vector space of the language model can easily lead to the following technical problems: First, numerical network features will overlap with existing semantic vectors, making it difficult for the model to distinguish between textual semantic information and structural risk information; Second, without modifying the weights of the main model, if the input space is mixed, the classification head's interpretation of soft prompts will be unstable; Therefore, this embodiment applies orthogonal constraints to the projection space so that the newly added soft prompts are in a subspace separated from the original semantic space. The system obtains the lexical representation parameter matrix of the language model; the lexical representation parameter matrix is ​​the embedding table used in the model to represent regular text lexical units; for example, assuming that the embedding table contains only 3 lexical vectors, and each lexical vector has a dimension of 2, the matrix can be simplified as: first row 1,0, second row 0,1, third row 1,1; although the dimension in the actual system is much higher than this, this simplified example is sufficient to demonstrate the calculation logic.

[0051] The system processes the above-mentioned lexical representation parameter matrix based on the singular value decomposition algorithm to obtain the orthogonal basis of the original semantic space. After decomposing the aforementioned 3×2 matrix, two mutually orthogonal basis vectors can be obtained to represent the main semantic directions already occupied by the language model. At this point, if any subsequently introduced soft cue highly coincides with these two directions, it means that it falls into the original semantic space.

[0052] Furthermore, in this embodiment, the original semantic space is preferably understood in engineering implementation as the main semantic subspace corresponding to the lexical representation parameter matrix, rather than necessarily being equivalent to all directions of the entire embedding dimension space. After obtaining each singular vector based on singular value decomposition, the system can select the first few main directions as the orthogonal basis of the original semantic space according to the cumulative energy ratio, the preset rank upper limit, or the validation set stability index. The remaining dimensions not occupied by the main semantic directions can be used as the available subspace for soft prompt mapping.

[0053] The reason for this approach is that the embedding dimension of actual language models is usually high, while the semantics of the original words are often concentrated in a few main directions. If the entire embedding space is directly equated to being completely filled, it will lead to the ambiguity of understanding that the orthogonal subspace is empty. The aforementioned 2-dimensional simplified example is only used to help understand the discrimination logic that overlap and interference are positively correlated, and is not intended to limit the original semantic space to cover all embedding dimensions in actual deployment.

[0054] Based on this, the system imposes constraints on the projection matrix. Specifically, the projection matrix is ​​subject to parameter updates based on a preset optimization objective, so that the risk control features are projected onto a direction perpendicular to the original semantic basis. For example, if the original semantic space mainly covers several main directions, and the mapping vector learned by the system for the soft cue largely overlaps with these main directions, then the vector needs to be adjusted. If the mapped vector falls more on the retained non-main semantic directions, it indicates that the soft cue carries additional structural information rather than ordinary text semantic information. After iterative training, the soft cue vector sequence obtained by the system will be more suitable for representing specialized risk control features such as high-frequency switching devices, multi-hop associated forwarding, and non-natural rhythms.

[0055] As a fault-tolerant processing branch, if the vocabulary representation parameter matrix is ​​too large to be decomposed in real time each time, the system can pre-calculate orthogonal basis offline and cache it, only recalculating it when the model version is updated; if there are numerical stability issues during the decomposition process, the vocabulary representation matrix can be normalized first before decomposition; if there is still a large overlap between soft cues and the original semantic space in a certain round of training, the system can temporarily increase the constraint strength, prioritize spatial isolation, and then gradually restore the normal training weights; if too many principal directions are selected based on the cumulative energy ratio, resulting in too narrow an available orthogonal subspace, the system can appropriately reduce the rank retention, or change to only constraining the first few principal singular directions, in order to balance spatial isolation and soft cue carrying capacity.

[0056] For example, in the same nighttime anti-harassment scenario, the operator model originally has strong text reasoning capabilities, such as understanding work order descriptions and recognizing patterns in manual notes, but it is not naturally adapted to millisecond-level dialing rhythms or device reuse topologies. By projecting risk control features into a subspace separated from the original semantic space, the system can open up a dedicated feature channel for number risk diagnosis without destroying the existing language understanding capabilities.

[0057] The purpose of this embodiment is to isolate the structured risk control features from the original semantic representation of the model, thereby reducing mutual interference between different information spaces and improving the stability and interpretability of the deep diagnostic link.

