Machine learning based voice traffic anomalous behavior risk identification method and system

Abstract

The application relates to the technical field of voice service security monitoring, and discloses a voice service abnormal behavior risk identification method and system based on machine learning, wherein the method comprises the following steps: acquiring virtual operator number segment voice call records, generating a call relationship graph with number segment level labels and edge time attributes; calculating edge life cycle feature vectors, generating edge life cycle baselines differentiated according to number segment levels; processing edge event streams by using a continuous time dynamic graph neural network, and outputting node cumulative embedding vectors; calculating sub-number segment embedding vector covariance matrices based on the node cumulative embedding vectors, and generating a KL divergence increment cumulative sequence; jointly performing point change detection on the KL divergence increment cumulative sequence and a new edge establishment rate function, and marking penetration candidate nodes; inputting multi-dimensional features of the penetration candidate nodes into a penetration mode classification model, and outputting abnormal risk probabilities and penetration stage labels; and generating risk warning results for nodes exceeding a threshold value. The application improves the identification effect of low-frequency slow penetration type abnormal behaviors that utilize the number segment cohesion characteristics.

Description

Technical Field

[0001] This invention relates to the field of voice service security monitoring technology, specifically to a method and system for identifying abnormal behavior risks in voice services based on machine learning. Background Technology

[0002] In voice service operations, telecommunications operators need to identify abnormal risks in voice call behavior to prevent violations such as telecom fraud and harassing calls. Existing methods typically employ statistical feature extraction based on fixed time windows, using rule-based threshold judgments or classification model training on dimensions such as call frequency and duration. However, the feature changes of low-frequency, slow-penetrating abnormal behaviors within any single time window are extremely weak, and the amount of information within a fixed window is insufficient to accumulate effective abnormal signals, leading to missed detections of such behaviors. Furthermore, normal calls within virtual operator number segments exhibit high frequency and strong cohesion, making it impossible for globally unified modeling to distinguish between normal inter-segment communication behavior and abnormal collaborative penetration behavior, resulting in a large number of false positives or false negatives in risk identification. Summary of the Invention

[0003] This invention provides a method and system for identifying abnormal behavior risks in voice services based on machine learning, which solves the technical problem in related technologies that cannot effectively capture dynamic structural changes in the call network to identify the risk of abnormal behavior in virtual operator number segments' infiltrated voice services.

[0004] This invention discloses a method for identifying abnormal behavior risks in voice services based on machine learning, comprising the following steps: Obtain the voice call records of the target virtual operator number segment, create edge relationships with the number as the node and the first call between two numbers, and generate a call relationship graph with number segment level labels and edge time attributes; Calculate the edge lifecycle feature vector for each edge in the call relationship graph, classify and statistically analyze the feature distribution according to edge within number segment and edge across number segment, and generate edge lifecycle baselines distinguished by number segment level; All edges in the call relationship graph are arranged according to their creation time to form an edge event stream. The edge event stream is input into a continuous-time dynamic graph neural network. The memory state of the nodes participating in the edge event is updated with each edge event as the driver. The cumulative embedding vector of the event-driven nodes is output. When updating the memory, the deviation of the edge life cycle feature vector of the current edge event from the edge life cycle baseline distinguished by the number segment level is used as the input. The embedding vector covariance matrix is ​​calculated for each sub-segment based on the node cumulative embedding vector. The KL divergence increment between the eigenvalue distributions of the covariance matrix at adjacent time points is calculated, and the cumulative KL divergence increment sequence for each sub-segment is generated. For each node, calculate the new edge establishment rate function, perform joint change point detection by combining the KL divergence increment cumulative sequence with the new edge establishment rate function, and mark the nodes that meet the joint change point conditions as penetration candidate nodes. Multi-dimensional features are extracted from penetration candidate nodes and input into the penetration pattern classification model. The model outputs the abnormal risk probability and penetration stage label. For penetration candidate nodes whose abnormal risk probability exceeds the preset threshold, a voice service abnormal behavior risk warning result is generated.

[0005] Furthermore, the edge lifecycle feature vector includes the following components: edge survival time, which is the difference between the most recent active time and the edge creation time; slope of the active frequency decay curve, which is the slope value obtained by fitting the decay curve after dividing the edge into equal time intervals and counting the number of calls in each interval; coefficient of variation of call interval time, which is the ratio of the standard deviation to the mean of the time interval between all two adjacent calls of the edge; edge creation time delay ratio, which is the ratio of the difference between the edge creation time and the first appearance time of the source node of the edge to the total existence time of the source node in the call relationship graph; wherein, each component is subjected to Z-score standardization.

[0006] Furthermore, the continuous-time dynamic graph neural network includes a time encoding function, a memory update unit, and an embedding generation unit; for each new edge event, the time encoding function calculates the time difference between the current edge event and the last time the source node and target node participated in the event. and Mapped to time-coded vectors ,in The time interval between the current edge event and the last time the source node participated in the edge event. The time interval between the current edge event and the last time the target node participated in an edge event is defined; the memory update unit encodes the time vector. Feature information of edge events The current memory state of the source node and the current memory state of the target node Concatenation is used as input, where This is the edge lifecycle feature vector corresponding to the current edge event. This is the memory state vector of the source node up to the current time step. The target node's memory state vector before the current moment is used as the basis for a gated cyclic transformation to output the updated source node memory state and target node memory state. The embedding generation unit, based on the updated memory state, performs a weighted aggregation with the node's historical event information, followed by a nonlinear mapping, to output the source node's cumulative embedding vector. Cumulative embedding vector of target node ,in The current moment when the event occurs. This is the identifier of the source node. This is the identifier for the target node.

[0007] Furthermore, the time encoding function The expression is: ; in to Arranged in ascending order A preset angular frequency, The preset positive integer represents the number of encoding dimensions, and the vector contains a total of Trigonometric function components.

[0008] Furthermore, the input to the memory update unit also includes the edge lifecycle baseline deviation distinguished by the number segment level. The baseline deviation The calculation method is as follows: ,in This is the edge lifecycle feature vector corresponding to the current edge event. This is the mean vector of each component of the edge lifecycle feature vector corresponding to the category to which the current edge event belongs. This is the standard deviation vector of each component of the edge lifecycle feature vector corresponding to the category to which the current edge event belongs. This is the category identifier for the current edge, divided by edge within the number segment or edge across number segments. Division and subtraction are performed item by item according to the components.

