Early warning dissuasion method, device, equipment, medium and program product

Abstract

The application provides a pre-warning dissuasion method, device, equipment, medium and program product, relates to the technical field of information security, and is used for improving the dissuasion success rate of abnormal events. The specific technical scheme is as follows: determining the event type of a first abnormal event based on the pre-warning clue information corresponding to the abnormal event and the current behavior characteristic information of the victim subject of the abnormal event; determining the stage information of the event development stage in which the victim subject is currently located in the abnormal event based on the target event time sequence template corresponding to the event type of the abnormal event and the current behavior characteristic information of the victim subject of the abnormal event; determining a target dissuasion opportunity based on the target event time sequence template and the stage information of the event development stage in which the victim subject is currently located in the abnormal event; and performing a dissuasion operation based on the event type, the event time sequence information, the stage information of the event development stage in which the victim subject is currently located in the abnormal event, and the target dissuasion opportunity. The application is applied in an anti-fraud main prevention scene.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, device, equipment, medium and program product for early warning and dissuasion. Background Technology

[0002] With the continued high incidence of telecommunications and online fraud, its methods are becoming increasingly diverse and innovative. Early warning and dissuasion are crucial to breaking the fraud chain; failure to do so in a timely and effective manner will result in financial losses for victims.

[0003] In related technologies, warnings against telecom fraud can typically be issued through methods such as tiered dissuasion, victim-based dissuasion, AI-powered automated voice dissuasion, or keyword-matched text recommendation dissuasion. Specifically, the aforementioned tiered dissuasion involves dissuading victims based on their risk level (high-risk, medium-risk, low-risk) using methods such as in-person visits, phone calls, and text messages; the aforementioned victim-based dissuasion matches appropriate dissuasion texts and strategies to the victim's profile (e.g., age, occupation); the aforementioned AI-powered automated voice dissuasion uses robots to make mass outbound calls for dissuasion; and the aforementioned keyword-matched text recommendation dissuasion dynamically adjusts the dissuasion text by recognizing keywords in the victim's spoken content.

[0004] However, since the above-mentioned methods of dissuasion are all triggered when the risk of telecommunications fraud is detected, the best window for intervention may have already passed by the time the risk of telecommunications fraud is detected, making it impossible to intervene in time and thus resulting in personal and property losses. Summary of the Invention

[0005] This application provides a method, device, equipment, medium, and program product for early warning and dissuasion, used to improve the success rate of dissuading abnormal events.

[0006] In a first aspect, embodiments of this application provide an early warning and dissuasion method, the method comprising: determining the event type of the abnormal event based on early warning clue information corresponding to the abnormal event and the current behavioral characteristic information of the victim of the abnormal event; determining the stage information of the current event development stage of the victim in the abnormal event based on the target event time sequence template corresponding to the event type of the abnormal event and the current behavioral characteristic information of the victim of the abnormal event; the target event time sequence template including the event time sequence information corresponding to the event type and the dissuasion effect parameters of each event development stage in the event time sequence; determining the target dissuasion timing based on the target event time sequence template and the stage information of the current event development stage of the victim in the abnormal event; and performing a dissuasion operation based on the event type, the event time sequence information, the stage information of the current event development stage of the victim in the abnormal event, and the target dissuasion timing.

[0007] The technical solution provided in this application brings at least the following beneficial effects: By pre-setting multiple event sequence templates, after determining the event type of the abnormal event based on the warning clue information corresponding to the abnormal event and the current behavioral characteristics of the victim of the abnormal event, this application can directly determine the stage information of the victim's current event development stage in the abnormal event based on the target event sequence template corresponding to the event type and the current behavioral characteristics of the victim of the abnormal event. Then, based on the target event sequence template corresponding to the event type and the stage information of the victim's current event development stage in the abnormal event, the application can determine the time of dissuasion with the highest success rate and execute the dissuasion operation, ultimately achieving the goal of accurate warning and dissuasion with "the right person, the right time, the right words, and the right method", thereby improving the success rate of dissuasion for abnormal events.