[0058] Constraining the projection matrix based on orthogonal basis includes: An orthogonal penalty term is constructed in the loss function used to train the projection matrix; where the orthogonal penalty term is the square of the Frobenius norm of the matrix product of the matrix consisting of the soft cue vector sequence and the transpose of the lexical representation parameter matrix; The network parameters of the projection matrix are iteratively updated with the goal of minimizing the loss function, thereby constraining the projection matrix.

[0059] This embodiment provides a training constraint mechanism for the projection matrix. Specifically, in the previous embodiment, although an orthogonal basis has been introduced, if the training objective only focuses on classification accuracy, the projection matrix may still tend to the local optimum during the iteration process, causing its mapping result to approach the original semantic space. To solve this defect, this embodiment adds an orthogonal penalty term to the loss function, making classification performance and spatial isolation simultaneously optimization objectives.

[0060] Specifically, during the training phase, the system first generates a soft cue vector sequence based on the current projection matrix, and then calculates the dot product strength between the sequence and the lexical representation parameter matrix. Here, the matrix arrangement is further defined: if the soft cue sequence contains (m) cue vectors, and the dimension of each cue vector in the embedding space is (d), then it can be arranged into a (md) matrix; if the lexical representation parameter matrix contains (V) lexical units, and the embedding dimension of each lexical unit vector is also (d), then it can be arranged into a (Vd) matrix.

[0061] In this arrangement, the dot product of the transpose matrix of the soft cue vector sequence and the lexical representation parameter matrix in the embodiment can be understood as calculating the relevance strength item by item along the common embedding dimension (d), thereby forming the overlap matrix between the cue and the lexical. In engineering implementation, an equivalent matrix multiplication arrangement can be used to complete this calculation. The core meaning is to measure the coupling strength between each direction of the soft cue and each direction of the original lexical representation, without changing the constraint target defined by the embodiment.

[0062] For ease of explanation, assume the currently generated soft suggestion sequence is a 2×2 matrix: first row 1,2, second row 0,1; the lexical representation parameter matrix is: first row 1,0, second row 0,1; after embedding dimension alignment, a 2×2 intermediate overlap matrix can be obtained; if the elements in this intermediate matrix are generally large, it indicates that the soft suggestions and the original lexical space are still strongly coupled; the system further sums the squares of each element in this intermediate matrix to obtain a non-negative scalar, which is used as an orthogonality penalty term; for example, if the value is 6, it means that the current overlap is greater than the preset upper limit; if it decreases to 1.2 after iteration, it means that the projection effect is closer to the orthogonal state.

[0063] During training, the total loss consists of two parts: a diagnostic loss, which constrains the final risk classification or risk probability output; and an orthogonal penalty term, which suppresses the overlap between the soft cue vector and the original vocabulary space. The system updates the projection matrix parameters by minimizing the total loss weighted by these two parts.

[0064] To illustrate with a simplified example, if the classification is accurate after a certain round of training, but the orthogonality penalty term is greater than the preset value, the optimizer will guide the projection matrix to update the parameters in a direction orthogonal to the original semantic space. If the orthogonality penalty term is less than the preset value, but the classification effect decreases, the optimizer will look for a more discriminative mapping direction while preserving spatial isolation. After multiple iterations, the projection matrix will tend towards a state that balances discriminability and stability.

[0065] Furthermore, the orthogonal penalty term is preferably used to constrain the overall overlap between the soft cue and the original semantic main direction, rather than requiring each cue dimension to be completely zero with all lexical units. That is, the system allows soft cues to have a small amount of approximate correlation in numerical terms, but requires that their overall correlation strength be stably suppressed to a preset range. This can avoid the collapse of expressive power caused by excessive constraints during training, and also make orthogonality an optimizable and monitorable continuous goal in engineering, rather than an absolute hard constraint that is difficult to achieve.

[0066] As a fault-tolerant branch, if the weight of the orthogonal penalty term is set too large, it may cause the projection matrix to excessively pursue orthogonality and sacrifice diagnostic ability. In this case, a phased training strategy can be adopted, that is, to start with a warm start with a lower constraint strength and then gradually increase it. If the penalty term is less than the preset weight range and the spatial isolation effect is insufficient, the similarity between soft prompts and word vectors can be monitored through the validation set and the weight can be dynamically adjusted. If there are far more normal numbers than abnormal numbers in the training samples, resulting in a skewed classification loss, the class balancing weight can be combined to ensure that the projection matrix does not deviate from the effective direction due to sample imbalance. If the vocabulary size exceeds the preset size threshold, the penalty term can be approximately calculated by high-frequency words, representative words of the main semantic direction, or block sampling to reduce the computational complexity of training while maintaining the constraint trend.

