A fraud identification training method based on multi-similarity fusion and feedback self-adaption

Abstract

This invention discloses a large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation, belonging to the field of telecommunications network fraud text recognition technology. The method first cleans, normalizes, and filters noise from the input text and historical cases. Then, it constructs a fraud profile based on Naive Bayes and Apriori algorithms and calculates the fraud likelihood score. By fusing multi-component text similarity, fraud profile, structured features, and label-aware rules, the final relevance score of candidate cases is obtained. Few-shot examples are selected through threshold filtering and ranking and input into a large-scale model for fraud identification. Finally, based on model prediction and human verification feedback, the three-way fusion weights of basic relevance, feature similarity, and label similarity are incrementally updated, non-negatively constrained, and normalized to achieve adaptive feedback adjustment. This invention effectively addresses the problems of paraphrasing and distribution drift in fraudulent language, improving recognition accuracy and robustness without retraining the large model, and is applicable to various anti-fraud text risk control scenarios.

Description

Technical Field

[0001] This invention relates to a large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation. Background Technology

[0002] With the rapid development of mobile internet and social media, telecommunications fraud is characterized by rapidly evolving tactics and diverse variations. Existing fraud text recognition technologies mainly suffer from the following shortcomings:

[0003] First, solutions based on static keyword matching or rule bases are not adaptable to synonym rewriting, insertion of noisy characters, and new fraud templates, and have high maintenance costs and are prone to missed detection.

[0004] Second, end-to-end solutions based on deep learning are highly dependent on the distribution of training data. When the distribution of fraudulent scripts drifts, frequent retraining is required, making it difficult to achieve continuous adaptive updates.

[0005] Third, most large-scale model-based similarity retrieval solutions use a single general semantic similarity, without systematically integrating keyword distribution, frequent itemsets, and structural features in the fraud field, resulting in insufficient targeting of fraud scenarios.

[0006] Fourth, existing feedback mechanisms mostly apply to the review process or the overall model level, lacking fine-grained, learnable optimization mechanisms for few-shot sample selection strategies and multi-path similarity fusion weights.

[0007] Therefore, it is necessary to propose a large-scale model training method for fraudulent text scenarios, which combines fraud profiling, multi-source similarity feature fusion, and feedback adaptive weight adjustment, in order to continuously improve recognition accuracy and robustness in the ever-evolving environment of fraudulent rhetoric. Summary of the Invention

[0008] This invention addresses the problems of existing technologies by providing a large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation. This invention operates without relying on external vector databases or additional large-scale model training; it only requires statistical modeling and similarity calculation on an existing case library, facilitating rapid deployment and migration across different business scenarios.

[0009] The technical solutions adopted in this invention are as follows:

[0010] A large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation includes the following steps:

[0011] S1: Clean and normalize the input text and historical cases, and perform noise filtering according to the effective length threshold;

[0012] S2: Extract fraud keywords from the screened fraud cases, construct fraud profiles through Naive Bayes statistics and Apriori frequent itemset mining, and calculate the fraud likelihood scores of the current input text and candidate cases based on the profiles.

[0013] S3: Calculate multi-component text similarity between the current input text and candidate cases and fuse them with weights to obtain text similarity. Blend the text similarity with the fraud likelihood score with weights to obtain basic relevance. Extract structured features to calculate feature similarity. Calculate label similarity based on label-aware rules. Blend the basic relevance, feature similarity, and label similarity with weights in three ways to obtain the final relevance score.

[0014] S4: Filter candidate cases based on relevance threshold and sort them in descending order. Select the Top N few-shot examples and generate structured prompt fragments to input into the large model to perform fraud identification.

[0015] S5: Receives feedback data containing model prediction results, manual verification results, and similarity components. Based on the verification labels, it performs incremental updates on the fusion weights corresponding to basic correlation, feature similarity, and label similarity, and performs non-negative constraint and normalization processing to achieve adaptive weight adjustment of feedback.

[0016] Furthermore, the large model is a large language model (LLM).

