Fraudulent user identification method and apparatus

Abstract

The embodiment of the specification provides a fraud user identification method and device, the method comprises: obtaining a plurality of intention sequences corresponding to a plurality of conversation records of a target user in a preset time window, each intention sequence is formed by intention labels corresponding to each message in the corresponding conversation record; the intention label is used for indicating the intention of the target stage in the fraud scene; the fraud scene is divided into a plurality of stage intentions in advance; for each intention sequence, respectively determine the path distance between each path distance and the standard intention path reflecting the fraud script, according to each path distance, determine the compliance feature of the target user about the fraud script; determine the comprehensive feature of the target user, wherein the comprehensive feature comprises the compliance feature; input the comprehensive feature into the decision model to obtain the probability that the target user is a fraud user. The accuracy of fraud user identification can be improved.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of artificial intelligence, and more particularly to methods and apparatus for identifying fraudulent users. Background Technology

[0002] With the rapid development of social networks and instant messaging platforms, sophisticated online scams disguised as dating and investment schemes are becoming increasingly prevalent, damaging, and sophisticated in their deception. Current technologies largely rely on predefined sensitive word libraries, single-turn dialogue intent classification, or isolated behavioral statistics to identify fraudulent users. These solutions possess a certain degree of ability to identify overtly fraudulent tactics used by scammers.

[0003] However, existing technologies are severely inadequate in detecting highly disguised statements, making it difficult to effectively distinguish between users' natural social discussions and those of fraudulent users. This not only results in a high false negative rate for fraudulent users but also leads to the misidentification of a large number of legitimate users, failing to meet the accuracy requirements for fraudulent user identification.

[0004] Therefore, there is a need to provide an improved solution that can enhance the accuracy of fraudulent user identification. Summary of the Invention

[0005] This specification describes one or more embodiments of a fraudulent user identification method and apparatus that can improve the accuracy of fraudulent user identification.

[0006] Firstly, a method for identifying fraudulent users is provided, including:

[0007] Multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window are obtained. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in the fraud scenario. The fraud scenario is pre-divided into multiple stage intents.

[0008] For each intent sequence, determine the path distance between it and the preset standard intent path reflecting the fraud script, and determine the target user's conformity with the fraud script based on each path distance;

[0009] Determine the comprehensive characteristics of the target user, including the matching degree characteristics;

[0010] The comprehensive features are input into the decision model to obtain the probability that the target user is a fraudulent user.

[0011] In one possible implementation, obtaining multiple intent sequences corresponding to multiple dialogue records of the target user within a preset time window further includes:

[0012] For any current message in a dialogue record, the current message and its associated historical context are input into a large language model, which then determines the intent tag corresponding to the current message from the intent tag set; the intent tag set includes tag indications of intents at multiple stages in a fraud scenario.

[0013] In one possible implementation, it also includes:

[0014] Based on multiple conversation records, the number of active chat conversations of the target user during the same period is counted.

[0015] Using semantic-based text similarity, the content duplication rate between different dialogue records is calculated;

[0016] Based on the number of chat conversations and the content repetition rate, the first behavioral pattern feature of the target user is determined, and the comprehensive feature also includes the first behavioral pattern feature.

[0017] In one possible implementation, it also includes:

[0018] Based on multiple conversation records, the average number of messages per day, the proportion of intimate messages, and the average reply delay time per conversation were statistically analyzed.

[0019] Based on the average number of messages per day in a single session, the proportion of intimate messages, and the average reply delay, the second behavioral pattern characteristics of the target user are determined, and the comprehensive characteristics also include the second behavioral pattern characteristics.

[0020] In one possible implementation, it also includes:

[0021] Based on the multiple dialogue records, a consistency score for the cross-session identity description information of the target user is determined, and the comprehensive feature also includes the consistency score.

[0022] In one possible implementation, it also includes:

[0023] Calculate the time interval between the first occurrence of the first intent label and the second intent label in each intent sequence; the first intent label indicates the intent to establish an emotional connection, and the second intent label indicates the intent to guide a high-risk operation.

[0024] For each time interval obtained from each intent sequence, the arithmetic mean or minimum value is calculated as the first and last intent span feature of the target user. The comprehensive feature also includes the first and last intent span feature.

[0025] In one possible implementation, it also includes:

[0026] Determine the percentage of pre-defined high-risk intent tags in each intent sequence;

[0027] For the proportion of each intent sequence, calculate the maximum value or weighted average value as the high-risk intent density feature. The comprehensive feature also includes the high-risk intent density feature.

[0028] In one possible implementation, the comprehensive feature is a feature set consisting of features from multiple dimensions, and the decision model is a decision tree model; the method further includes:

[0029] Traverse the feature subsets in the comprehensive features that do not contain the target feature, evaluate the difference between the feature subsets and the feature union on the model prediction output, and determine the feature contribution of the target feature, wherein the feature union is the union of the feature subsets and the target feature.

[0030] In one possible implementation, the comprehensive feature is a feature set consisting of features from multiple dimensions, the decision model is a logistic regression model, and the method further includes:

[0031] Obtain interactive feature terms generated by applying conditional threshold interactions to different features in the feature set;

[0032] The interactive feature terms and the feature set are input together into the logistic regression model for joint parameter optimization.

[0033] In one possible implementation, the method further includes:

[0034] Obtain the verification results of manual review based on the probability that the target user is a fraudulent user;

[0035] If the review result is a missed report or a false report, then defect tracing is performed to obtain defect attribution results, which include at least one of the following: intent recognition defect, standard intent path failure, and decision model deviation;

[0036] Based on the defect attribution results, update at least one of the following: intent recognition process, standard intent path, and decision model.

[0037] Secondly, a fraudulent user identification device is provided, comprising:

[0038] The acquisition unit is used to acquire multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in the fraud scenario. The fraud scenario is pre-divided into multiple stage intents.