[0008] One possible implementation involves determining the target dissuasion timing based on the target event timeline template and the stage information of the victim's current stage of event development in the abnormal event. This includes: determining dissuasion effectiveness parameters corresponding to the victim's current stage of event development in the abnormal event, based on the target event timeline template and the stage information of the victim's current stage of event development in the abnormal event; the dissuasion effectiveness parameters include the historical dissuasion success rate corresponding to the victim's current stage of event development in the abnormal event, and the dissuasion difficulty coefficient corresponding to the next stage of event development; and determining the target dissuasion timing based on the dissuasion effectiveness parameters.

[0009] Another possible implementation method, which determines the target dissuasion timing based on the aforementioned dissuasion effect parameters, includes: calculating the dissuasion assessment value of the current stage of event development of the victim in the aforementioned abnormal event based on the aforementioned dissuasion effect parameters; and determining the target dissuasion timing based on the aforementioned dissuasion assessment value.

[0010] Another possible implementation involves performing dissuasion operations based on the aforementioned event type, event sequence information, the current stage of the event development of the victim in the aforementioned abnormal event, and the aforementioned target dissuasion timing. This includes: generating a dissuasion plan based on the aforementioned event type and the current stage of the event development of the victim in the aforementioned abnormal event; the dissuasion plan including dissuasion timing, dissuasion channels, dissuasion frequency, dissuasion text, and the dissuasion execution entity; and performing corresponding dissuasion operations based on the aforementioned dissuasion plan.

[0011] In another possible implementation, before the aforementioned target event timeline template corresponding to the event type of the abnormal event and the current behavioral characteristic information of the victim of the abnormal event, the method further includes: determining a target event timeline template corresponding to the event type from an event timeline template library based on the event type of the abnormal event; wherein the event timeline template library includes at least one event timeline template, each event timeline template corresponds to an event type, and each event timeline template is generated based on historical event data and historical dissuasion data of the corresponding event type.

[0012] Another possible implementation of the aforementioned warning and dissuasion device further includes: an acquisition module for acquiring event data of at least one event of the first event type; an extraction module for extracting the temporal behavioral feature sequence corresponding to each event; a clustering module for clustering the temporal behavioral feature sequence corresponding to each event using a time series clustering algorithm to obtain event time sequence information of the event corresponding to the first event type; the event time sequence information includes stage information of each event development stage of the event corresponding to the first event type; a calculation module for calculating the dissuasion effect parameters of each event development stage based on the historical dissuasion data of each event; a generation module for generating an event time sequence template corresponding to the first event type based on the event time sequence information and the dissuasion effect parameters of each event development stage; and a storage module for storing the event time sequence template corresponding to the first event type in the event time sequence template library.

[0013] Secondly, embodiments of this application provide an early warning and dissuasion device, comprising: a determining module, configured to determine the event type of the abnormal event based on early warning clue information corresponding to the abnormal event and the current behavioral characteristic information of the victim of the abnormal event; the determining module is further configured to determine the stage information of the current event development stage of the victim in the abnormal event based on a target event time sequence template corresponding to the event type of the abnormal event and the current behavioral characteristic information of the victim of the abnormal event; the target event time sequence template includes event time sequence information corresponding to the event type and dissuasion effect parameters for each event development stage in the event time sequence; the determining module is further configured to determine a target dissuasion timing based on the target event time sequence template and the stage information of the current event development stage of the victim in the abnormal event; and an execution module, configured to execute a dissuasion operation based on the event type, the event time sequence information, the stage information of the current event development stage of the victim in the abnormal event, and the target dissuasion timing.

[0014] One possible implementation is that the aforementioned determining module is specifically used to: determine the dissuasion effect parameters corresponding to the current stage of the event development of the victim in the aforementioned abnormal event, based on the aforementioned target event timeline template and the stage information of the current stage of event development of the victim in the aforementioned abnormal event; the dissuasion effect parameters include the historical dissuasion success rate corresponding to the current stage of event development of the victim in the aforementioned abnormal event, and the dissuasion difficulty coefficient corresponding to the next stage of event development of the aforementioned event development stage; and determine the target dissuasion timing based on the aforementioned dissuasion effect parameters.