[0017] Furthermore, the multi-component text similarity is obtained by weighted fusion of keyword Jaccard similarity, character n-gram cosine similarity, Jaro-Winkler similarity, longest common substring similarity, and length similarity.

[0018] Furthermore, the structured features include keyword density, length normalization value, and numerical features;

[0019] The feature similarity is obtained by weighted fusion of keyword Jaccard consistency, density consistency, length consistency, and numerical feature consistency.

[0020] Furthermore, the label perception rule is defined in segments: when the target classification and the case classification are the same, the label similarity is 1.0; when the case classification is empty, the label similarity is 0.8 to 0.95; and when the target classification and the case classification are different, the label similarity is 0.5 to 0.8.

[0021] Furthermore, the incremental update uses a fixed learning rate, with the learning rate ranging from 0.01 to 0.15, and assigns a positive or negative update direction based on whether the feedback is marked as correct or incorrect.

[0022] Feedback data reception includes online and offline modes. In online mode, a single weight update is performed when valid feedback is received and manual review is triggered. In offline mode, a batch weight update is performed when a scheduled task or calendar cycle is triggered.

[0023] Furthermore, the feedback data includes prediction results and verification tags based on Top1 or TopN examples. In Top1 mode, weight updates are performed based on the feedback of the most relevant single sample, while in TopN mode, weight updates are performed based on the feedback of the overall prediction results of TopN examples.

[0024] Furthermore, the value of N in TopN ranges from 3 to 10, and the correlation threshold of the final correlation score ranges from 0.05 to 0.15.

[0025] Furthermore, the sum of the fusion weights corresponding to basic relevance, feature similarity, and label similarity is 1 and all are non-negative. Specifically, the weight of basic relevance ranges from 0.5 to 0.85, the weight of feature similarity ranges from 0.1 to 0.3, and the weight of label similarity ranges from 0.05 to 0.2.

[0026] Furthermore, in the construction of fraud profiles, the minimum support value for Apriori frequent itemset mining ranges from 0.1 to 0.5; the effective length threshold includes a minimum effective length of 3 to 20 characters and a maximum effective length of 2000 to 10000 characters.

[0027] The present invention has the following beneficial effects:

[0028] By integrating five text similarity components—keyword Jaccard, character n-gram cosine, Jaro-Winkler, longest common substring, and length similarity—and taking into account various variant features such as keyword overlap, local fragment distribution, misspellings, and slight deformations, the recall capability against paraphrased fraudulent rhetoric and noise interference is improved.

[0029] By constructing fraud profiles based on high-quality fraud cases, and utilizing Naive Bayes to statistically analyze keyword distribution and Apriori mining to mine frequent itemsets, similarity calculation is integrated with prior knowledge in the fraud domain, reducing the risk of false positives and false negatives caused by relying solely on general text similarity.

[0030] By using a label-aware mechanism to differentiate between similar, unlabeled, and dissimilar cases, the selected few-shot examples are made more relevant to the target classification task, reducing interference from cross-class samples.

[0031] Through a feedback-driven incremental weight update mechanism, after obtaining model prediction results and manual verification feedback, the three-way fusion weights of basic relevance, feature similarity and label similarity are adjusted online or offline, enabling the system to automatically adjust the strategy as the distribution of fraud samples changes, reducing the cost of frequent manual adjustments and rule base maintenance.

[0032] By using effective length thresholds and relevance thresholds to filter low-quality samples and low-relevance candidates, invalid or misleading samples are prevented from entering the few-shot notification, thus improving system stability. Attached Figure Description

[0033] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0034] Combined with appendix Figure 1 The specific implementation of the present invention will be described in detail. This implementation takes the anti-fraud text recognition scenario as the application carrier and fully realizes the large model fraud recognition training process based on multi-similarity fusion and feedback adaptation.