[0039] The first determining unit is used to determine the path distance between each intent sequence acquired by the acquiring unit and a preset standard intent path reflecting a fraud script, and to determine the target user's conformity to the fraud script based on each path distance.

[0040] The second determining unit is used to determine the comprehensive characteristics of the target user, including the conformity characteristics obtained by the first determining unit.

[0041] The identification unit is used to input the comprehensive features obtained by the second determining unit into the decision model to obtain the probability that the target user is a fraudulent user.

[0042] Thirdly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first aspect.

[0043] Fourthly, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method of the first aspect.

[0044] The method and apparatus provided in the embodiments of this specification first acquire multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in a fraud scenario. The fraud scenario is pre-divided into multiple stage intents. Then, for each intent sequence, the path distance between it and a preset standard intent path reflecting the fraud script is determined. Based on each path distance, the conformity feature of the target user with respect to the fraud script is determined. Next, the comprehensive feature of the target user is determined, including the conformity feature. Finally, the comprehensive feature is input into a decision model to obtain the probability that the target user is a fraud user. As can be seen from the above, the embodiments of this specification effectively capture the fraud evolution logic in dialogue records by converting unstructured dialogue records into intent sequences composed of multi-stage intents and quantifying their path distances to preset standard intent paths reflecting the fraud script, thereby generating conformity features. This conformity feature, combined with the comprehensive features of the target user, significantly improves the model's early identification accuracy for scripted, long-term, complex online fraud after inputting the comprehensive features into the decision model. At the same time, it reduces the false negative rate of fraudulent users caused by highly disguised rhetoric and the false positive rate of normal interactions, thereby improving the accuracy of fraudulent user identification. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification;

[0047] Figure 2 A flowchart of a fraudulent user identification method according to one embodiment is shown;

[0048] Figure 3 An illustration of intent recognition according to one embodiment is shown;

[0049] Figure 4 This diagram illustrates a consistency scoring method according to one embodiment.

[0050] Figure 5 A schematic diagram of a decision architecture according to one embodiment is shown;

[0051] Figure 6 A schematic block diagram of a fraudulent user identification device according to one embodiment is shown. Detailed Implementation

[0052] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0053] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification. This scenario involves identifying fraudulent users. Specifically, by analyzing multiple conversation records of a target user within a preset time window, the probability that the target user is a fraudulent user is determined. Typically, a fraudulent user is a scammer who initiates a pre-set fraudulent activity. This activity could involve using dating platforms, social media, etc., to gain the victim's trust under the guise of romance or friendship, then inducing them to deposit money or place bets on fake investment platforms or gambling websites, ultimately resulting in the victim being unable to withdraw funds and becoming unreachable. It is understood that the preset time window can be represented by a start and end point, and the duration can be flexibly set, such as 1 day, 2 days, 3 days, 1 week, etc. The target user is involved in all multiple conversation records, but different conversation records have different chat partners. The target user engages in conversations with multiple chat partners concurrently within the preset time window. Each conversation can also be called a dialogue, and one conversation corresponds to one dialogue record.

[0054] Reference Figure 1A conversation log contains multiple messages arranged chronologically. Each message contains message content and its associated unique timestamp. For example, message 1's message content is "Are you tired from work lately?", timestamp T1 (2023-10-01 14:30), ...; message N's message content is "There's an internal channel...", timestamp TN (2023-10-02 09:05), ...; message M's message content is "Click the link to view", timestamp TM (2023-10-03 16:40), .... These timestamped messages form a message sequence in chronological order. This embodiment employs multi-stage intent classification, dividing each message into specific stages within the lifecycle of a pre-defined fraudulent behavior based on its semantic purpose. Each message has a corresponding stage intent, which can be represented by intent tags. As the interaction progresses, the intent tags corresponding to each message exhibit a clear stage-wise evolution trajectory. Early messages in the message sequence mostly mapped to low-risk intent tags such as "building emotional connections" or "daily interactions." Mid-term messages gradually transitioned to medium-risk intent tags such as "building trust" and "confirming relationships." Later messages, however, concentrated on high-risk intent tags such as "guiding investment" or "requesting funds." This evolutionary path is not a random divergence of natural social interaction, but rather strictly follows a standardized operational process pre-set by fraudulent users, revealing a highly templated and scripted path. The aforementioned risk refers to the possibility that the target user is a fraudulent user.

[0055] In this embodiment, the path distance between the actual intent sequence and the preset standard intent path is calculated to generate a feature representing the user's conformity to the fraud script. Based on this conformity feature, fraudulent user identification can output a high-risk probability in the early, latent stage before the fraudulent user completes their financial harvest. This effectively penetrates the surface of highly disguised rhetoric, achieving accurate characterization and pre-emptive interception of scripted fraudulent behavior, thus improving the accuracy of fraudulent user identification.

[0056] Figure 2 This diagram illustrates a flowchart of a fraudulent user identification method according to one embodiment, which can be based on... Figure 1 The implementation scenario is shown. For example... Figure 2As shown, the fraudulent user identification method in this embodiment includes the following steps: Step 21, obtaining multiple intent sequences corresponding to multiple dialogue records of the target user within a preset time window, each intent sequence being formed by intent tags corresponding to each message in the corresponding dialogue record; the intent tags are used to indicate the target stage intent in the fraud scenario; the fraud scenario is pre-divided into multiple stage intents; Step 22, for each intent sequence, determining the path distance between it and the preset standard intent path reflecting the fraud script, and determining the target user's conformity feature with respect to the fraud script based on each path distance; Step 23, determining the target user's comprehensive features, including the conformity feature; Step 24, inputting the comprehensive features into a decision model to obtain the probability that the target user is a fraudulent user. The specific execution method of each of the above steps is described below.

[0057] First, in step 21, multiple intent sequences corresponding to multiple dialogue records of the target user within a preset time window are obtained. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in the fraud scenario. The fraud scenario is pre-divided into multiple stage intents. It can be understood that when the target user sends a message, the intent of the message can be identified to obtain the intent tag corresponding to the message.