[0015] Another possible implementation, the aforementioned determining module, is specifically used to: calculate the dissuasion assessment value of the victim's current stage of event development in the aforementioned abnormal event based on the aforementioned dissuasion effect parameters; and determine the target dissuasion timing based on the aforementioned dissuasion assessment value.

[0016] Another possible implementation is that the aforementioned execution module is specifically used to: generate a dissuasion plan based on the aforementioned event type and the current stage of the event development of the aforementioned victim in the aforementioned abnormal event. The dissuasion plan includes the timing of dissuasion, the channels for dissuasion, the frequency of dissuasion, the dissuasion text, and the dissuasion execution entity; and execute the corresponding dissuasion operation based on the aforementioned dissuasion plan.

[0017] In another possible implementation, the aforementioned determining module is further configured to: determine a target event time sequence template corresponding to the aforementioned event type from the event time sequence template library based on the event type of the aforementioned abnormal event; wherein the aforementioned event time sequence template library includes at least one event time sequence template, each event time sequence template corresponds to an event type, and each event time sequence template is generated based on historical event data and historical dissuasion data of the corresponding event type.

[0018] Another possible implementation of the aforementioned warning and dissuasion device further includes: an acquisition module for acquiring event data of at least one event of the first event type; an extraction module for extracting the temporal behavioral feature sequence corresponding to each event; a clustering module for clustering the temporal behavioral feature sequence corresponding to each event using a time series clustering algorithm to obtain event time sequence information of the event corresponding to the first event type; the event time sequence information includes stage information of each event development stage of the event corresponding to the first event type; a calculation module for calculating the dissuasion effect parameters of each event development stage based on the historical dissuasion data of each event; a generation module for generating an event time sequence template corresponding to the first event type based on the event time sequence information and the dissuasion effect parameters of each event development stage; and a storage module for storing the event time sequence template corresponding to the first event type in the event time sequence template library.

[0019] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory stores a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect described above.

[0020] Fourthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect described above.

[0021] Fifthly, this application provides a computer program product stored in a storage medium, which, when executed by a computer, implements the method described in the first aspect.

[0022] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0023] The beneficial effects of the second to sixth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0024] Figure 1 A schematic diagram of the network architecture for an application of an early warning and dissuasion method provided in this application embodiment;

[0025] Figure 2 A flowchart illustrating an early warning and dissuasion method provided in an embodiment of this application;

[0026] Figure 3 A flowchart illustrating another early warning and dissuasion method provided in this application embodiment;

[0027] Figure 4 A flowchart illustrating another early warning and dissuasion method provided in this application embodiment;

[0028] Figure 5 A flowchart illustrating another early warning and dissuasion method provided in this application embodiment;

[0029] Figure 6 A flowchart illustrating another early warning and dissuasion method provided in this application embodiment;

[0030] Figure 7 A flowchart illustrating the process of constructing an event sequence template provided in an embodiment of this application;

[0031] Figure 8 A flowchart illustrating the implementation process of an early warning and dissuasion method provided in this application embodiment;

[0032] Figure 9This application provides an example of an event timing template for an event type.

[0033] Figure 10 This is a schematic diagram of the structure of an early warning and dissuasion device provided in an embodiment of this application;

[0034] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0035] The following is a detailed description of the warning and dissuasion methods, devices, equipment, media, and procedures provided in this application, with reference to the accompanying drawings.

[0036] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0037] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0038] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0039] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0040] The present application provides a warning and dissuasion method, device, equipment, medium, and program product that can be applied to anti-fraud prevention scenarios.

[0041] In existing solutions, early warning and dissuasion technologies mainly include the following categories:

[0042] Risk-based tiered dissuasion: Different dissuasion methods are adopted according to the risk level (high-risk, medium-risk, low-risk) of the warning clues, such as in-person visits for high-risk cases, phone calls for medium-risk cases, and text messages for low-risk cases. This method achieves differentiated allocation of dissuasion resources, but it does not take into account the specific characteristics of different types of fraud. Under the same risk level, the dissuasion effect of different types of fraud varies significantly.