[0009] Furthermore, the embedding vector covariance matrix The calculation method is as follows: ; in This represents the total number of nodes within this sub-segment. For the first number in this sub-segment Each node at the current moment The cumulative embedding vector, This is the mean vector of the cumulative embedding vectors of all nodes within this sub-segment. This indicates transpose; after each new edge event is triggered, the embedding vector covariance matrix of the affected sub-segment is recalculated; the KL divergence increment is the current covariance matrix. eigenvalue distribution The distribution of eigenvalues ​​of the covariance matrix obtained in the previous calculation The KL divergence values ​​between them, where and These are the eigenvalue distributions formed by arranging the corresponding covariance matrices in descending order of their eigenvalues. This represents the time interval between two consecutive calculations.

[0010] Furthermore, the new edge establishment rate function is obtained by calculating a smooth value using an exponentially weighted moving average algorithm based on the number of unique called parties added by a node within a unit of time. The joint change point detection includes the following steps: for the cumulative KL divergence increment sequence of each sub-segment, it is determined whether the KL divergence increment continues to accumulate positively within multiple consecutive event triggering cycles. If so, the sub-segment is marked as a structural change active segment. For each node within the structural change active segment, it is detected whether its new edge establishment rate function exhibits a step-like upward pattern within a range aligned with the time period of continuous positive accumulation of KL divergence. The step-like upward pattern refers to the new edge establishment rate function maintaining a stable or slow growth for several adjacent time periods before experiencing a sudden increase, and then maintaining a stable level again after the sudden increase. Nodes that simultaneously meet the conditions of continuous positive accumulation of KL divergence and the step-like upward pattern are marked as penetration candidate nodes.

[0011] Furthermore, the multi-dimensional features include called party attributes, which include: the distribution entropy of the number segment to which the called number belongs, the evolution trend of the cosine distance between the called node embedding vector and the penetration candidate node embedding vector arranged according to the call time, and the degree centrality sorting of the called nodes in their respective sub-number segments according to the node degree from high to low. The called party attributes are combined with the node cumulative embedding vector of the penetration candidate nodes, the shape features of the KL divergence cumulative curve, and the new edge rate variable point parameters to form a concatenated feature vector. The concatenated feature vector is then subjected to Z-score standardization and input into the penetration pattern classification model.

[0012] Furthermore, the generation of the risk warning result also includes: calculating the estimated time to reach the critical penetration density based on the new edge establishment rate function of the penetration candidate node and the current scale of the penetrated call network, and incorporating the estimated time into the risk warning result.

[0013] This invention discloses a machine learning-based voice service abnormal behavior risk identification system, used to execute the aforementioned machine learning-based voice service abnormal behavior risk identification method, comprising: The call relationship graph generation module is used to obtain the voice call records of the target virtual operator number segment, create edge relationships with the number as the node and the first call as the edge relationship, and generate a call relationship graph with number segment level labels and edge time attributes. The edge lifecycle baseline calculation module is used to calculate the edge lifecycle feature vector for each edge in the call relationship graph, classify and statistically distribute the features according to edge within number segment and edge across number segment, and generate edge lifecycle baselines distinguished by number segment level. The dynamic graph processing module is used to arrange all edges in the call relationship graph according to their creation time to form an edge event stream. The edge event stream is processed by a continuous-time dynamic graph neural network, and the cumulative embedding vector of the event-driven node with fused number segment context information is output. The structural change detection module is used to calculate the embedding vector covariance matrix for each sub-segment based on the node cumulative embedding vector, and calculate the KL divergence increment of the eigenvalue distribution of the embedding vector covariance matrix after each new edge event is triggered, generating the cumulative KL divergence increment sequence for each sub-segment. The joint change point detection module is used to calculate the new edge establishment rate function for each node, perform joint change point detection by combining the KL divergence increment cumulative sequence with the new edge establishment rate function, and mark the nodes that meet the joint change point conditions as penetration candidate nodes. The penetration pattern classification module is used to extract the called-end attributes of penetration candidate nodes and concatenate them with the node cumulative embedding vector, KL divergence cumulative curve shape features and new edge rate variable point parameters. The input is a pre-trained penetration pattern classification model, and the output is the abnormal risk probability and penetration stage label. The risk warning module is used to generate risk warning results for abnormal voice service behavior of penetration candidate nodes and all their peer numbers when the probability of abnormal risk exceeds a preset threshold.

[0014] The beneficial effects of this invention are as follows: By adopting an event-driven update method using a continuous-time dynamic graph neural network, the analysis granularity is shifted from a fixed time window to the single-edge event level, enabling low-frequency abnormal behaviors to be continuously tracked and accumulated and recorded each time a call occurs. This overcomes the problem of insufficient information within a fixed time window, which prevents the accumulation of effective abnormal signals and avoids the missed detection of low-frequency, slow-penetrating abnormal behaviors.

[0015] By introducing the edge lifecycle baseline of number segment hierarchy as prior information for the memory update of continuous-time dynamic graph neural network, the baseline deviation of normal behavior patterns within the number segment is integrated into the cumulative embedding vector of the node. This overcomes the problem of feature confusion between normal high-frequency interoperability and abnormal penetration behavior within the number segment of virtual operators under global unified modeling, and realizes the distinction between normal social expansion and abnormal penetration behavior within the number segment.

[0016] By jointly detecting change points using the cumulative KL divergence increment sequence of sub-segments and the rate function for establishing new edges of nodes, time-aligned analysis of group structure splitting signals and individual edge expansion pattern signals is achieved. This overcomes the shortcomings of using KL divergence detection alone in low-frequency scenarios and using new edge rate change points alone in failing to exclude normal behavior. It enables effective identification of low-frequency, slow-penetrating abnormal behavior that is concealed by the cohesion characteristics of number segments. Attached Figure Description

[0017] Figure 1 This is a flowchart of a machine learning-based method for identifying abnormal behavior risks in voice services, provided in an embodiment of the present invention. Figure 2 This is a schematic diagram comparing the survival time of the external number X and the inner edge of the A sub-number segment provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the comparison of edge lifecycle feature vectors provided in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the change of the cumulative embedding vector of the penetration node as the event progresses, provided in an embodiment of the present invention. Figure 5 This is a schematic diagram illustrating the changes in the KL divergence increment and cumulative value of sub-segment A provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the joint change point detection results of sub-number segment A nodes provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the baseline mean of edge lifecycle provided in an embodiment of the present invention. Detailed Implementation

[0018] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0019] At least one embodiment of the present invention discloses a method for identifying abnormal behavior risks in voice services based on machine learning, see [link to relevant documentation]. Figure 1 This includes the following steps: Step 100: Obtain the voice call records of the target virtual operator number segment and generate a call relationship graph with number segment hierarchical tags and edge time attributes.