[0058] In one example, obtaining multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window also includes:

[0059] For any current message in a dialogue record, the current message and its associated historical context are input into a large language model, which then determines the intent tag corresponding to the current message from the intent tag set; the intent tag set includes tag indications of intents at multiple stages in a fraud scenario.

[0060] In this example, inputting historical context along with the current message into a large language model helps eliminate semantic ambiguity in the current message. Simultaneously, fine-grained classification based on pre-defined multiple stage intentions can identify highly deceptive rhetoric from fraudulent users, accurately mapping unstructured messages to standardized stage intentions. This approach not only achieves a dimensionality upgrade from isolated message matching to continuous intent sequences but also provides structured, alignable data for subsequent calculations of the target user's fit with the fraud script, fundamentally improving the early identification accuracy of complex online fraud.

[0061] Figure 3 An illustration of intent recognition according to one embodiment is shown. (Refer to...) Figure 3The input to the large language model is the current message and its historical context, while the output is the intent label of the current message. Specifically, for any dialogue record of the target user, each current message is sequentially traversed, and this current message and its associated historical context are used as input data. Then, combined with pre-defined prompts, the input data is sent to the large language model for processing, transforming the unstructured dialogue content into a structured, control-meaningful sequence of intents. The prompts contain definitions of semantic analysis task objectives, intent label sets, and multiple inference criteria to guide the model in performing intent discrimination within the complete dialogue context.

[0062] The semantic analysis task objective could be to analyze the current message in conjunction with the provided historical context and identify the most representative intent tags with the highest risk level from a predefined set of intent tags.

[0063] The intent tag set predefines multiple stages of intent within the lifecycle of a fraud scenario, serving as a candidate set for the model's output. This set can cover intents such as contact establishment, daily interaction, emotional connection building, relationship establishment, investment guidance, platform traffic generation, and demand for funds. For example, the intent tag set... Among them, CI represents the intention to establish contact, initiating conversations under the pretext of sending the wrong message, business cooperation, or looking for old friends; FI represents the intention to engage in daily interaction, with normal polite responses and sharing of trivial matters in life, without any obvious emotional inclination; EB represents the intention to build emotional connections, engaging in in-depth conversations about private topics, showing excessive concern, and sharing past emotional pain to gain sympathy or build trust; RE represents the intention to establish a relationship, explicitly proposing to establish a romantic or long-term partnership, using affectionate terms; IG represents the intention to guide investment, mentioning side hustles, investment profits, system vulnerabilities, showing profit charts, or inducing users to click / download unknown links; PD represents the intention to drive traffic to the platform, guiding users to private chat tools under the pretext of security, privacy, poor signal, or convenient phone calls; FR represents the intention to solicit funds, directly demanding cash, loans, top-ups, or requiring payment of various fees / taxes.

[0064] Furthermore, the model follows several pre-defined inference criteria when making judgments. For example, the context-dependent criterion requires that if a single message is semantically ambiguous (e.g., "Okay"), it must be determined through historical dialogues whether it is a confirmation of "investment advice" or a "general greeting." The high-risk priority principle prioritizes messages containing multiple intentions, outputting the label most valuable for system risk warning (e.g., if it contains both daily interaction intentions and investment guidance intentions, it should be judged as investment guidance intentions). The metaphor recognition criterion accurately identifies industry jargon used by scammers (e.g., "eat meat," "take you flying," "system delay," etc.).

[0065] After the large language model completes inference, it outputs structured data containing target intent tags, judgment logic, risk level indicators, and key evidence words. Intent tags corresponding to each message are extracted from this data and then continuously concatenated and aggregated according to the chronological order of each message in the dialogue record, ultimately generating a multi-stage intent sequence representing the evolutionary trajectory of the target user's behavior. This intent sequence eliminates redundancy and unstructured noise in the original text, providing standardized and aligned data for subsequent calculation of feature index values.

[0066] For example, a dialogue record contains n messages. For each message and its historical context, a large language model is requested to output the corresponding intent label, and finally a structured intent sequence is generated. This serves as the basis for subsequent modeling and feature extraction. Here, i1 is the intent label corresponding to the first message, i2 is the intent label corresponding to the second message, ..., i n This is the intent tag corresponding to the nth message.

[0067] Then, in step 22, for each intent sequence, the path distance between it and the preset standard intent path reflecting the fraud script is determined. Based on each path distance, the target user's conformity to the fraud script is determined. It can be understood that the standard intent path is the same as the standard intent sequence; the more a user's intent sequence conforms to the standard intent sequence, the more likely that user is a fraudulent user.

[0068] In this embodiment of the specification, the conformity feature is a temporal feature further extracted based on each intent sequence. Based on multiple intent sequences of the target user, the path distances between each sequence and a preset standard intent path reflecting the fraud script are first determined. Then, based on each path distance, the conformity feature of the target user with respect to the fraud script is comprehensively determined.

[0069] For example, for a target user, there are K conversation records within a preset time window, and the kth conversation record is denoted as c. k The corresponding intent sequence is ,in , , Represents the nth k The timestamp of the message.

[0070] The aforementioned path distance can be a normalized value of the edit distance between the actual intent sequence and the standard intent path. The following example illustrates how to calculate the above compliance feature.

[0071] First, define the standard path as... For the k-th dialogue record Preserve the order in which each intent tag first appears, and extract the deduplicated and ordered intent sequence: ,calculate Compared with standard intent path The normalized edit distance is used as the aforementioned path distance: Edit distance To make the sequence Convert to The minimum number of single-character editing operations required, including insertion, deletion, and replacement. The larger the value, the more the dialogue records conform to the script.

[0072] Then, feature aggregation is performed based on the user dimension of path distance. Here, a weighted length average is used to obtain the target user's matching feature: , where n k Representing session c k The total number of messages in the message.