[0067] For example, during a week of data playback training at the risk control center, the system found that certain fixed rhythms and device-shared soft cues tended to fall into the high-frequency semantic direction of the text in the early stages, causing the deep diagnosis to be unstable in its judgment of similar numbers. After adding an orthogonal penalty term, these soft cues gradually moved away from the original text semantic space, the corresponding number risk score fluctuations decreased significantly, and the deep diagnosis results became more consistent.

[0068] The purpose of this embodiment is to ensure that soft cue vectors can not only classify but also not excessively intrude into the original semantic space by explicitly introducing orthogonal constraints into the training objective, thereby improving the stability of the deep diagnostic model in long-term iterations.

[0069] The query features, key features, and value features are input into a pre-defined large language model for cross-attention calculation to extract the target association features, including: Calculate the dot product of the transpose matrices of the query features and the key features; Divide the dot product by the square root of the feature dimension of the key feature to generate the attention weight matrix; After normalizing the attention weight matrix using an exponential function, matrix multiplication is performed with the value features to calculate the target association features.

[0070] In the aforementioned process, if a full self-association operation is directly performed on all inputs, the computational load will increase non-linearly with the input length, making it unsuitable for high-concurrency number risk control scenarios. Therefore, this embodiment employs cross-attention with identifier data as the query center, calculating only which soft tips need to be paid attention to for the current number; details are as follows: The system calculates the dot product of the query feature and the transpose of the key feature. Taking number N1 as an example, assuming its query feature (Q) is a row vector 1,2, and the soft suggestion sequence has two key features, (K1)=[1,0] and (K2)=[1,1], then the dot product of (Q) and (K1) is 1, and the dot product of (Q) and (K2) is 3, thus obtaining a relevance vector 1,3 of length 2. This result reflects the initial matching degree between the current number identifier and each soft suggestion. The system divides the dot product result by the square root of the dimension scaling factor. Since the dimension of the key feature in this example is 2, the square root of the scaling factor is approximately 1.414, so the scaled result is approximately 0.71, 2.12. This processing can prevent the dot product value from exceeding the preset value range when the dimension increases, thus making the subsequent normalization more stable. The system processes the scaled result using a normalized exponential function to obtain attention weights. Continuing with the example above, after normalization, the two weights can be approximated as 0.20 and 0.80, meaning that the second soft cue has a greater impact on the diagnosis of this number. The system uses the above weights to perform weighted aggregation of the value features; let the two corresponding value features be (V1)=[2,1] and (V2)=[0,3], then the target correlation feature is approximately (0.20V_1+0.80V_2), finally obtaining 0.4,2.6; this result is the correlation feature most relevant to the current risk diagnosis of number N1, and the abnormal category can be determined by inputting the classification header; The core of the above process is that the query features are only used to search for the current target number, rather than having all soft tips perform full calculations on each other; in this way, with a fixed number of soft tips, the calculation scale is basically linearly related to the number of tips, which meets the processing requirements of the millisecond-level risk control link. As a fault-tolerant branch, if all dot product results are close to 0, it indicates that there is no obvious correlation between the current query feature and the soft suggestion. In this case, the system can revert the target related feature to the mean of the value features or a preset safety vector. If the concentration of a certain weight distribution after normalization exceeds a preset threshold, such as reaching 0.99 or higher, it may mean that the model is overfitting to a single suggestion. In this case, a mild smoothing strategy can be added during the training phase. If the key feature dimension is abnormally configured to 0, the system will directly stop the deep diagnosis of this round and return the router result to avoid illegal calculation. For example, in the same nighttime anti-harassment scenario, the query features of number N1 are more biased towards shared devices, while the soft prompt sequence includes both device reuse prompts and time-repeated prompts. After cross-attention operation, the system found that the weight of device reuse prompts is significantly higher than other prompts. Therefore, the target association features more concentratedly reflect the risk of group reuse. Based on this, the classification head determines that it belongs to a high-risk device pool rotation type number, rather than ordinary business peak fluctuations. This embodiment focuses on the target number and extracts the most relevant structural and rhythmic information from the soft cue sequence to reduce the interference of irrelevant features on diagnosis and reduce the computational resource consumption of deep models. Before acquiring the heterogeneous feature data and identifier data of the target data node corresponding to the number to be diagnosed, the following steps are also included: Obtain the original timestamp sequence and original associated identifier list corresponding to the target data node; The original timestamp sequence is subjected to frequency domain periodic feature extraction based on the Fast Fourier Transform algorithm to generate time series data; Based on the original list of association identifiers, an adjacency matrix of the local subgraph is constructed to generate topological structure data.