[0020] Retrieve all voice call records for the target virtual operator's number segment within a preset long period. Extract the calling number, called number, call initiation time, call duration, and the sub-number segment identifier from each call record. Generate a call relationship graph by creating edge relationships based on the numbers as nodes and the first call between two numbers.

[0021] It should be noted that each edge in the call relationship graph records the following attributes: edge creation time, i.e., the time when the first call between the two numbers was initiated; recent active time, i.e., the time when the most recent call was initiated; and cumulative call count, i.e., the total number of historical calls between the two numbers. Each node is marked with the sub-number segment identifier to which the number belongs, serving as a number segment level label.

[0022] Step 200: Calculate the edge lifecycle feature vector for each edge in the call relationship graph to generate an edge lifecycle baseline that distinguishes between number segments.

[0023] For each edge in the call relationship graph, calculate the edge lifecycle feature vector based on the edge's time attribute. Classify all edges into intra-number segment edges and cross-number segment edges, and statistically analyze the edge lifecycle feature distribution for edges within each sub-number segment and edges across number segments respectively, generating an edge lifecycle baseline that distinguishes number segment levels.

[0024] It should be noted that the edge lifecycle feature vector includes the following components: edge survival time, which is the difference between the most recent active time and the edge creation time; the slope of the active frequency decay curve, which is the slope value obtained by fitting the decay curve after dividing the edge into equal time intervals and counting the number of calls in each interval; the coefficient of variation of call interval time, which is the ratio of the standard deviation to the mean of the time interval between all two adjacent calls of the edge; and the edge creation time delay ratio, which is the ratio of the difference between the edge creation time and the first appearance time of the source node of the edge to the total existence time of the source node in the call relationship graph. Among them, the edge survival time and the slope of the active frequency decay curve have time dimensions, while the coefficient of variation of call interval time and the edge creation time delay ratio are dimensionless ratios. Since the dimensions and numerical scales of each component are different, in order to avoid the difference in dimensions affecting the baseline statistics and subsequent feature processing effects, each component is Z-score standardized to ensure that each component is on a uniform scale.

[0025] It should be noted that the edge lifecycle baseline for segment-level differentiation refers to: for each sub-segment, the lifecycle feature vectors of the edges between nodes within the sub-segment are statistically analyzed, and the mean and standard deviation of each component are obtained as the intra-segment baseline; the lifecycle feature vectors of the edges between nodes within the sub-segment and nodes in other sub-segments are statistically analyzed, and the mean and standard deviation of each component are obtained as the cross-segment baseline.

[0026] Step 300: Arrange all edges in the call relationship graph according to their creation time to form an edge event stream. Use a continuous-time dynamic graph neural network to process the edge event stream and output the event-driven node cumulative embedding vector.

[0027] All edges in the call relationship graph are arranged from earliest to latest creation time, forming an edge event stream. This edge event stream is then input into a continuous-time dynamic graph neural network for processing. The continuous-time dynamic graph neural network uses each edge event as a driver, updating the memory states of the source and target nodes involved in that edge event, and outputting a cumulative embedding vector of nodes that incorporates temporal information.

[0028] It should be noted that the continuous-time dynamic graph neural network includes a temporal encoding function, a memory update unit, and an embedding generation unit. The data transfer relationship between these units is as follows: For each new edge event, the temporal encoding function maps the unequal time interval between the current edge event and the previous participation events of the source node and the target node into a continuous temporal encoding vector. ,in The time interval between the current edge event and the last time the source node participated in the edge event. The time interval between the current edge event and the last time the target node participated in an edge event. and All are non-negative real numbers; the memory update unit encodes the time vector. Feature information of edge events The current memory state of the source node and the current memory state of the target node Concatenate as input ,in This is the edge lifecycle feature vector corresponding to the current edge event. This is the memory state vector of the source node up to the current time step. This is the memory state vector of the target node up to the current time step. At the moment the current edge event occurs, output the updated source node memory state and the updated target node memory state; based on the updated source node memory state and the updated target node memory state, the embedding generation unit outputs the cumulative embedding vector of the source node. Cumulative embedding vector of target node ,in For the source node at the current moment Embedded vector, For the target node at the current time Embedded vector, This is the identifier of the source node. This serves as the identifier for the target node. The time encoding function is also included. in accordance with and The expression for calculating the composite trigonometric function components of a single linear mapping, superimposed with high-frequency and low-frequency components, is as follows: ; in to Arranged in ascending order A preset angular frequency, The preset positive integer represents the number of encoding dimensions, and the vector contains a total of Each of the trigonometric function components is arranged according to... to The order in which they act on and This generation process ensures that the frequency of changes in each component of the encoded vector increases with the length of the time interval, thus uniquely distinguishing different time intervals in the low-dimensional space. The memory update unit then processes the input... After gating cyclic transformation, the updated source node memory state and the updated target node memory state are output. The gating cyclic transformation controls the proportion of historical information retained in the memory state and the degree of writing of current event information through update gate and reset gate, thereby accumulating event information at different times in the memory state according to the order of events. The embedding generation unit uses the updated memory state as the query basis, performs weighted aggregation with the node's historical event information, and then performs nonlinear mapping to output the node's cumulative embedding vector. This makes the embedding vector reflect both the historical event sequence in which the node participated and the incremental information introduced by the current event.

[0029] In this embodiment, to introduce prior information about normal behavior within a number segment during the node memory update process, thereby distinguishing between normal social expansion and abnormal penetration behavior, the input to the memory update unit also includes the edge lifecycle baseline deviation at the number segment level. The edge lifecycle baseline deviation at the number segment level is obtained by calculating the edge lifecycle feature vector of the current edge event. The baseline mean corresponding to the category to which this edge belongs The difference, expressed as the baseline standard deviation Obtained after normalization, i.e. ,in This is the edge lifecycle feature vector corresponding to the current edge event. This is the mean vector of each component of the edge lifecycle feature vector corresponding to the category to which the current edge event belongs. This is the standard deviation vector of each component of the edge lifecycle feature vector corresponding to the category to which the current edge event belongs. This serves as the category identifier for the current edge, categorized by whether it's an edge within a number segment or an edge spanning multiple number segments. The normalized baseline deviation vector is calculated by performing division and subtraction on a component-by-component basis. The baseline deviations of the edge lifecycles, differentiated by number segment level, are then considered. With time-encoded vectors and side event feature information The node's current memory state is input into the memory update unit, so that the node's cumulative embedding vector incorporates the segment context information.

[0030] Step 400: Based on the node cumulative embedding vector, calculate the embedding vector covariance matrix for each sub-segment and generate the KL divergence increment cumulative sequence for each sub-segment.