[0073] Next, in step 23, the comprehensive characteristics of the target user are determined, including the conformity feature. It is understood that the comprehensive characteristics can be a feature set consisting of features from multiple dimensions, with the conformity feature being one of those dimensions.

[0074] In one example, it also includes:

[0075] Based on multiple conversation records, the number of active chat conversations of the target user during the same period is counted.

[0076] Using semantic-based text similarity, the content duplication rate between different dialogue records is calculated;

[0077] Based on the number of chat conversations and the content repetition rate, the first behavioral pattern feature of the target user is determined, and the comprehensive feature also includes the first behavioral pattern feature.

[0078] Optionally, an active chat conversation can be defined as a conversation record in which the number of two-way interaction messages between the target user and a specific object reaches a set threshold within a preset statistical period, and the time interval between the last interaction and the current time does not exceed a preset validity period.

[0079] In this example, the first behavioral pattern feature, also known as the broad-net feature, is a type of interaction topology feature that quantifies the operational characteristics of a suspect from a behavioral pattern perspective. It generates the first behavioral pattern feature by statistically analyzing the number of active chat conversations of the target user within a preset time window and combining this with a semantic-based text similarity algorithm to calculate the content repetition rate between different conversation records. This approach effectively overcomes the technical bottleneck of traditional risk control methods that only focus on isolated conversations and cannot identify parallel conversations of fraudulent users. Compared to shallow rules that rely on keyword matching, semantic-level repetition rate calculation can penetrate highly disguised verbal variations such as synonym substitution and word order rearrangement, accurately capturing cross-conversation reuse traces of verbal templates. By integrating concurrency scale and content reuse into a combined feature, it can significantly distinguish from normal social behavior, providing highly discriminative input, thereby significantly improving the early identification accuracy of mass-produced traffic-driving accounts and assembly-line fraud, and effectively suppressing false positives against genuine multi-line social users.

[0080] In one example, it also includes:

[0081] Based on multiple conversation records, the average number of messages per day, the proportion of intimate messages, and the average reply delay time per conversation were statistically analyzed.

[0082] Based on the average number of messages per day in a single session, the proportion of intimate messages, and the average reply delay, the second behavioral pattern characteristics of the target user are determined, and the comprehensive characteristics also include the second behavioral pattern characteristics.

[0083] Optionally, based on a database of affectionate terms and a small emotion recognition model, the proportion of intimate messages in the conversation record can be calculated.

[0084] In this example, the second behavioral pattern feature, also known as the deep penetration feature, is a type of interaction topology feature that quantifies the suspect's operational characteristics from a behavioral pattern perspective. This second behavioral pattern feature is generated by statistically analyzing the average daily number of messages per session, the proportion of intimate messages, and the average response delay. This approach effectively overcomes the technical bottleneck of traditional risk control methods that only focus on text content and cannot quantify the intensity of emotional manipulation and the rhythm of genuine responses. Compared to isolated behavioral statistics, this feature integrates interaction frequency, emotional intensity, and temporal delay in a multi-dimensional way, objectively reconstructing the typical operational patterns of fraudulent users in one-on-one scenarios, such as high-intensity resource allocation, excessive concern, and abnormally rapid responses or regular concealment. Incorporating this feature into the comprehensive feature set enables the decision-making model to accurately distinguish between natural deep social interactions and industrialized fraud processes, triggering early warnings before victims establish strong trust relationships, and significantly improving the interception timeliness of highly concealed, long-term emotional fraud.

[0085] In one example, it also includes:

[0086] Based on the multiple dialogue records, a consistency score for the cross-session identity description information of the target user is determined, and the comprehensive feature also includes the consistency score.

[0087] In this example, consistency scoring is a type of interactive topological feature that quantifies the operational characteristics of a suspect from the perspective of identity authenticity. By extracting self-description information from multiple parallel conversations of the target user and performing cross-contextual comparison based on common-sense logic and background coherence, an identity description consistency score is generated. This approach effectively overcomes the technical bottleneck of traditional risk control, which focuses only on single-segment dialogue content and cannot identify the multi-role role-playing and dynamic persona packaging of fraudulent users. Compared to shallow rule matching, this feature introduces logical verification dimensions such as geographical and spatiotemporal constraints and professional resume consistency, enabling it to penetrate surface-level rhetoric and accurately quantify the degree of identity forgery. Incorporating this score into comprehensive features helps distinguish between natural multi-line social interactions and industrialized identity customization, significantly improving the early identification accuracy and interpretability of organized and assembly-line fraud.

[0088] Figure 4 A schematic diagram illustrating a consistency scoring method according to one embodiment is shown. (Refer to...) Figure 4 This embodiment utilizes a large language model to determine the aforementioned consistency score. The model's input consists of multiple dialogue records, such as dialogue record 1, dialogue record 2, ..., dialogue record N, and the output is a consistency score. Cue words can be flexibly set to instruct the large language model to identify logical inconsistencies in the user's descriptions of occupation, geographical location, and life background by comparing multiple dialogue segments. The consistency (personality consistency) among the multiple input dialogue records is evaluated, and a score between [0,1] is output. The lower the score, the more suspicious the user.

[0089] In one example, it also includes:

[0090] Calculate the time interval between the first occurrence of the first intent label and the second intent label in each intent sequence; the first intent label indicates the intent to establish an emotional connection, and the second intent label indicates the intent to guide a high-risk operation.

[0091] For each time interval obtained from each intent sequence, the arithmetic mean or minimum value is calculated as the first and last intent span feature of the target user. The comprehensive feature also includes the first and last intent span feature.