[0035] The input text to be detected and the historical case text stored in the system are preprocessed sequentially. The text is cleaned by removing HTML tags, URL links starting with http: / / or https: / / , ASCII 0x00~0x1F and 0x7F control characters, compressing consecutive whitespace characters into a single space, converting full-width characters to half-width characters, and standardizing the mapping of traditional and variant characters to complete the text standardization process. On this basis, the text is expanded with synonyms and variants to improve the robustness of subsequent keyword matching.

[0036] The processed text is subjected to noise filtering according to the preset effective length threshold. Abnormal text with a length less than the minimum effective length or greater than the maximum effective length is removed, and valid text that meets the length requirements is retained for subsequent processing.

[0037] Fraud-related keywords are extracted from high-quality fraud cases. The cleaned fraud case text is used as the data source. The Naive Bayes algorithm is used to calculate the distribution probability of each fraud keyword in the fraud text. Combined with Laplace smoothing, the conditional probability of the keyword under the fraud category is calculated to obtain the basic fraud likelihood score of the keyword. At the same time, the keyword set of each case is used as transaction data. The Apriori algorithm is used to mine the frequent itemsets of fraud keywords and record the frequent itemsets that meet the minimum support requirement and their relative support.

[0038] For any text to be processed, the Naive Bayes statistical score and the Apriori frequent itemset score are calculated based on the extracted keyword set. The average of the two scores is used as the fraud likelihood score of the text, thereby completing the construction of a fraud profile. Based on the fraud profile, the fraud likelihood scores of the current input text and the candidate case text are calculated respectively.

[0039] Calculate multi-dimensional text similarity components for the current input text and candidate case texts. Each component includes keyword Jaccard similarity.

[0040] The text similarity is calculated by weighting and fusing the following similarity components: character n-gram cosine similarity, Jaro-Winkler similarity, longest common substring similarity, and length similarity. The expression for calculating the text similarity is as follows:

[0041] ,

[0042] Each weight satisfies , The calculation methods for each similarity component are as follows:

[0043] Keyword Jaccard similarity is calculated based on a set of fraudulent keywords extracted from the text, where... For the first sample, For the second text, For from text The extracted keyword set, Let y be the set of keywords extracted from the text y. The set of keywords common to both texts. The set of all unique keywords in two text segments is expressed as:

[0044] , ,

[0045] Character n-gram cosine similarity is obtained by constructing character n-gram frequency vectors and calculating the vector cosine similarity, where... The second similarity component represents the sample and The degree of similarity between them For the first sample, For the second text, a and b are... , The vectors obtained by constructing them respectively For vector dot product, The Euclidean norm of a vector, normalized over the dot product, is expressed as:

[0046] ,

[0047] in Let x be the n-gram vector corresponding to the text. Let y be the n-gram vector corresponding to the text y. ;

[0048] The Jaro-Winkler similarity expression is: , ;

[0049] in, The third similarity component represents and The degree of similarity between them For the first sample, For the second text, This is an intermediate variable used to store the calculated Jaro-Winkler similarity score. This is the Jaro-Winkler similarity function, which measures the similarity between two texts at the character level.

[0050] The expression for the longest common substring similarity is:

[0051] ,

[0052] in, The fourth similarity component represents and The degree of similarity between them , , respectively and The length of the string.

[0053] The length similarity expression is:

[0054] .

[0055] in, The fourth similarity component This refers to the set of keywords extracted from cleaned and normalized text based on a predefined set of fraud-related keywords. To normalize the text, based on the character length... Character n-gram frequency vectors constructed using a sliding window JW For the Jaro-Winkler similarity function, and Let x and y be the text lengths, respectively. This is the absolute value of the difference in length between the two text segments. The function is the length of the longest common substring. The cardinality of the set or a string, length The larger of the two lengths is used for normalization.

[0056] The range of values ​​for each weight is limited to:

[0057] , , ], , The preferred option is: .

[0058] Therefore, by setting weights within the above range, a comprehensive measurement of keyword overlap, local segment distribution, character-level similarity, continuous segment duplication, and text length differences can be achieved, thereby obtaining a comprehensive text similarity score that better meets the needs of fraudulent text identification.