[0043] Precise dissuasion based on victim profiles: This method matches appropriate dissuasion texts and strategies to a victim's profile, including age, occupation, education level, and history of being scammed. While focusing on victim characteristics, this approach ignores the chronological progression of fraud cases and fails to provide timely dissuasion.

[0044] AI-based automated dissuasion: This method uses AI voice robots to make batch outbound calls to those under warning, improving efficiency by replacing manual intervention. While this solves the efficiency problem, the AI ​​text is usually a generic template, making it impossible to provide differentiated and phased dissuasion based on the different timelines of various fraud types.

[0045] Keyword-based text recommendation: During the dissuasion process, corresponding text templates are matched to identify keywords described by the victim. This method enables dynamic text adjustment, but it relies on the victim's narration and cannot proactively predict the victim's current stage of the crime, resulting in insufficient timeliness.

[0046] In summary, existing early warning and dissuasion technologies have the following common shortcomings: ① They do not consider the temporal characteristics of different types of fraud, making it impossible to accurately pinpoint the victim's stage in the crime; ② The timing of dissuasion lacks scientific basis, missing the key point for optimal dissuasion effect; ③ The dissuasion text does not match the crime logic of the case type, making it difficult to effectively persuade the victim; ④ There is a lack of closed-loop evaluation and strategy iteration mechanisms for the dissuasion effect.

[0047] To address the aforementioned technical problems, this application provides a method, device, equipment, medium, and program product for early warning and dissuasion. By pre-setting multiple event sequence templates, after determining the event type of an abnormal event based on the early warning clue information corresponding to the abnormal event and the current behavioral characteristics of the victim of the abnormal event, the application can directly determine the stage information of the victim's current event development stage in the abnormal event based on the target event sequence template corresponding to the event type and the current behavioral characteristics of the victim of the abnormal event. Furthermore, based on the target event sequence template corresponding to the event type and the stage information of the victim's current event development stage in the abnormal event, the application can determine the dissuasion opportunity with the highest success rate and execute the dissuasion operation, ultimately achieving the goal of accurate early warning and dissuasion with "the right person, the right time, the right words, and the right method," thereby improving the success rate of dissuasion for abnormal events.

[0048] The following description, in conjunction with the accompanying drawings, details the warning and dissuasion methods, devices, equipment, media, and program products provided in the embodiments of this application.

[0049] Figure 1 The network architecture of an early warning and dissuasion method provided in an embodiment of this application is illustrated. For example... Figure 1 As shown, the network architecture includes an early warning and dissuasion device 101 and a terminal device 102. The early warning and dissuasion device 101 and the terminal device 102 are interconnected.

[0050] In some embodiments, the warning and dissuasion device 101 may be a server, a computer, or a processor or processing unit within a server or computer. The server may be a single server or a server cluster consisting of multiple servers. It should be noted that the embodiments of this application do not limit the specific device form of the warning and dissuasion device 101. Figure 1 The example shown is a single server for the China-Israel early warning and dissuasion device 101.

[0051] In some embodiments, the terminal device may be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, personal computer (PC), ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., and the embodiments of this application do not specifically limit it. Figure 1 The example shown is a mobile phone, with terminal device 102 as an example.

[0052] In some embodiments, the warning and dissuasion device 101 determines the event type of the abnormal event based on the warning clue information corresponding to the abnormal event and the current behavioral characteristics information of the victim of the abnormal event; it determines the stage information of the current event development stage of the victim in the abnormal event based on the target event time sequence template corresponding to the event type of the abnormal event and the current behavioral characteristics information of the victim of the abnormal event; the target event time sequence template includes the event time sequence information corresponding to the event type and the dissuasion effect parameters of each event development stage in the event time sequence; it determines the target dissuasion timing based on the target event time sequence template and the stage information of the current event development stage of the victim in the abnormal event; and it sends a dissuasion SMS to the terminal device 102 based on the event type, the event time sequence information, the stage information of the current event development stage of the victim in the abnormal event, and the target dissuasion timing.