[0092] In this example, the beginning and end intent span feature is a temporal feature further extracted based on each intent sequence. The beginning and end intent span feature is generated by calculating the time interval between the first appearance of the emotional connection intent and the high-risk operation guidance intent in each intent sequence, and then calculating the arithmetic mean or minimum value across sessions. This processing method effectively overcomes the technical bottleneck of relying solely on the logical order of intents and failing to perceive the real time dimension. Compared to static content matching, it directly quantifies the rate of progress and time compression of the fraud lifecycle, accurately identifying the abnormal rhythm of fraudulent users quickly closing their traps. Through the aggregation strategy of mean or extreme values, it retains both the global representation of the overall operational rhythm and captures the most aggressive inducement path targeting key objectives. After incorporating this span feature into the comprehensive feature set, it can keenly distinguish between the long-cycle trust building in natural social interactions and the short-term process of scripted fraud, outputting high-risk probabilities before victims suffer financial losses, significantly improving the timeliness and accuracy of early warnings.

[0093] For example, for the k-th dialogue record c k If both emotional connection intention (EB) and investment guidance intention (IG) exist simultaneously, then calculate... ,in , If any one of these intentions is missing, then... .

[0094] Then retrieve all valid ones. The average value is obtained from the user u dimension .

[0095] We can also introduce the shortest intent span time feature. .

[0096] In one example, it also includes:

[0097] Determine the percentage of pre-defined high-risk intent tags in each intent sequence;

[0098] For the proportion of each intent sequence, calculate the maximum value or weighted average value as the high-risk intent density feature. The comprehensive feature also includes the high-risk intent density feature.

[0099] In this example, the high-risk intent density feature is a temporal feature further extracted based on each intent sequence. By determining the proportion of preset high-risk intent tags in each intent sequence and calculating the maximum value or weighted average across sessions, the high-risk intent density feature is generated. This processing method effectively overcomes the technical bottleneck of relying solely on the frequency of high-risk words and being easily diluted by harmless content in long sessions. Compared to static counting, using a relative proportion objectively reflects the malicious concentration and risk aggregation within a unit of dialogue capacity, accurately depicting the aggressive closing rhythm of fraudulent users' high-frequency pressure and intensive guidance. Through the aggregation strategy of extreme values ​​and weighted averages, it retains both the macro-level representation of the overall threat level and identifies the strongest attack links targeting high-value targets. After incorporating this density feature into the comprehensive feature set, it can keenly capture abnormal jumps or sustained high levels of risk concentration, outputting high-risk probabilities before the victim completes the transfer of funds, significantly improving the early identification accuracy of high-intensity inducement-based fraud.

[0100] For example, for session c k Here, the set of high-risk intent tags is defined as follows: Calculate its density, that is, its quantity proportion: .

[0101] Here, we can take the maximum value among all session densities, that is, use the most aggressive inducement attempt as the output feature: .

[0102] Alternatively, a weighted average of all conversation densities can be taken, i.e., using the overall tendency as the output feature: .

[0103] Finally, in step 24, the comprehensive features are input into the decision model to obtain the probability that the target user is a fraudulent user. It is understood that the comprehensive features can be extracted based on a large language model, which focuses on complex semantic parsing and intent extraction, fully leveraging its contextual understanding and generalization capabilities; the decision model can be a lightweight small model that efficiently integrates structured features to achieve low-latency, high-precision risk assessment.

[0104] Figure 5 A schematic diagram of a decision architecture according to one embodiment is shown. (Refer to...) Figure 5The input to the decision model is a comprehensive feature set, which consists of features from multiple dimensions. Specifically, these multiple dimensions include the aforementioned conformity features, broad-based features, deep-penetration features, consistency scores, first-to-last intent span features, high-risk intent density features, as well as the target user's natural attribute features and risk attribute features. The natural attribute features cover user type, real-name authentication status, location identifier, login network address, and recent transaction frequency, etc. The risk attribute features include non-personal operation risk indicators, account transfer risk indicators, and recent social media complaint counts, etc. In the embodiments of this specification, the features from the above multiple dimensions can be preprocessed, for example, by imputing missing values, binning discretization of continuous variables, or one-hot encoding of categorical variables. Then, they are aligned according to a preset field order and concatenated into a unified structured numerical vector. This numerical vector serves as the comprehensive feature. The decision model receives this comprehensive feature as input and, through forward inference calculation, outputs the probability that the target user is a fraudulent user.

[0105] In one example, the comprehensive feature is a feature set consisting of features from multiple dimensions, and the decision model is a decision tree model; the method further includes:

[0106] Traverse the feature subsets in the comprehensive features that do not contain the target feature, evaluate the difference between the feature subsets and the feature union on the model prediction output, and determine the feature contribution of the target feature, wherein the feature union is the union of the feature subsets and the target feature.

[0107] In this example, the feature contribution of the target feature is generated by traversing the feature subsets in the comprehensive features that do not contain the target feature and comparing the difference between the predicted output of the decision tree model and the feature union after adding the target feature. This processing method effectively overcomes the technical bottleneck of only outputting a single risk probability without providing a basis for judgment. Compared with static weight analysis or simple correlation measurement, calculating the contribution based on the marginal effect of feature combination fully considers the interaction and collinearity interference between multi-dimensional contingency features, ensuring the objectivity and fairness of the attribution results. Based on the feature contribution, a structured risk assessment report can be automatically generated, significantly shortening the cognitive path of manual review.

[0108] In one embodiment of this application, the decision model employs a lightweight classifier based on a gradient boosting decision tree (GBDT) architecture. During the model training phase, the positive sample set consists of target users whose pre-defined fraudulent behavior has been manually verified, while the negative sample set is constructed by mixing risk-free users and a small number of users with other risk types to optimize the model's decision boundary and improve its specific discrimination ability for particular fraud scenarios. For any target user to be identified, the comprehensive features generated in the preceding steps are input into the decision model to perform forward inference, and the model output generates a continuous risk probability value representing the likelihood of the user engaging in fraudulent behavior.