[0031] For each sub-segment, collect the cumulative embedding vectors of all nodes within that sub-segment. ,in For the first number in this sub-segment Each node at the current moment The cumulative embedding vector, Let be the node index. Calculate the embedding vector covariance matrix: ; in This represents the total number of nodes within this sub-segment. This is the mean vector of the cumulative embedding vectors of all nodes within this sub-segment. For this sub-segment at the current time The covariance matrix of the embedding vector. This represents the transpose. After each new edge event is triggered, the embedding vector covariance matrix of the affected sub-segment is recalculated. The current covariance matrix is ​​calculated using the KL divergence algorithm. eigenvalue distribution The distribution of eigenvalues ​​of the covariance matrix obtained in the previous calculation The KL divergence between them is used as the KL divergence increment, where The current covariance matrix The eigenvalue distribution formed by eigenvalues ​​arranged from largest to smallest. This is the eigenvalue distribution formed by arranging the covariance matrix obtained in the previous calculation in descending order of eigenvalues. This represents the time interval between two consecutive calculations. The KL divergence increments are accumulated sequentially over time to form a cumulative sequence for each sub-segment.

[0032] It should be noted that the eigenvalue distribution of the embedding vector covariance matrix reflects the dispersion and main direction distribution of node embeddings within the sub-segment. When there is penetration behavior within the sub-segment, the embedding vectors of some nodes deviate from the normal distribution, causing changes in the eigenvalue distribution of the embedding vector covariance matrix, manifested as a continuously positive KL divergence increment. When there is no penetration behavior within the sub-segment, the changes in node embedding exhibit normal fluctuations, with the KL divergence increment randomly distributed around zero, without forming a continuous accumulation of positive values.

[0033] Step 500: Calculate the new edge establishment rate function for each node, perform joint change point detection by combining the KL divergence increment cumulative sequence with the new edge establishment rate function, and mark the nodes that meet the joint change point conditions as penetration candidate nodes.

[0034] For each node, the number of newly added unique called parties within a unit of time is counted, and its smoothed value is calculated using an exponentially weighted moving average algorithm, serving as the new edge establishment rate function for that node. The cumulative KL divergence increment sequence of each sub-segment is then used for joint change point detection with the new edge establishment rate function of each node within that sub-segment to identify penetration candidate nodes that meet the joint change point conditions. The steps of the joint change point detection are as follows: Step 501: For the cumulative sequence of KL divergence increments of each sub-segment, determine whether the KL divergence increments continue to accumulate in positive values ​​within multiple consecutive event triggering cycles. If so, mark the sub-segment as an active segment of structural change and proceed to step 502; otherwise, skip the sub-segment.

[0035] Step 502: For each node in the active structural change segment, check whether its new edge establishment rate function shows a step-like upward pattern within the range that is aligned with the time period of continuous positive accumulation of KL divergence.

[0036] It should be noted that the step-like upward pattern refers to a situation where the rate function of establishing a new side remains stable or grows slowly over several adjacent time periods, then suddenly increases, and after the sudden increase, it remains stable again at a new level, forming a step-like change curve.

[0037] Step 503: Mark the nodes that simultaneously satisfy the KL divergence continuous positive accumulation condition described in Step 501 and the step-like upward mode condition described in Step 502 as penetration candidate nodes.

[0038] In this embodiment, to avoid the shortcomings of single signal detection in low-frequency scenarios, joint change point detection performs time-aligned analysis of group structure split signals and individual edge expansion pattern signals. KL divergence detection alone lacks sensitivity in low-frequency scenarios, and new edge rate change points alone cannot distinguish between normal social expansion and infiltration behaviors. By requiring the continuous positive accumulation of KL divergence increments and the step-like increase of the new edge establishment rate function to occur synchronously in time, nodes exhibiting normal behavior that only meet a single condition are excluded.

[0039] Step 600: Extract multi-dimensional features from the penetration candidate nodes and input them into the penetration pattern classification model to output the abnormal risk probability and penetration stage label.

[0040] For each penetration candidate node, extract the called-end attributes of all newly added edges. Concatenate the called-end attributes with the node cumulative embedding vector, KL divergence cumulative curve shape features, and new edge rate change point parameters of the penetration candidate node to form a concatenated feature vector. Input the concatenated feature vector into a pre-trained penetration pattern classification model, which outputs the abnormal risk probability and penetration stage label.

[0041] It should be noted that the attributes of the called party include: the distribution entropy of the number segment to which the called number belongs, reflecting the degree of dispersion of the call parties of the penetration candidate nodes in different number segments; the evolution trend of the cosine distance between the embedded vector of the called node and the embedded vector of the penetration candidate node, which is a cosine distance sequence arranged according to the call time, wherein the cosine distance is calculated based on the cosine similarity algorithm, and the two vectors involved in the operation are both output by the embedding generation unit of the continuous time dynamic graph neural network in step 300, and have the same vector dimension; the degree centrality ranking of the called node in its respective sub-number segment, which is the position of the called node in its sub-number segment arranged from high to low node degree.

[0042] It should be noted that the components in the concatenated feature vector, such as the number segment distribution entropy, cosine distance, degree centrality ranking, node cumulative embedding vector, KL divergence cumulative curve shape feature, and new edge rate variable point parameter, have different types and numerical scales. In order to avoid scale differences affecting the classification performance of the penetration pattern classification model, the concatenated feature vector is subjected to Z-score standardization.

[0043] It should be noted that the penetration pattern classification model is a pre-trained classification model. Its input is a concatenated feature vector, and its output includes anomaly risk probability values ​​and penetration stage labels. The penetration stage labels indicate the current evolution stage of the penetration behavior. The penetration pattern classification model can employ a multilayer perceptron, using the concatenated feature vector as input and a Softmax layer at the output. Each category probability output by the Softmax layer is associated with an output neuron, forming a category probability distribution. The highest probability is taken as the anomaly risk probability value, and the category corresponding to the highest probability is taken as the penetration stage label. Training uses a supervised classification method, with historical penetration event labeled samples and normal call behavior labeled samples as the training set, and optimization is performed using the cross-entropy loss function and gradient descent algorithm.

[0044] In this embodiment of the application, in order to improve the ability of the penetration pattern classification model to distinguish the evolution of the penetration stage, the penetration pattern classification model can also adopt a long short-term memory network. The input is a sequence of concatenated feature vectors arranged in chronological order. A softmax layer is set at the output end. Each category probability output by the softmax layer is associated with an output neuron to form a category probability distribution. The category corresponding to the highest probability is taken as the abnormal risk probability value and the penetration stage label. The training adopts a supervised sequence classification method, using the temporal feature sequence samples of the penetration process as the training set, and using the cross-entropy loss function and gradient descent algorithm for optimization.