[0053] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0054] See Figure 2 This is a flowchart illustrating a warning and dissuasion method provided in an embodiment of this application. Figure 2 As shown, the early warning and dissuasion method provided in this application embodiment can be implemented by the aforementioned early warning and dissuasion device, specifically including the following steps 201 to 204.

[0055] Step 201: The early warning and dissuasion device determines the event type of the abnormal event based on the early warning clues corresponding to the abnormal event and the current behavioral characteristics of the victim of the abnormal event.

[0056] In some embodiments, the abnormal event in this application refers to an event that occurs during business interaction, deviates from the normal business process, and has the potential to harm the user's property or information rights. Examples include fraud cases, malicious fraudulent transactions, illegal harassment, and fake transactions that infringe upon the interests of relevant parties.

[0057] For example, taking an unusual event as a fraud case, the event type of the aforementioned unusual event can be the case type of the fraud case.

[0058] In some embodiments, the victim in this application refers to a participating entity whose legitimate rights and interests are adversely affected and may suffer losses in an abnormal event.

[0059] In some embodiments, the aforementioned warning clues refer to information indicating a potential risk of being scammed.

[0060] For example, the aforementioned warning clues include, but are not limited to: duration of overseas calls, frequency of overseas calls, receipt of fraudulent keywords (e.g., secure account, order-brushing rebate, deposit, screen sharing, unfreezing fee, credit-related cases), unfamiliar SMS links, fake APP download prompts, access to phishing websites, frequent small-amount transfer attempts, and large-amount funds prepared for transfer.

[0061] In some embodiments, the aforementioned behavioral characteristics information includes: communication behavior (e.g., inbound / outbound calls, duration, frequency), network behavior (e.g., access duration, access depth, whether an APP is downloaded), and financial behavior (e.g., whether there is a transfer, the amount transferred, the frequency of transfers), etc.

[0062] In some embodiments, the types of abnormal events in this application include, but are not limited to: fraudulent order-brushing and rebate schemes, fraudulent investment and wealth management, fraudulent refund schemes impersonating e-commerce or logistics customer service, fraudulent online loans, credit repair scams, online dating and matchmaking scams (e.g., pig butchering scams), and fraudulent security account schemes impersonating public security, procuratorate, and court officials.

[0063] Step 202: The early warning and dissuasion device determines the stage information of the victim's current stage of event development in the abnormal event based on the target event time sequence template corresponding to the event type of the abnormal event and the current behavioral characteristics information of the victim of the abnormal event.

[0064] In some embodiments, different event timing templates correspond to different event types.

[0065] In some embodiments, the event sequence template corresponding to any event type includes event sequence information corresponding to that event type, as well as dissuasion effect parameters for each event development stage in the event sequence.

[0066] In some embodiments, the event sequence corresponding to any of the above event types refers to the sequence of the crime process of the historical abnormal events corresponding to that event type.

[0067] In some embodiments, the target event timeline template includes event timeline information corresponding to the event type of the abnormal event, as well as dissuasion effect parameters for each event development stage in the event timeline.

[0068] For example, the dissuasion effectiveness parameters for any event development stage in the event timeline include, but are not limited to: the historical dissuasion success rate corresponding to that event development stage, and the dissuasion difficulty coefficient corresponding to the next event development stage.

[0069] In some embodiments, the stage information of the current stage of event development of the aforementioned victim in the abnormal event includes, but is not limited to, the stage label of the event development stage, the stage name of the event development stage, and the position of the event development stage in the entire event timeline.

[0070] For example, such as Figure 9 As shown, taking a fraud case as an example, assuming the case type is "pig butchering scam", the corresponding event sequence template includes the event sequence information corresponding to the case type and the dissuasion effect parameters of each event development stage in the event sequence. The event sequence information includes the stage information of each event development stage.