[0071] This embodiment provides a preprocessing mechanism for generating heterogeneous feature data. Specifically, in the aforementioned diagnostic link, if unprocessed raw logs are used directly, lightweight networks will find it difficult to stably extract effective patterns. For example, timestamps are merely the occurrence times of discrete events and do not directly indicate periodicity; the associated identifier list is just an unordered collection of objects and does not explicitly form a graph structure. Therefore, this embodiment completes frequency domain processing and graph structure construction before feature extraction.

[0072] The system obtains the original timestamp sequence and original associated identifier list corresponding to the target data node. Taking number N1 as an example, its 6 outbound call timestamps within an observation window can be simplified to 0 seconds, 3 seconds, 6 seconds, 9 seconds, 12 seconds, and 15 seconds. Its original associated identifier list can be recorded as D1, IP1, N2, D1, and IP2, which respectively represent objects such as device, IP, and associated number.

[0073] The system extracts frequency domain periodic features from the original timestamp sequence using the Fast Fourier Transform algorithm to generate time series data. For ease of understanding, the timestamps can first be converted into intervals between adjacent events, resulting in an interval sequence of 3,3,3,3,3. After frequency domain analysis of this sequence, if the difference between the energy peak at a certain fixed frequency and other frequency bands is greater than a preset threshold, it indicates the presence of strong periodic behavior. For example, the system can output a simplified frequency domain feature vector of 0.05, 0.92, 0.07, where the middle component is prominent, indicating that the number has a triggering pattern close to a fixed period, commonly seen in script-based automatic dialing or group control device behavior. If the original sequence is more complex, such as 2,5,2,5,2, the frequency domain analysis will show bimodal or alternating peaks, thus revealing another type of rhythmic feature.

[0074] Furthermore, in this embodiment, the frequency domain periodicity feature extraction of the original timestamp sequence is based on the Fast Fourier Transform algorithm. In engineering implementation, it is not limited to directly performing spectrum calculation on the original absolute time value, but allows the original timestamp sequence to be equivalently time-domain processed first, and then the Fast Fourier Transform is performed.

[0075] The aforementioned transformation of the original timestamp into a sequence of adjacent event intervals, or into a discrete counting sequence within the observation window, is essentially still based on the extraction of periodic features from the original timestamp sequence. Its purpose is to eliminate the translation effect of the absolute start time on the frequency domain results, so that the spectrum more stably reflects the event rhythm rather than the calendar time offset. In other words, the time series data in this embodiment can be a frequency domain representation obtained directly or indirectly from the original timestamp sequence, and the two are technically consistent.

[0076] The system constructs an adjacency matrix of the local subgraph based on the original list of associated identifiers, generating topological data. Taking the above list as an example, N1 is connected to D1, IP1, N2, and IP2, where D1 appears twice and can be considered as a higher-weight edge. If only the connection is considered, a 5-node local graph can be formed. If the number of connections is further recorded, the corresponding element in the adjacency matrix can be set to 2 or other weight values. For example, the matrix element from N1 to D1 is recorded as 2, and the element from N1 to IP1 is recorded as 1. In this way, the scattered identifier list is transformed into a structured input that can be read by the graph convolutional network.

[0077] As a fault-tolerant processing branch, if the original timestamp sequence is too short, for example, with only one or two events, and cannot form stable frequency domain features, the system can revert to basic statistics, such as mean interval and variance, as alternative time series data. If the original associated identifier list is empty, the system generates a minimal local graph containing only the current number node and reduces the topological mode weight during subsequent fusion. If timestamps are duplicated, out of order, or have abnormal jumps, they are sorted and outliers are removed before entering the Fast Fourier Transform to prevent distortion of frequency domain features. If the events within the observation window are sparse enough to support the effective spectral resolution, the system can expand the time window or switch to a segmented statistical sequence before performing frequency domain analysis to maintain the stability of periodic feature extraction.