[0109] To overcome the limitations of traditional black-box models that only output a single probability value, this embodiment further introduces a feature attribution mechanism based on cooperative game theory to determine the independent influence weights of each dimension indicator on the final risk assessment. Specifically, it iterates through any feature subset S in the comprehensive features that does not contain the target feature i, and evaluates the difference in the predicted output of the decision model when only the input feature subset S is used and the union of the input features S∪{i} is used. By weighted summing of the marginal contribution differences of all possible subsets, the feature contribution of the target feature i is calculated. Its mathematical expression is as follows:

[0110] .

[0111] Where F represents the full feature set of the comprehensive features, and S represents any subset of features in F after removing the target feature i. This represents the prediction function of the decision model for the combination of input features, where |S| and |F| represent the number of features in the corresponding set, and "!" represents factorial. Based on the risk probability value and the contribution of each feature, a structured risk assessment report is automatically generated. The report includes the risk level determination result, the predicted probability accurate to a preset decimal place, and a list of key driving features arranged in descending order of contribution, along with their corresponding marginal impact values. For example, the report content includes: high risk level, probability 0.92; key evidence includes: conformity feature reaches 0.81, contribution +0.32; persona consistency score is only 0.25, contribution +0.28; high-risk intent density feature 0.60, contribution +0.21. This attribution output mechanism realizes a closed loop from probability prediction to logical tracing, significantly reducing the cognitive load of manual review and providing clear root cause localization anchors for offline strategy iteration.

[0112] In one example, the comprehensive feature is a feature set consisting of features from multiple dimensions, the decision model is a logistic regression model, and the method further includes:

[0113] Obtain interactive feature terms generated by applying conditional threshold interactions to different features in the feature set;

[0114] The interactive feature terms and the feature set are input together into the logistic regression model for joint parameter optimization.

[0115] In another embodiment of this application, the decision model may employ a logistic regression architecture. In this architecture, Weight of each feature This directly reflects its contribution to the qualitative assessment of risk. Given the advantages of logistic regression models—compact parameter space, efficient training convergence, and model weights that directly characterize the direction and intensity of each feature's contribution to the qualitative assessment of risk—this embodiment addresses the technical limitation of its linear assumption in automatically capturing the nonlinear coupling relationships between multidimensional risk indicators by introducing a feature cross-validation mechanism based on prior knowledge in the anti-fraud field. Specifically, based on preset business rules and conditional thresholds, logical combinations and numerical mappings are performed on different dimensions of features in the comprehensive features to generate explicit interactive feature terms.

[0116] The construction of interactive feature terms encompasses various composite modes: for example, multiplying or jointly determining the consistency feature with the broad-cast feature using a threshold to quantify the combined risk of "large-scale casting with a high degree of fit to the fraud script." It represents the product of the number of active chat conversations during the same period and the relevance feature, and the interaction feature term. This represents the product of content repetition rate and conformity feature; a negative correlation is established between deep penetration feature and persona consistency score to capture the abnormal pattern of "high-frequency interaction accompanied by identity logic contradiction," and interaction feature items. It represents the product of the average daily number of messages in a single chat and the consistency score of the user's persona, an interaction feature item. It represents the product of the proportion of intimate messages and the consistency score of the character profile, and the interaction feature item. It represents the product of the average delay in replying to the other party's message and the consistency score of the persona; or it can jointly divide the initial and final intention span features with the high-risk intention density features into intervals to identify the aggressive closing rhythm of "rapid advancement and intensive pressure", interaction feature items This indicates that the span of the initial and final intents is less than the product of the maximum value of 48 hours and the density of high-risk intents, and the interaction feature term. This indicates that the span of intent characteristics from beginning to end is less than the product of the weighted average of the density of high-risk intents over 48 hours. Furthermore, higher-order cross-terms can be constructed based on multi-condition logic and relationships. For example, when the number of active dialogues in the same period exceeds a preset threshold and the script conformity characteristic is greater than a specified critical value, the corresponding binary indicator variable or continuous interaction score is triggered, and the interaction feature item... This indicates that the number of active dialogues during the same period exceeds n and the script conformity feature is greater than x.

[0117] Subsequently, the generated interactive feature terms and comprehensive features are concatenated into vectors to form an enhanced input feature matrix, which is then fed into the logistic regression model to perform joint parameter optimization, such as gradient descent based on maximum likelihood estimation and regularization constraints. This approach effectively overcomes the expression bottleneck of linear models in complex fraud scenarios, enabling the model to explicitly inject key nonlinear interactive signals while maintaining high interpretability of weights (i.e., regression coefficients directly correspond to risk contribution). The final output risk probability not only possesses a clear attribution path but also significantly improves the model's discrimination boundary clarity and generalization stability for complex and highly disguised fraudulent behaviors through expert-driven feature engineering pre-compensation.

[0118] In one example, the method further includes:

[0119] Obtain the verification results of manual review based on the probability that the target user is a fraudulent user;

[0120] If the review result is a missed report or a false report, then defect tracing is performed to obtain defect attribution results, which include at least one of the following: intent recognition defect, standard intent path failure, and decision model deviation;

[0121] Based on the defect attribution results, update at least one of the following: intent recognition process, standard intent path, and decision model.

[0122] In this example, a closed-loop optimization system of "prediction-verification-attribution-iteration" was constructed by introducing manual review and feedback, along with a hierarchical defect tracing mechanism. This approach effectively overcomes the technical bottlenecks of static deployment and the inability to cope with the rapid iteration of fraudulent users' rhetoric and concept drift. Compared to blindly retraining the entire dataset or simply adjusting thresholds, prediction bias is precisely decoupled to three independent levels: the intent recognition process, the standard intent path, and the decision model, enabling targeted localization of the root cause. Based on the attribution results, targeted optimization of prompt instructions, expansion of the tag system, reconstruction of the standard fraud path, or incremental retraining of the model can be triggered. This continuously improves the adaptability of each module to new fraud patterns while minimizing computational power consumption and manual annotation costs. This closed-loop mechanism not only ensures the stability of recognition accuracy over long-term operation but also transforms discrete human experience into sedimentable system knowledge, significantly enhancing the self-evolution capability and business sustainability of the overall architecture.