[0071] The above-mentioned "pig butchering scam" includes five stages of development: T1-T2-T3-T4-T5. T1 refers to the establishment of contact, T2 refers to the establishment of trust, T3 refers to the inducement to invest, T4 refers to the small profit stage, and T5 refers to the large profit harvest stage.

[0072] Furthermore, the stage information corresponding to T1 includes: stage name "establishing contact", time position "0-3 days"; the stage information corresponding to T2 includes: stage name "establishing trust", time position "3-14 days"; the stage information corresponding to T3 includes: stage name "inducing investment", time position "7-21 days"; the stage information corresponding to T4 includes: stage name "small profit", time position "14-30 days"; the stage information corresponding to T5 includes: stage name "large harvest", time position "after 30 days".

[0073] Furthermore, such as Figure 9As shown, based on the characteristics of the victim (e.g., the time of first contact, the victim's behavioral characteristics), the current stage of the victim (e.g., stage T3) and the remaining window (e.g., about 4-20 days until the large-scale harvesting stage) can be determined. Based on the determined information, the optimal time for dissuasion can be determined, thereby improving the success rate of dissuasion.

[0074] In some embodiments, the stage information of the victim's current stage of event development in the abnormal event is determined through the following process: First, the similarity between the victim's user feature information and the stage features of each event development stage in the event timeline is calculated to obtain the similarity Sim(V_user, Tj) between the victim and each event development stage; and, based on the time span from the victim's first contact to the current time, the overlap and matching degree Time_match(t, Tj) between the victim and each event development stage in the event timeline can be calculated; then, based on the similarity Sim(V_user, Tj) between the victim and each event development stage, the time span from the victim's first contact to the current time, and the overlap and matching degree between the victim and each event development stage in the event timeline, the comprehensive matching degree Match_score(Tj) corresponding to the victim and each event development stage is calculated; finally, the event development stage with the highest comprehensive matching degree is the stage information Stage_current of the event development stage in which the victim is currently in the abnormal event.

[0075] For example, the similarity Sim(V_user, Tj) between the victim and each stage of the event can be calculated based on the following formula 1:

[0076] Sim(V_user, Tj) = (V_user · W_j) / (||V_user|| × ||W_j||) (Formula 1)

[0077] Where Sim(V_user, Tj) represents the similarity between the victim's feature vector and the feature templates of each stage, V_user represents the feature vector formed by encoding the victim's current behavioral features, Tj represents the template of the j-th stage, and W_j represents the feature weight vector of the j-th stage.

[0078] For example, the degree of overlap and matching between the victim and each stage of the event in the timeline can be calculated based on the following formula 2: Time_match(t, Tj)

[0079] Time_match(t, Tj) = exp(-|t - μ_tj|^2 / (2 × σ_tj^2)) (Formula 2)

[0080] Wherein, Time_match(t, Tj) represents the degree of overlap and matching between the time span from the victim's first contact to the current time and the template of the j-th stage, t represents the time span from the victim's first contact to the current time, μ_tj represents the mean of the time window of the j-th stage, and σ_tj represents the standard deviation of the time window of the j-th stage.

[0081] For example, the overall matching score Match_score(Tj) between the victim and each stage of the event can be calculated based on the following formula 3:

[0082] Match_score(Tj) = α × Sim(V_user, Tj) + β × Time_match(t, Tj) (Formula 3)

[0083] Where Match_score(Tj) represents the overall similarity at stage j, and α and β are weighting coefficients (α=0.7, β=0.3).

[0084] For example, the event development stage with the highest overall matching degree can be determined based on Formula 4:

[0085] Stage_current = argmax(Match_score(Tj)), j ∈ {1, 2, ..., n} (Formula 4)

[0086] Among them, Stage_current represents the stage with the highest overall matching degree, that is, the stage information of the current stage of event development in which the victim is in the abnormal event.

[0087] Step 203: The early warning and dissuasion device determines the timing of target dissuasion based on the target event timeline template and the stage information of the victim's current stage of event development in the abnormal event.