[0078] For example, in nighttime anti-harassment monitoring, the number N1 appears to have a low total number of outbound calls, but its timestamp interval remains almost constant, and its frequency domain features show a highly concentrated main peak. At the same time, its associated identifier list shows that the same device D1 is repeatedly bound. After preprocessing, the system generates high-quality time series data and topology data, providing reliable input for subsequent lightweight feature extraction and deep diagnosis.

[0079] The purpose of this step is to transform the discrete events and related objects in the raw logs into computable, topology-preserving, and periodic structured features, thereby improving the input quality of subsequent diagnostic links.

[0080] Example 2 according to Figure 2 As shown, this embodiment also provides an AI risk diagnosis system for abnormal phone numbers based on multi-dimensional feature fusion, including: Data acquisition module 1 is used to acquire heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed; Feature extraction module 2 is used to perform feature extraction and fusion processing on the heterogeneous feature data using a preset feature extraction network to generate feature representations; The routing diagnosis module 3 is used to input the feature representation into a preset gated router, output the corresponding risk probability, and realize hierarchical diagnosis through threshold judgment; The deep diagnostic module 4 is used to trigger deep diagnostics of the large language model for ambiguous risk results within the threshold range, and to map the feature representation into a soft cue vector sequence orthogonal to the original semantic space of the large language model. The calculation output module 5 is used to map the identification data into query features, use the soft cue vector sequence as key features and value features, calculate the target association features through cross attention, and output the final diagnosis result through the classification head. The final diagnosis result represents the abnormal risk category or risk probability of the number to be diagnosed.

[0081] The adaptive feedback module 6 is used to construct a loss function with the final diagnostic result as a pseudo-label, and to adaptively update the network parameters of the gated router based on the loss function.

[0082] In this embodiment, the system can be deployed in the server cluster of the operator's risk control center, or in the risk control node facing the enterprise communication platform. It consists of a data acquisition module 1, a feature extraction module 2, a routing diagnosis module 3, a deep diagnosis module 4, a calculation output module 5, and an adaptive feedback module 6. The modules interact with each other through message queues or shared memory.

[0083] Data acquisition module 1 is responsible for accessing the relevant raw data of the number to be diagnosed and outputting heterogeneous feature data and identification data. In engineering implementation, this module can obtain raw events from the signaling acquisition interface, application interface gateway logs, session control node or account association database. If the system supports both real-time streaming and batch playback, this module can be configured with streaming input channels and offline loading channels respectively. For the same number N1, the data acquisition module will collect its associated list, event timestamps and number identification codes within a unified time window and organize them into standard input objects.

[0084] Feature extraction module 2 receives topological structure data and time series data output by the data acquisition module. After being processed by graph convolution sub-units and one-dimensional convolution sub-units respectively, the data is fused to obtain feature representation. This module can be deployed on a hybrid architecture of central processing unit and graphics processing unit. The graph convolution sub-unit is responsible for processing local graphs, and the time convolution sub-unit is responsible for processing short-term rhythmic sequences. The fusion sub-unit outputs a fixed-length vector for downstream applications to call quickly.

[0085] The routing diagnosis module 3 performs rapid risk triage on the feature representation; this module can be a lightweight neural network that outputs a single risk probability value; if the probability falls in the low-risk or high-risk zone, the module directly outputs the result and ends the current processing; if the probability is in the middle range, it sends a trigger signal to the deep diagnosis module, along with the feature representation and identification data; this ensures that the system can prioritize the processing of a large number of easily judged numbers in high-concurrency scenarios with shorter processing links.

[0086] The deep diagnostic module 4 is responsible for performing soft cue mapping and orthogonal spatial projection. Specifically, this module first converts the feature representation into a soft cue vector sequence based on the projection matrix. This module can be deployed on the same computing node as the large language model inference engine, or it can be called through remote inference service. However, local inference is preferred in actual deployment to reduce network round-trip latency.

[0087] The calculation output module 5 is responsible for performing cross-attention calculation and classification head output; specifically, this module reads the number identifier code as the query feature, and sends it together with the soft cue sequence into the cross-attention sub-unit to obtain the target association feature, and outputs the risk category or risk probability through the classification head.