[0045] Step 700: For penetration candidate nodes whose abnormal risk probability exceeds the preset threshold, generate a voice service abnormal behavior risk warning result.

[0046] For penetration candidate nodes whose abnormal risk probability exceeds a preset threshold, a risk warning result for abnormal voice service behavior is generated for the penetration candidate node and all peer numbers with which they have established call relationships, based on its penetration stage label.

[0047] In this embodiment of the application, in order to assess the urgency of the penetration behavior and assist the operator in prioritizing the handling, a rate function is established based on the new edge of the penetration candidate node and the scale of the currently penetrated call network to calculate the estimated time to reach the critical penetration density, and the estimated time to reach the critical penetration density is incorporated into the risk warning result.

[0048] On the other hand, this invention also proposes a machine learning-based voice service abnormal behavior risk identification system, comprising: The call relationship graph generation module is used to obtain all voice call records of the target virtual operator number segment within a preset long period, and generate a call relationship graph with number segment level labels and edge time attributes by using the number as a node and creating edge relationships with the first call.

[0049] The edge lifecycle baseline calculation module is used to calculate the edge lifecycle feature vector for each edge in the call relationship graph, classify and statistically distribute the features according to the edge within the number segment and the edge across the number segment, and generate the edge lifecycle baseline with the number segment level distinction.

[0050] The dynamic graph processing module is used to arrange all edges in the call relationship graph according to their creation time to form an edge event stream. The edge event stream is processed using a continuous-time dynamic graph neural network, and the cumulative embedding vector of the event-driven node with fused number segment context information is output.

[0051] The structural change detection module is used to calculate the embedding vector covariance matrix for each sub-segment based on the node cumulative embedding vector. After each new edge event is triggered, it calculates the KL divergence increment of the eigenvalue distribution of the embedding vector covariance matrix and generates the cumulative KL divergence increment sequence for each sub-segment.

[0052] The joint change point detection module is used to calculate the new edge establishment rate function for each node, perform joint change point detection by combining the KL divergence increment cumulative sequence with the new edge establishment rate function, and mark the nodes that meet the joint change point conditions as penetration candidate nodes.

[0053] The penetration pattern classification module is used to extract the called-end attributes of penetration candidate nodes and concatenate them with the node cumulative embedding vector, KL divergence cumulative curve shape features and new edge rate variable point parameters. The input is a pre-trained penetration pattern classification model, and the output is the abnormal risk probability and penetration stage label.

[0054] The risk warning module is used to generate risk warning results for abnormal voice service behavior of penetration candidate nodes and all their peer numbers when the probability of abnormal risk exceeds a preset threshold.

[0055] By way of example, the system proposed in this invention may also include various features and combinations thereof in the method embodiments, which will not be elaborated here.

[0056] This invention employs an event-driven update method using a continuous-time dynamic graph neural network, shifting the analysis granularity from a fixed time window to the single-edge event level. This allows low-frequency abnormal behaviors with only a few calls per day to be continuously tracked and accumulated as each call occurs. Thus, it overcomes the problem of insufficient information within a fixed time window to accumulate effective abnormal signals and solves the problem of low-frequency, slow-penetrating abnormal behaviors being missed under fixed-window statistical methods.

[0057] This invention introduces the edge lifecycle baseline of number segment hierarchy as prior information for the memory update of continuous-time dynamic graph neural network, so that the cumulative embedding vector of the node incorporates the benchmark deviation of normal behavior patterns within the number segment. Therefore, it overcomes the problem of feature confusion between normal high-frequency interoperability behavior and abnormal penetration behavior within the number segment of virtual operators under global unified modeling, thereby realizing the distinction between normal social expansion and abnormal penetration behavior within the number segment.

[0058] This invention achieves time-aligned analysis of group structure splitting signals and individual edge expansion pattern signals by jointly detecting change points using the cumulative sequence of KL divergence increments of sub-number segments and the rate function for establishing new edges of nodes. Therefore, it overcomes the shortcomings of insufficient sensitivity of KL divergence detection in low-frequency scenarios and the inability to exclude normal behavior by using new edge rate change points alone. Thus, it effectively identifies low-frequency slow-penetration abnormal behavior that is hidden by the cohesion characteristics of number segments.

[0059] See Figures 2-7 The following application examples are proposed: A virtual mobile network operator (MVNO) needs to identify abnormal risks in voice call behavior within a certain number segment when operating its services. Taking the operator's sub-segment A as an example, several new numbers were added to sub-segment A in the first quarter of a certain year to expand specific services. All phone numbers in this sub-segment were new users, exhibiting characteristics of a large number of numbers leaving the network and high-frequency interconnection between numbers in the early stages of business expansion.

[0060] Meanwhile, external entities are exploiting the cohesive nature of this number segment to conduct low-frequency, slow-speed infiltration. Infiltrators use a small number of numbers to gradually establish call relationships with multiple legitimate numbers within the segment, progressively expanding their connection coverage within the sub-segment. This allows them to lay the groundwork for targeted harassment or fraud against legitimate users within the segment. Because such activities generate only a very small number of calls per day, it is difficult to detect abnormal signals through fixed-time-window statistical analysis.

[0061] This embodiment uses call data from sub-number segment A of a virtual operator during the period from January 1st to March 31st of a certain year as the analysis object, and fully demonstrates the data flow process of six core steps. In the specific implementation, the steps are as follows: generation of call relationship graph, generation of edge lifecycle baseline, continuous time dynamic graph neural network processing, generation of sub-number segment KL divergence increment cumulative sequence, joint change point detection, penetration feature extraction and hierarchical early warning.

[0062] Step 1: Generating the call relationship diagram.

[0063] Collect all voice call records for sub-number segment A within a preset long period (January 1st to March 31st of a certain year). Extract the calling number, called number, call initiation time, call duration, and sub-number segment identifier from each call record. Create edge relationships based on the numbers as nodes and the first call between two numbers.

[0064] The following are sample original call records for sub-number segment A during this period. User 1 and User 2 are normal outbound numbers within sub-number segment A; external number X is a number controlled by the intruder; and external number Y is a collaborating number controlled by the intruder.