[0059] The above comprehensive text similarity and fraud likelihood score are weighted and fused to obtain the basic relevance. The expression for calculating the basic relevance is as follows:

[0060] ,

[0061] in, For text similarity functions, , ( ) represents the fraud likelihood score between the current text and candidate texts obtained based on fraud profiling, with text similarity weights. The value range is 0.5-0.8, with the preferred value being... .

[0062] Subsequently, structured features such as keyword density, normalized length value, and numerical features are extracted from the text. The similarity of each feature dimension is calculated and weighted to obtain the feature similarity. The specific calculation expression is as follows:

[0063]

[0064] Wherein, the weight coefficients satisfy and , Let x and y represent the total similarity of the feature layer, and x and y represent two samples to be compared. , , , The weights of the four sub-components, Jaccard similarity at the keyword level. Based on Normalized similarity of features For length similarity components, For numerical feature similarity.

[0065] The calculations for each item are as follows: Keyword Jaccard similarity Used to measure keyword overlap ratio; density consistency. The expression is:

[0066] ,

[0067] in, For two samples to be compared, and For samples x and y in the features The value on,

[0068] To normalize using a larger scale, the maximum value of the three values ​​is taken. To truncate the normalized difference to no more than 1 and avoid out-of-bounds errors caused by abnormally large differences, To prevent division by zero of extremely small positive numbers; length consistency. The expression is:

[0069] ,

[0070] in and They are respectively The length of the text. This is the difference in length.

[0071] Numerical feature consistency The text is assigned a value of 1 or 0 based on whether it contains the same type of multi-digit feature.

[0072] According to the label awareness rules, the label similarity between the current input text and the candidate case text is calculated. The label similarity is defined in segments. When the target category and the case category are the same, the label similarity value is 1.0. When the case category is empty and unlabeled, the label similarity value is 0.8 to 0.95 (preferably 0.9). When the target category and the case category are different, the label similarity value is 0.5 to 0.8 (preferably 0.7).

[0073] The basic relevance, feature similarity, and label similarity are weighted and fused together to obtain the final relevance score. The fusion expression is as follows:

[0074] ,

[0075] thus, The feature similarity is based on keyword density, length normalization, and numerical features. The label similarity is obtained based on text category information; the three weights satisfy:

[0076] , .

[0077] The three weights satisfy the condition that their sum is 1 and all are non-negative. , , .

[0078] , , These are the weights of the basic relevance component, the feature similarity component, and the label similarity component, respectively. In this embodiment, it is preferable to take... , , .

[0079] Candidate case texts are filtered based on a preset relevance threshold, and candidate cases with a final relevance score not higher than the threshold are removed. The remaining candidate cases are sorted in descending order of their final relevance scores, and the top N candidate cases are selected as few-shot examples. The selected examples are integrated with the current input text to form a structured prompt fragment. This prompt fragment is input into a large language model, which performs fraud identification inference based on the prompt fragment and outputs the fraud risk judgment result and corresponding explanation information for the current input text.

[0080] The system receives feedback data including large model prediction results, manual verification results, and scores for each similarity component. Feedback data reception supports both online and offline modes. In online mode, single weight updates are performed upon receiving valid feedback and triggering manual review. In offline mode, batch weight updates are performed when triggered by scheduled tasks or preset periods. Based on the correct or incorrect verification markers in the feedback, incremental updates are performed on the three-way fusion weights corresponding to basic relevance, feature similarity, and label similarity. Incremental updates use a fixed learning rate. Let the feedback marker be... The basic relevance, feature similarity, and label similarity of the corresponding samples are respectively

[0081] , , The learning rate is The update expressions for the three weights are as follows:

[0082] ,

[0083] ,

[0084] .

[0085] in, , , The three-way fusion weights at the current moment correspond to basic relevance, feature similarity, and label similarity, respectively.