[0088] The adaptive feedback module 6 updates the gated router parameters in the routing diagnosis module based on the final diagnostic results. This module can use online small-step updates or offline aggregation followed by batch updates. If some samples are consistently identified as high-risk after deep diagnosis, and their routing output remains in an ambiguous range for a long time, the feedback module will include these samples in the reinforcement training set. If some samples are proven to be normal services after deep diagnosis, the feedback module will reduce the tendency of similar samples to be falsely triggered.

[0089] To more clearly illustrate the system's collaborative relationship, a simplified process example is given: When number N1 arrives, the data acquisition module extracts its local map and time interval sequence; the feature extraction module generates a vector (F3); the routing diagnosis module outputs 0.61 and sends it to the deep diagnosis module; the deep diagnosis module calculates the target association feature (R3) based on soft hints and query features, and then outputs high risk and 0.87; the adaptive feedback module records this result in the training cache for subsequent fine-tuning of the gating boundary.

[0090] In case of abnormal situations, if the data acquisition module fails to collect all necessary raw data within the specified time, the system can use a missing modality processing strategy to generate partial input and attach confidence level labels to the output results; if the feature extraction module exits abnormally, the routing diagnosis module can switch to a backup model based on basic statistics; if the deep diagnosis module is overloaded or times out, the system prioritizes real-time processing, temporarily using routing results and adding samples to a delayed review queue; if the feedback module detects a recent sudden change in sample distribution, such as a surge in business during holidays causing the overall normal pattern to shift upwards, the update strategy can be switched from online real-time updates to updates after manual review to avoid boundary drift.

[0091] To further clarify, in order to ensure the correspondence between system name and method name throughout the text, the aforementioned graph convolution subunit, one-dimensional convolution subunit, and fusion subunit are all internal components of the feature extraction module, while the cross-attention subunit and classification head are internal components of the deep diagnostic module; the inference engine in the text only represents the deployment or invocation form of the preset large language model and does not constitute a new module name parallel to the deep diagnostic module; the lightweight neural network in this system embodiment corresponds to the gated router implementation form within the routing diagnostic module.

[0092] For example, during the high-concurrency anti-harassment duty period of the operator at night, the system continuously receives a large number of numbers to be diagnosed; ordinary customer service numbers with a number ratio exceeding the preset proportion and numbers with characteristics that meet the preset abnormal rules are quickly diverted by the routing diagnosis module, and only a small number of highly disguised numbers enter the deep diagnosis module; for these complex samples, the system combines orthogonal soft prompts and cross-attention to output more granular risk categories, and continuously corrects the front-end diversion boundary through the feedback module, thereby forming a closed-loop diagnosis link.

[0093] The purpose of this system is to implement the aforementioned diagnostic methods in a modular manner, so that data collection, feature extraction, risk routing, in-depth diagnosis and feedback updates can form a deployable, scalable and fault-tolerant engineering architecture, thereby achieving real-time and stable identification of abnormal numbers.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. An AI-based risk diagnosis method for abnormal phone numbers based on multi-dimensional feature fusion, characterized in that, include: Obtain heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed; A preset feature extraction network is used to extract and fuse features from the heterogeneous feature data to generate feature representations. The feature representation is input into a preset gated router, which outputs the corresponding risk probability. A graded diagnosis is achieved by judging through a threshold. For ambiguous risk results within the threshold range, the large language model is triggered to perform deep diagnosis, mapping the feature representation into a soft cue vector sequence orthogonal to the original semantic space of the large language model; The identification data is mapped to query features, the soft cue vector sequence is used as key features and value features, the target association features are calculated through cross attention, and the final diagnosis result is output through the classification head. The final diagnosis result represents the abnormal risk category or risk probability of the number to be diagnosed. Specifically, for ambiguous risk results within a threshold range, triggering deep diagnosis by the large language model involves mapping feature representations to a soft cue vector sequence orthogonal to the original semantic space of the large language model. This is achieved by using a projection matrix to project the feature representations onto a subspace orthogonal to the original semantic space of the large language model. Obtain the lexical representation parameter matrix of the pre-defined large language model; The lexical representation parameter matrix is ​​orthogonalized based on the singular value decomposition algorithm to determine the orthogonal basis of the original semantic space. The projection matrix is ​​constrained based on orthogonal basis so that the space containing the soft cue vector sequence remains orthogonal to the original semantic space.