[0123] For example, for users predicted by the preceding steps each day, a certain percentage are manually reviewed again, with a focus on users missed or falsely affected by the model. The cause is then attributed to the defective module, and subsequent optimization actions are determined. These mainly include: missed intent recognition → updating the intent labeling system or optimizing prompts; invalid script rules → expanding the standard path template; small model decision bias → retraining and adjusting feature weights.

[0124] The method provided in this specification first obtains multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in a fraud scenario. The fraud scenario is pre-divided into multiple stage intents. Then, for each intent sequence, the path distance between it and a preset standard intent path reflecting the fraud script is determined. Based on each path distance, the conformity feature of the target user with respect to the fraud script is determined. Next, the comprehensive feature of the target user is determined, including the conformity feature. Finally, the comprehensive feature is input into a decision model to obtain the probability that the target user is a fraud user. As can be seen from the above, this specification embodiment effectively captures the fraud evolution logic in dialogue records by converting unstructured dialogue records into intent sequences composed of multi-stage intents and quantifying their path distances to preset standard intent paths reflecting the fraud script, thereby generating conformity features. This conformity feature, combined with the comprehensive features of the target user, significantly improves the model's early identification accuracy for scripted, long-term, complex online fraud after inputting the comprehensive features into the decision model. At the same time, it reduces the false negative rate of fraudulent users caused by highly disguised rhetoric and the false positive rate of normal interactions, thereby improving the accuracy of fraudulent user identification.

[0125] According to another embodiment, a fraudulent user identification device is also provided, which is used to perform the methods provided in the embodiments of this specification. Figure 6 A schematic block diagram of a fraudulent user identification device according to one embodiment is shown. Figure 6 As shown, the device 600 includes:

[0126] The acquisition unit 61 is used to acquire multiple intent sequences corresponding to multiple dialogue records of the target user within a preset time window. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in the fraud scenario. The fraud scenario is pre-divided into multiple stage intents.

[0127] The first determining unit 62 is used to determine the path distance between each intent sequence acquired by the acquiring unit 61 and a preset standard intent path reflecting a fraud script, and to determine the target user's conformity to the fraud script based on each path distance.

[0128] The second determining unit 63 is used to determine the comprehensive characteristics of the target user, including the conformity characteristics obtained by the first determining unit 62.

[0129] The identification unit 64 is used to input the comprehensive features obtained by the second determination unit 63 into the decision model to obtain the probability that the target user is a fraudulent user.

[0130] Optionally, as an embodiment, the acquisition unit 61 is further configured to input the current message and its associated historical context into a large language model for any current message in a dialogue record, so that the model can determine the intent tag corresponding to the current message from the intent tag set; the intent tag set includes tag indications of multiple stages of intent in a fraud scenario.

[0131] Optionally, as an embodiment, it also includes:

[0132] The first statistical unit is used to count the number of active chat conversations of the target user during the same period based on multiple conversation records.

[0133] The first computing unit is used to calculate the content duplication rate between different dialogue records using semantic-based text similarity.

[0134] The third determining unit is used to determine the first behavioral pattern feature of the target user based on the number of chat conversations obtained by the first statistical unit and the content repetition rate obtained by the first calculation unit. The comprehensive feature also includes the first behavioral pattern feature.

[0135] Optionally, as an embodiment, it also includes:

[0136] The second statistical unit is used to calculate the average number of messages per day, the proportion of intimate messages, and the average response delay time per conversation based on multiple dialogue records.

[0137] The fourth determining unit is used to determine the second behavioral pattern characteristics of the target user based on the average daily number of messages per session, the proportion of intimate messages and the average reply delay time obtained by the second statistical unit. The comprehensive characteristics also include the second behavioral pattern characteristics.

[0138] Optionally, as an embodiment, it also includes:

[0139] The fifth determining unit is used to determine the consistency score of the target user's cross-session identity description information based on the multiple dialogue records, and the comprehensive feature also includes the consistency score.

[0140] Optionally, as an embodiment, it also includes:

[0141] The second calculation unit is used to calculate the time interval between the first occurrence of the first intention label and the second intention label in each intention sequence; the first intention label indicates the intention to establish an emotional connection, and the second intention label indicates the intention to guide a high-risk operation.

[0142] The sixth determining unit is used to calculate the arithmetic mean or minimum value of the time intervals obtained by the second calculation unit for each intent sequence, as the first and last intent span feature of the target user. The comprehensive feature also includes the first and last intent span feature.

[0143] Optionally, as an embodiment, it also includes:

[0144] The third calculation unit is used to determine the proportion of preset high-risk intent tags in each intent sequence;

[0145] The seventh determining unit is used to calculate the maximum value or weighted average value of the quantity proportions obtained by the third calculation unit for each intent sequence, as a high-risk intent density feature. The comprehensive feature also includes the high-risk intent density feature.

[0146] Optionally, as an embodiment, the comprehensive feature is a feature set composed of features of multiple dimensions, and the decision model is a decision tree model; the device further includes:

[0147] An evaluation unit is used to traverse the feature subsets in the comprehensive features that do not contain the target feature, evaluate the difference between the feature subsets and the feature union on the model prediction output, and determine the feature contribution of the target feature, wherein the feature union is the union of the feature subsets and the target feature.

[0148] Optionally, as an embodiment, the comprehensive feature is a feature set composed of features of multiple dimensions, the decision model is a logistic regression model, and the acquisition unit 61 is further used to acquire interactive feature items generated by performing conditional threshold cross-validation on different features in the feature set;

[0149] The device further includes an optimization unit, used to input the interactive feature items acquired by the acquisition unit 61 and the feature set into the logistic regression model for joint parameter optimization.