[0065] Table 1. Original call records for part of sub-number segment A

[0066] After converting the call records in the table above into a call relationship graph, each edge records three time attributes: edge creation time, most recent active time, and cumulative number of calls. The edge between external number X and user 1 was created on January 18th of a certain year, was most recent active on March 5th of a certain year, and has a cumulative number of calls of 2. The edges between external number X and users 3 and 2 were created on February 2nd and February 16th of a certain year, respectively, and have a cumulative number of calls of 1 each. In the converted call relationship graph, each edge is categorized according to the sub-number segment to which its two endpoints belong: edges where both endpoints belong to sub-number segment A are categorized as intra-segment edges, and edges where one endpoint belongs to sub-number segment A and the other to another sub-segment are categorized as cross-segment edges. This categorization provides the basis for calculating the baseline of edge lifecycle by category in step 2.

[0067] Step 2: Edge lifecycle baseline generation.

[0068] For each edge in the call relationship graph, a lifecycle feature vector is calculated based on the edge creation time, the most recent active time, and the initiation time of each call. This vector contains four components: edge survival time, slope of the active frequency decay curve, coefficient of variation of call interval time, and edge creation time latency ratio. Z-score normalization is applied to each component to ensure they are on a uniform scale.

[0069] Then, edges are classified according to whether they are within a number segment or across number segments. Edges within sub-segment A (such as the edge between user 1 and user 2) are counted as the baseline within the number segment; edges between nodes in sub-segment A and sub-segment C (such as the edge between external number X and user 1) are counted as the baseline across number segments.

[0070] Taking the edge between external number X and each user in sub-number segment A as an example, the standardized edge lifecycle feature vector is shown in the table below.

[0071] Table 2. Lifecycle Feature Vectors of Sub-Segment A (Standardized)

[0072] In the table above, the coefficient of variation of call interval time between external number X and each user is 0, indicating that these edges have only had one call and there is no adjacent call interval. The edge creation time delay ratio is 1.00, indicating that the edge creation time of external number X is later than the first appearance time of its source node. However, normal edges within the number segment, such as the edge between user 1 and user 2, show a higher coefficient of variation of call interval time (0.71) and a lower edge creation time delay ratio (0.36), reflecting the behavioral pattern of multiple repeated calls between normal numbers and the rapid establishment of call relationships after leaving the network.

[0073] The mean and standard deviation of each component of the above feature vectors are statistically analyzed according to whether they are intra-segment edges or cross-segment edges, generating edge lifecycle baselines that distinguish segment levels. In this scenario, the mean survival time of the cross-segment baseline for sub-segment A is 40 days, with a standard deviation of 7.5 days; the mean survival time of the edge survival time of the intra-segment baseline is 55 days, with a standard deviation of 9.0 days.

[0074] Step 3: Continuous-time dynamic graph neural network processing.

[0075] Arrange all edges in the call relationship graph generated in step 1 from earliest to latest according to their creation time, forming an edge event stream. Input this edge event stream into a continuous-time dynamic graph neural network. The network updates the memory state of the source and target nodes based on each edge event.

[0076] For each new edge event, the time encoding function maps the time interval between the current edge event and the last time the source node and target node participated in the event to a time encoding vector. Taking the edge event between external number X and user 3 (edge ​​creation time is February 2nd of a certain year) as an example, the time interval since external number X last participated in the edge event (call with user 1, January 18th of a certain year) is 15 days; user 3's first participation in the edge event is considered to have a time interval of 0. This time encoding vector, along with the edge event feature information (i.e., the standardized edge lifecycle feature vector of external number X and user 3 calculated in step 2), the memory state of the source node, and the memory state of the target node, is input into the memory update unit to achieve the fusion update of time encoding, feature information, and node memory.

[0077] Meanwhile, the input to the memory update unit also includes the edge lifecycle baseline deviation for number segment hierarchy differentiation. This deviation is calculated based on the baseline generated in step 2, combined with the feature vectors of each edge, according to the baseline deviation formula. When the edge lifecycle feature of the external number X has a continuous deviation from the cross-number segment baseline, the baseline deviation exhibits a stable bias, enabling the cumulative embedding vector of the node to fuse number segment context information.

[0078] The following illustrates the changes in some dimensions of the cumulative embedding vector of certain nodes within the external number X and sub-number A segments during continuous-time dynamic graph neural network processing. For ease of illustration, only the values ​​of the first three principal dimensions of the embedding vector after three edge events are listed.

[0079] Table 3. Changes in the cumulative embedding vector of the penetration node as the event progresses.

[0080] The three edge events of external number X record its establishment of edge relationships with user 1 and user 3, as well as its two calls with user 1. Each event triggers an update of its memory state, causing the cumulative embedding vector to continuously change across all dimensions as the event progresses, reflecting the penetration process of gradually establishing call relationships with multiple normal numbers within sub-number segment A. The node cumulative embedding vector output in this step provides the basis for calculating the changes in the sub-number segment embedding distribution structure in step 4.

[0081] Step 4: Generate the cumulative sequence of KL divergence increments for sub-segments.

[0082] For sub-segment A, collect the cumulative embedding vectors of all nodes within the sub-segment, where the node index is used to distinguish each node within the sub-segment. Based on the cumulative embedding vectors of all nodes, calculate the embedding vector covariance matrix, where the total number of nodes within the sub-segment and the mean vector of the cumulative embedding vectors of all nodes are used as formula parameters in the calculation.

[0083] After each new edge event is triggered, the embedding vector covariance matrix of sub-segment A is recalculated. The KL divergence algorithm is used to calculate the KL divergence between the current eigenvalue distribution of the covariance matrix and the previous eigenvalue distribution, which is then used as the KL divergence increment. These increments are accumulated in chronological order to form a cumulative sequence of KL divergence increments for sub-segment A.

[0084] As external number X gradually establishes call relationships with users 1, 3, and 2, the embedding vectors of some nodes within sub-number segment A gradually deviate from their normal distribution. Consequently, the eigenvalue distribution of the covariance matrix changes, and the KL divergence increment continuously accumulates positive values. The following shows the KL divergence increment and cumulative value of sub-number segment A after the fourth edge event is triggered.

[0085] Table 4. Cumulative Sequence of KL Divergence Increment in Sub-segment A

[0086] The table above shows that the KL divergence increment from the first call between external number X and user 1, as a single event, is only 0.02, which is difficult to distinguish from normal fluctuations. As external number X establishes call relationships with users 3 and 2, the KL divergence increment remains positive over multiple consecutive event triggering cycles, with the cumulative value increasing from 0.02 to 0.85, forming a continuous positive accumulation. This pattern indicates that the node embedding distribution within sub-number segment A has undergone a group-level structural change, and sub-number segment A is marked as a segment with active structural changes. The cumulative KL divergence increment sequence generated in this step serves as one of the input conditions for joint change point detection in step 5.