2. The abnormal number AI risk diagnosis method based on multi-dimensional feature fusion according to claim 1, characterized in that, The heterogeneous feature data includes topological structure data and time series data, and the identification data includes device fingerprint digest, account number or encoding vector.

3. The abnormal number AI risk diagnosis method based on multi-dimensional feature fusion according to claim 2, characterized in that, The specific process of using a preset feature extraction network to extract and fuse features from the heterogeneous feature data to generate feature representations includes: The topological structure data is input into a preset graph convolutional network to extract spatial topological features and generate spatial feature vectors. Time series data is input into a pre-defined one-dimensional convolutional network to extract temporal rhythm features and generate temporal feature vectors. By fusing spatial feature vectors and temporal feature vectors, feature representations are generated.

4. The abnormal number AI risk diagnosis method based on multi-dimensional feature fusion according to claim 1, characterized in that, In the step of inputting the feature representation into a preset gated router, outputting the corresponding risk probability, and realizing hierarchical diagnosis through threshold judgment, the threshold includes a preset first threshold and a preset second threshold, and the first threshold is less than the second threshold. The specific process includes: In response to a risk probability that is lower than a preset first threshold or higher than a preset second threshold, the risk probability is output as the final diagnostic result. In response to a risk probability greater than or equal to the first threshold and less than or equal to the second threshold, a pre-defined large language model is triggered to perform a deep diagnostic operation.

5. The abnormal number AI risk diagnosis method based on multi-dimensional feature fusion according to claim 1, characterized in that, The constraint on the projection matrix based on orthogonal basis includes: An orthogonal penalty term is constructed in the loss function used to train the projection matrix; where the orthogonal penalty term is the square of the Frobenius norm of the matrix product of the matrix consisting of the soft cue vector sequence and the transpose of the lexical representation parameter matrix; The network parameters of the projection matrix are iteratively updated with the goal of minimizing the loss function, thereby constraining the projection matrix.

6. The AI-based risk diagnosis method for abnormal phone numbers based on multi-dimensional feature fusion according to claim 1, characterized in that, The process of mapping identifier data to query features, using soft cue vector sequences as key and value features, and calculating target association features through cross-attention includes: Extract the identifier data and map it into a dense vector through a pre-defined embedding layer or encoder, which serves as the query feature; Calculate the dot product of the transpose matrices of the query features and the key features; Divide the dot product by the square root of the feature dimension of the key feature to generate the attention weight matrix; After normalizing the attention weight matrix using an exponential function, matrix multiplication is performed with the value features to calculate the target association features.

7. The abnormal number AI risk diagnosis method based on multi-dimensional feature fusion according to claim 1, characterized in that, Before the heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed, the following are also included: Obtain the original timestamp sequence and original associated identifier list corresponding to the target data node; The original timestamp sequence is subjected to frequency domain periodic feature extraction based on the Fast Fourier Transform algorithm to generate time series data; Based on the original list of association identifiers, an adjacency matrix of the local subgraph is constructed to generate topological structure data.

8. The AI-based risk diagnosis method for abnormal phone numbers based on multi-dimensional feature fusion according to claim 1, characterized in that, A loss function is constructed using the final diagnostic results as pseudo-labels, and the network parameters of the gated router are adaptively updated based on the loss function.

9. An AI-based risk diagnosis system for abnormal phone numbers based on multi-dimensional feature fusion, characterized in that, To implement the abnormal number AI risk diagnosis method based on multi-dimensional feature fusion as described in any one of claims 1-8, the method includes: The data acquisition module is used to acquire heterogeneous feature data and identification data of the target data node corresponding to the number to be diagnosed; The feature extraction module is used to perform feature extraction and fusion processing on the heterogeneous feature data using a preset feature extraction network to generate feature representations; The routing diagnostic module is used to input the feature representation into a preset gated router, output the corresponding risk probability, and achieve hierarchical diagnosis through threshold judgment; The deep diagnostic module is used to trigger deep diagnostics of the large language model for ambiguous risk results within the threshold range, mapping the feature representation into a soft cue vector sequence orthogonal to the original semantic space of the large language model; The calculation output module is used to map the identification data into query features, using the soft cue vector sequence as key features and value features, and calculates the target association features through cross attention. The final diagnostic result is output through the classification head, where the final diagnostic result represents the abnormal risk category or risk probability of the number to be diagnosed.

Images