[0086] After the update, the weights are subjected to non-negativity constraints and normalization. The non-negativity constraint process is as follows:

[0087] ,

[0088] ,

[0089] ,

[0090] Where S is the sum of the three original weights, used as the normalization denominator. Based on basic correlation, For feature similarity, This represents the label similarity. , , This represents the final weight after normalization.

[0091] The normalization process involves dividing the weights after each constraint by the sum of the three weights, ensuring that the updated three weights still satisfy the constraint that the sum is 1 and non-negative. Through the above feedback-driven adaptive weight adjustment, the quality of few-shot example selection and the fraud detection effect of the large model are continuously optimized.

[0092] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements without departing from the principle of the present invention, and these improvements should also be considered within the scope of protection of the present invention.

Claims

1. A large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation, characterized in that: Includes the following steps: S1: Clean and normalize the input text and historical cases, and perform noise filtering according to the effective length threshold; S2: Extract fraud keywords from the screened fraud cases, construct fraud profiles through Naive Bayes statistics and Apriori frequent itemset mining, and calculate the fraud likelihood scores of the current input text and candidate cases based on the profiles. S3: Calculate multi-component text similarity between the current input text and candidate cases and fuse them with weights to obtain text similarity. Blend the text similarity with the fraud likelihood score with weights to obtain basic relevance. Extract structured features to calculate feature similarity. Calculate label similarity based on label-aware rules. Blend the basic relevance, feature similarity, and label similarity with weights in three ways to obtain the final relevance score. S4: Filter candidate cases based on the relevance threshold of the final relevance score and sort them in descending order. Select the Top N few-shot examples and generate structured prompt fragments to input into the large model to perform fraud identification. S5: Receives feedback data containing model prediction results, manual verification results, and similarity components. Based on the verification labels, it performs incremental updates on the fusion weights corresponding to basic correlation, feature similarity, and label similarity, and performs non-negative constraint and normalization processing to achieve adaptive weight adjustment of feedback.

2. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: The large model mentioned is a large language model.

3. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: The multi-component text similarity is obtained by weighted fusion of keyword Jaccard similarity, character n-gram cosine similarity, Jaro-Winkler similarity, longest common substring similarity, and length similarity.

4. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: The structured features include keyword density, length normalization value, and numerical features; The feature similarity is obtained by weighted fusion of keyword Jaccard consistency, density consistency, length consistency, and numerical feature consistency.

5. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: The label perception rule is defined in segments. When the target classification and the case classification are the same, the label similarity is 1.

0. When the case classification is empty, the label similarity is 0.8 to 0.

95. When the target classification and the case classification are different, the label similarity is 0.5 to 0.

8.

6. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: The incremental update uses a fixed learning rate, with the learning rate ranging from 0.01 to 0.15, and assigns a positive or negative update direction based on whether the feedback is marked as correct or incorrect. Feedback data reception includes online and offline modes. In online mode, a single weight update is performed when valid feedback is received and manual review is triggered. In offline mode, a batch weight update is performed when a scheduled task or calendar cycle is triggered.

7. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: Feedback data includes prediction results and verification tags based on Top1 or TopN examples. In Top1 mode, weight updates are performed based on the feedback of the most relevant single sample, while in TopN mode, weight updates are performed based on the feedback of the overall prediction results of TopN examples.

8. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: In TopN, N ranges from 3 to 10, and the correlation threshold ranges from 0.05 to 0.

15.

9. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: The sum of the fusion weights corresponding to basic relevance, feature similarity, and label similarity is 1 and none of them are negative. Specifically, the weight of basic relevance ranges from 0.5 to 0.85, the weight of feature similarity ranges from 0.1 to 0.3, and the weight of label similarity ranges from 0.05 to 0.

2.

10. The large-scale fraud identification training method based on multi-similarity fusion and feedback adaptation as described in claim 1, characterized in that: In the construction of fraud profiles, the minimum support value of Apriori frequent itemset mining ranges from 0.1 to 0.5; the effective length threshold includes a minimum effective length of 3 to 20 characters and a maximum effective length of 2000 to 10000 characters.

Images