[0087] Step 5: Joint change point detection.

[0088] For each node in sub-segment A, the number of unique called parties added to the node within a unit of time is counted, and a smoothed value is calculated using the exponentially weighted moving average algorithm, which is used as the new edge establishment rate function for that node. The cumulative KL divergence increment sequence of sub-segment A output in step 4 is aligned with the new edge establishment rate function of each node in the time dimension, and joint change point detection is performed synchronously.

[0089] External number X established connections with user 1 on January 18th, user 3 on February 2nd, and user 2 on February 16th. It then entered a period of silence lasting several weeks. On March 5th, it spoke with user 1 again but did not establish a new connection. Its new connection establishment rate function experienced a sudden increase in mid-to-late February, then stabilized at a new level in March, exhibiting a clear step-like upward pattern. This pattern coincides with the continuous accumulation of positive values ​​in the KL divergence increment of sub-number segment A.

[0090] The joint change point detection results are shown in the table below, where the external number X simultaneously satisfies the KL divergence continuous positive accumulation condition and the step-like upward pattern condition.

[0091] Table 5. Results of Joint Change Point Detection for Sub-segment A

[0092] Although users 1, 2, and 3 have a call relationship with external number X, they do not exhibit any behavior of extending edges to a large number of new peers; their new edge establishment rate function does not increase stepwise. External number X is marked as a penetration candidate node.

[0093] Step 6: Penetration feature extraction and hierarchical early warning.

[0094] For external number X, extract the called-side attributes of all newly added edges, including the distribution entropy of the called number segment, the evolution trend of the cosine distance between the called node embedding vector and the embedding vector of the penetration candidate node, and the degree centrality ranking of the called node in its respective sub-segment. Concatenate these called-side attributes with the node cumulative embedding vector, KL divergence cumulative curve shape features, and new edge rate change point parameters of external number X, and input them into the penetration pattern classification model after Z-score standardization.

[0095] The called parties of external number X are distributed across three different numbers (User 1, User 3, and User 2) within sub-segment A. The entropy of the number segment to which the called numbers belong is close to zero, indicating that the called parties are concentrated within a single target number segment. The cosine distance sequence between the called node and external number X shows a gradually converging trend over three time periods. The degree centrality ranking of the called node within sub-segment A is 1st, 4th, and 3rd, respectively, indicating that external number X preferentially contacts nodes with higher social status within the number segment. These characteristics highly match the low-frequency, slow penetration behavior pattern.

[0096] The following shows the main splicing feature components and their output results of the external number X input penetration pattern classification model.

[0097] Table 6. Characteristics and Classification Output of Penetration Candidate Nodes

[0098] The penetration pattern classification model outputs an abnormal risk probability of 0.93, exceeding the preset threshold of 0.80. The penetration stage label is "edge expansion period," indicating that the identified object is in the evolutionary stage of gradually expanding the connection coverage within the number segment. The system then generates a voice service abnormal behavior risk warning result for external number X and all peer numbers with which it has established call relationships, and pushes the warning result along with the penetration stage label to the risk handling queue.

[0099] Overall explanation of data flow: Throughout the implementation process, the data undergoes five stages of transmission and transformation. In the first stage, the original call records of sub-number segment A from January 1st to March 31st of a given year are deduplicated through the first call and transformed into a call relationship graph with edge creation time, most recent active time, and cumulative call count. Simultaneously, intra-segment and cross-segment edges are categorized. In the second stage, each edge in the call relationship graph has its lifecycle feature vector calculated based on its time attribute. An edge lifecycle baseline is generated by classifying intra-segment and cross-segment edges, providing a benchmark for subsequent deviation calculations. In the third stage, the edges in the call relationship graph are sorted by creation time to form an edge event stream. A continuous-time dynamic graph neural network updates the node's memory state driven by each edge event, and outputs a cumulative embedding vector after fusing time encoding and baseline deviation. In the fourth stage, the cumulative embedding vectors of all nodes within sub-number segment A are calculated using the covariance matrix and accumulated using KL divergence increments to form a KL divergence increment cumulative sequence reflecting changes in the group structure. In the fifth stage, the sequence is aligned temporally with the new edge establishment rate function of the external number X. Penetration candidate nodes are identified through joint change point detection. Then, after called party attribute extraction, feature concatenation, and a penetration pattern classification model, an abnormal risk probability of 0.93 and a "edge expansion period" penetration stage label are output. Finally, a risk warning result covering the penetration candidate nodes and all their corresponding numbers is generated. This complete process achieves end-to-end data transformation from raw call records to tiered risk warnings, verifying that low-frequency, slow-speed penetration-type abnormal behavior can be effectively accumulated and identified using this method.

[0100] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A method for identifying abnormal behavior risks in voice services based on machine learning, characterized in that, Includes the following steps: Obtain the voice call records of the target virtual operator number segment, create edge relationships with the number as the node and the first call between two numbers, and generate a call relationship graph with number segment level labels and edge time attributes; Calculate the edge lifecycle feature vector for each edge in the call relationship graph, classify and statistically analyze the feature distribution according to edge within number segment and edge across number segment, and generate edge lifecycle baselines distinguished by number segment level; All edges in the call relationship graph are arranged according to their creation time to form an edge event stream. The edge event stream is input into a continuous-time dynamic graph neural network. The memory state of the nodes participating in the edge event is updated with each edge event as the driver. The cumulative embedding vector of the event-driven nodes is output. When updating the memory, the deviation of the edge life cycle feature vector of the current edge event from the edge life cycle baseline distinguished by the number segment level is used as the input. The embedding vector covariance matrix is ​​calculated for each sub-segment based on the node cumulative embedding vector. The KL divergence increment between the eigenvalue distributions of the covariance matrix at adjacent time points is calculated, and the cumulative KL divergence increment sequence for each sub-segment is generated. For each node, calculate the new edge establishment rate function, perform joint change point detection by combining the KL divergence increment cumulative sequence with the new edge establishment rate function, and mark the nodes that meet the joint change point conditions as penetration candidate nodes. Multi-dimensional features are extracted from penetration candidate nodes and input into the penetration pattern classification model. The model outputs the abnormal risk probability and penetration stage label. For penetration candidate nodes whose abnormal risk probability exceeds the preset threshold, a voice service abnormal behavior risk warning result is generated.

2. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 1, characterized in that, The edge lifecycle feature vector It includes the following components: edge survival time, which is the difference between the most recent active time and the edge creation time; slope of the active frequency decay curve, which is the slope value obtained by fitting the decay curve after dividing the edge into equal time intervals and counting the number of calls in each interval; and coefficient of variation of call interval time, which is the ratio of the standard deviation to the mean of the time interval between all two adjacent calls of the edge. The edge creation time delay ratio is the ratio of the difference between the edge creation time and the first appearance time of the source node of that edge to the total existence time of the source node in the call relationship graph; among them, Z-score standardization is performed on each component.

3. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 1, characterized in that, The continuous-time dynamic graph neural network includes a time encoding function, a memory update unit, and an embedding generation unit; for each new edge event, the time encoding function calculates the time difference between the current edge event and the last time the source node and target node participated in the event. and Mapped to time-coded vectors ,in The time interval between the current edge event and the last time the source node participated in the edge event. The time interval between the current edge event and the last time the target node participated in an edge event is defined; the memory update unit encodes the time vector. Feature information of edge events The current memory state of the source node and the current memory state of the target node Concatenation is used as input, where This is the edge lifecycle feature vector corresponding to the current edge event. This is the memory state vector of the source node up to the current time step. The source node's memory state vector before the current time is given by a gated cyclic transformation, which outputs the updated source node's memory state and the target node's memory state. The embedding generation unit, based on the updated memory state and node historical event information, performs a weighted aggregation and then a nonlinear mapping to output the cumulative embedding vectors of the source nodes. Cumulative embedding vector of target node ,in The current moment when the event occurs. This is the identifier of the source node. This is the identifier for the target node.

4. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 3, characterized in that, The time encoding function The expression is: ； in to Arranged in ascending order A preset angular frequency, The preset positive integer represents the number of encoding dimensions, and the vector contains a total of Trigonometric function components.

5. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 3, characterized in that, The input to the memory update unit also includes the edge lifecycle baseline deviation distinguished by the number segment level. The baseline deviation The calculation method is as follows: ,in This is the edge lifecycle feature vector corresponding to the current edge event. This is the mean vector of each component of the edge lifecycle feature vector corresponding to the category to which the current edge event belongs. This is the standard deviation vector of each component of the edge lifecycle feature vector corresponding to the category to which the current edge event belongs. This is the category identifier for the current edge, divided by edge within the number segment or edge across number segments. Division and subtraction are performed item by item according to the components.

6. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 1, characterized in that, The embedding vector covariance matrix The calculation method is as follows: ； in This represents the total number of nodes within this sub-segment. For the first number in this sub-segment Each node at the current moment The cumulative embedding vector, This is the mean vector of the cumulative embedding vectors of all nodes within this sub-segment. This indicates transpose; after each new edge event is triggered, the embedding vector covariance matrix of the affected sub-segment is recalculated; the KL divergence increment is the current covariance matrix. eigenvalue distribution The distribution of eigenvalues ​​of the covariance matrix obtained in the previous calculation The KL divergence values ​​between them, where and These are the eigenvalue distributions formed by arranging the corresponding covariance matrices in descending order of their eigenvalues. This represents the time interval between two consecutive calculations.

7. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 1, characterized in that, The new edge establishment rate function is obtained by calculating a smooth value using an exponentially weighted moving average algorithm based on the number of unique called counterparts added by a node within a unit of time. The joint change point detection includes the following steps: for the cumulative KL divergence increment sequence of each sub-segment, it is determined whether the KL divergence increment continues to accumulate positively within multiple consecutive event triggering cycles. If so, the sub-segment is marked as a structural change active segment. For each node within the structural change active segment, it is detected whether its new edge establishment rate function exhibits a step-like upward pattern within a range aligned with the time period of continuous positive accumulation of KL divergence. The step-like upward pattern refers to the new edge establishment rate function maintaining a stable or slow growth for several adjacent time periods before experiencing a sudden increase, and then maintaining a stable level again after the sudden increase. Nodes that simultaneously meet the conditions of continuous positive accumulation of KL divergence and the step-like upward pattern are marked as penetration candidate nodes.

8. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 1, characterized in that, The multi-dimensional features include called party attributes, which include: the distribution entropy of the called number segment, the evolution trend of the cosine distance between the called node embedding vector and the penetration candidate node embedding vector arranged according to the call time, and the degree centrality sorting of the called nodes in their respective sub-segments according to the node degree from high to low. The called party attributes are combined with the node cumulative embedding vector of the penetration candidate nodes, the shape features of the KL divergence cumulative curve, and the new edge rate variable point parameters to form a concatenated feature vector. The concatenated feature vector is then subjected to Z-score standardization and input into the penetration pattern classification model.

9. The method for identifying abnormal behavior risks in voice services based on machine learning according to claim 1, characterized in that, The generation of the risk warning result also includes: calculating the estimated time to reach the critical penetration density based on the new edge establishment rate function of the penetration candidate node and the current scale of the penetrated call network, and incorporating the estimated time into the risk warning result.

10. A machine learning-based voice service abnormal behavior risk identification system, used to execute the machine learning-based voice service abnormal behavior risk identification method according to any one of claims 1 to 9, characterized in that, include: The call relationship graph generation module is used to obtain the voice call records of the target virtual operator number segment, create edge relationships with the number as the node and the first call as the edge relationship, and generate a call relationship graph with number segment level labels and edge time attributes. The edge lifecycle baseline calculation module is used to calculate the edge lifecycle feature vector for each edge in the call relationship graph, classify and statistically distribute the features according to edge within number segment and edge across number segment, and generate edge lifecycle baselines distinguished by number segment level. The dynamic graph processing module is used to arrange all edges in the call relationship graph according to their creation time to form an edge event stream. The edge event stream is processed by a continuous-time dynamic graph neural network, and the cumulative embedding vector of the event-driven node with fused number segment context information is output. The structural change detection module is used to calculate the embedding vector covariance matrix for each sub-segment based on the node cumulative embedding vector, and calculate the KL divergence increment of the eigenvalue distribution of the embedding vector covariance matrix after each new edge event is triggered, generating the cumulative KL divergence increment sequence for each sub-segment. The joint change point detection module is used to calculate the new edge establishment rate function for each node, perform joint change point detection by combining the KL divergence increment cumulative sequence with the new edge establishment rate function, and mark the nodes that meet the joint change point conditions as penetration candidate nodes. The penetration pattern classification module is used to extract the called-end attributes of penetration candidate nodes and concatenate them with the node cumulative embedding vector, KL divergence cumulative curve shape features and new edge rate variable point parameters. The input is a pre-trained penetration pattern classification model, and the output is the abnormal risk probability and penetration stage label. The risk warning module is used to generate risk warning results for abnormal voice service behavior of penetration candidate nodes and all their peer numbers when the probability of abnormal risk exceeds a preset threshold.

Images