[0150] Optionally, as an embodiment, the acquisition unit 61 is further configured to acquire the verification result of manual verification of the probability that the target user is a fraudulent user;

[0151] The device further includes: an attribution unit, configured to perform defect tracing and obtain defect attribution results if the verification result obtained by the acquisition unit 61 is a missed report or a false report, which includes at least one of the following: intent recognition defect, standard intent path failure, and decision model deviation;

[0152] An update unit is used to update at least one of the following based on the defect attribution results obtained by the attribution unit: the intent recognition process, the standard intent path, and the decision model.

[0153] The apparatus provided in this embodiment first acquires multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in a fraud scenario. The fraud scenario is pre-divided into multiple stage intents. Then, the first determining unit 62 determines the path distance between each intent sequence and a preset standard intent path reflecting a fraud script. Based on each path distance, the conformity feature of the target user with respect to the fraud script is determined. Next, the second determining unit 63 determines the comprehensive feature of the target user, including the conformity feature. Finally, the identification unit 64 inputs the comprehensive feature into a decision model to obtain the probability that the target user is a fraud user. As can be seen from the above, this embodiment effectively captures the fraud evolution logic in dialogue records by converting unstructured dialogue records into intent sequences composed of multi-stage intents and quantifying their path distances to preset standard intent paths reflecting a fraud script, thereby generating conformity features. This conformity feature, combined with the comprehensive features of the target user, significantly improves the model's early identification accuracy for scripted, long-term, complex online fraud after inputting the comprehensive features into the decision model. At the same time, it reduces the false negative rate of fraudulent users caused by highly disguised rhetoric and the false positive rate of normal interactions, thereby improving the accuracy of fraudulent user identification.

[0154] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 2 The method described.

[0155] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 2 The method described.

[0156] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0157] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying fraudulent users, comprising: Multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window are obtained. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in the fraud scenario. The fraud scenario is pre-divided into multiple stages of intent; For each intent sequence, determine the path distance between it and the preset standard intent path reflecting the fraud script, and determine the target user's conformity with the fraud script based on each path distance; Determine the comprehensive characteristics of the target user, including the matching degree characteristics; The comprehensive features are input into the decision model to obtain the probability that the target user is a fraudulent user.

2. The method as described in claim 1, wherein, Acquiring multiple intent sequences corresponding to multiple dialogue records of the target user within a preset time window, also includes: For any current message in a dialogue record, the current message and its associated historical context are input into a large language model, which then determines the intent tag corresponding to the current message from the intent tag set; the intent tag set includes tag indications of intents at multiple stages in a fraud scenario.

3. The method as described in claim 1, wherein, Also includes: Based on multiple conversation records, the number of active chat conversations of the target user during the same period is counted. Using semantic-based text similarity, the content duplication rate between different dialogue records is calculated; Based on the number of chat conversations and the content repetition rate, the first behavioral pattern feature of the target user is determined, and the comprehensive feature also includes the first behavioral pattern feature.

4. The method of claim 1, wherein, Also includes: Based on multiple conversation records, the average number of messages per day, the proportion of intimate messages, and the average reply delay time per conversation were statistically analyzed. Based on the average number of messages per session per day, the proportion of intimate messages, and the average reply delay, the second behavioral pattern characteristics of the target user are determined, and the comprehensive characteristics also include the second behavioral pattern characteristics.

5. The method of claim 1, wherein, Also includes: Based on the multiple dialogue records, a consistency score for the cross-session identity description information of the target user is determined, and the comprehensive feature also includes the consistency score.

6. The method of claim 1, wherein, Also includes: Calculate the time interval between the first occurrence of the first intent label and the second intent label in each intent sequence; The first intent label indicates the intent to establish an emotional connection, and the second intent label indicates the intent to guide a high-risk operation; For each time interval obtained from each intent sequence, the arithmetic mean or minimum value is calculated as the first and last intent span feature of the target user. The comprehensive feature also includes the first and last intent span feature.

7. The method of claim 1, wherein, Also includes: Determine the percentage of pre-defined high-risk intent tags in each intent sequence; For the proportion of each intent sequence, calculate the maximum value or weighted average value as the high-risk intent density feature. The comprehensive feature also includes the high-risk intent density feature.

8. The method of claim 1, wherein, The comprehensive feature is a feature set composed of features from multiple dimensions, and the decision model is a decision tree model; the method further includes: Traverse the feature subsets in the comprehensive features that do not contain the target feature, evaluate the difference between the feature subsets and the feature union on the model prediction output, and determine the feature contribution of the target feature, wherein the feature union is the union of the feature subsets and the target feature.

9. The method of claim 1, wherein, The comprehensive features are a feature set composed of features from multiple dimensions, the decision model is a logistic regression model, and the method further includes: Obtain interactive feature terms generated by applying conditional threshold interactions to different features in the feature set; The interactive feature terms and the feature set are input together into the logistic regression model for joint parameter optimization.

10. The method of claim 1, wherein, The method further includes: Obtain the verification results of manual review based on the probability that the target user is a fraudulent user; If the review result is a missed report or a false report, then defect tracing is performed to obtain defect attribution results, which include at least one of the following: intent recognition defect, standard intent path failure, and decision model deviation; Based on the defect attribution results, update at least one of the following: intent recognition process, standard intent path, and decision model.

11. A fraudulent user identification device, comprising: The acquisition unit is used to acquire multiple intent sequences corresponding to multiple dialogue records of a target user within a preset time window. Each intent sequence is formed by intent tags corresponding to each message in the corresponding dialogue record. The intent tags are used to indicate the target stage intent in the fraud scenario. The fraud scenario is pre-divided into multiple stages of intent; The first determining unit is used to determine the path distance between each intent sequence acquired by the acquiring unit and a preset standard intent path reflecting a fraud script, and to determine the target user's conformity to the fraud script based on each path distance. The second determining unit is used to determine the comprehensive characteristics of the target user, including the conformity characteristics obtained by the first determining unit. The identification unit is used to input the comprehensive features obtained by the second determining unit into the decision model to obtain the probability that the target user is a fraudulent user.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-10.

Images