[0088] In some embodiments, the aforementioned target dissuasion timing is used to characterize the stage in which dissuasion of the victim is most effective in the current abnormal event.

[0089] In some embodiments, the warning and dissuasion device can determine the remaining dissuasion time window for the victim in an abnormal event based on the target event time sequence template corresponding to the event type of the abnormal event and the current behavioral characteristics information of the victim of the abnormal event.

[0090] For example, the remaining dissuasion time window for the victim in an abnormal event can be determined based on the following formula 5:

[0091] T_remaining = Time_window_max(Stage_next) - t_current (Formula 5)

[0092] Where T_remaining represents the remaining dissuasion time window, Time_window_max(Stage_next) represents the upper bound of the time window for the next stage, and t_current represents the current time span.

[0093] In some embodiments, combined with Figure 2 ,like Figure 3 As shown, step 203 above can be implemented through steps 203a and 203b.

[0094] Step 203a: The early warning and dissuasion device determines the dissuasion effect parameters corresponding to the current stage of the abnormal event based on the target event time sequence template and the stage information of the victim's current stage of event development in the abnormal event.

[0095] In some embodiments, the aforementioned dissuasion effectiveness parameters include the historical dissuasion success rate corresponding to the current stage of event development in the aforementioned abnormal event, and the dissuasion difficulty coefficient corresponding to the next stage of event development.

[0096] In some embodiments, the aforementioned persuasion effectiveness parameter is used to characterize the success rate of persuasion in the current stage of information. The higher the persuasion effectiveness parameter, the higher the success rate of persuasion in the current stage of information. Conversely, the lower the persuasion effectiveness parameter, the lower the success rate of persuasion in the current stage of information.

[0097] In some embodiments, the aforementioned persuasion difficulty coefficient is used to characterize the difficulty of persuasion. The higher the persuasion difficulty coefficient, the greater the difficulty of persuasion at the corresponding stage. Conversely, the lower the persuasion difficulty coefficient, the less difficult the persuasion at the corresponding stage.

[0098] Step 203b: The early warning and dissuasion device determines the timing of dissuasion based on the dissuasion effect parameters.

[0099] In some embodiments, the warning and dissuasion device can determine the optimal timing score based on the dissuasion effect parameter, and then compare the optimal timing score with a preset threshold to obtain the dissuasion timing result. Specifically, when the optimal timing score is ≥0.6, it is determined that the current time is the optimal dissuasion time, and "dissuade immediately" is output; when 0.4≤Score_timing<0.6 and there is a better time later, "dissuade at an appropriate time" is output; when Score_timing is less than 0.4, "continuous monitoring" is output.

[0100] For example, the optimal timing score can be determined based on the following formulas 6 and 7:

[0101] T_normalized = T_remaining / T_window_max (Formula 6)

[0102] Score_timing = α × P_success(stage) + β × T_normalized - γ × D_next + δ × U_urgency (Formula 7)

[0103] Wherein, T_normalized represents the normalized remaining dissuasion time window, T_window_max represents the standard time window of the current stage, Score_timing represents the optimal timing score, P_success(stage) represents the historical dissuasion success rate of the current stage, D_next represents the dissuasion difficulty coefficient of the next stage (value range 0-1, the larger the value, the higher the difficulty), obtained from the intervention_params of the event sequence template, U_urgency represents the urgency factor, which takes a value of 1 if there is an urgent behavior (such as transferring money, downloading a fraudulent APP, or talking to a fraudulent party), otherwise it takes a value of 0, α, β, γ, δ are weight coefficients, determined by fitting historical data (α=0.35, β=0.25, γ=0.20, δ=0.20).

[0104] In this way, by determining the dissuasion effect parameters corresponding to the current stage of the event development of the identified victim in the abnormal event, the timing of the target dissuasion can be determined, avoiding the missed key node of optimal dissuasion effect due to immediately dissuading after receiving warning clues, thereby improving the success rate of dissuasion in abnormal events.

[0105] In some embodiments, combined with Figure 3 ,like Figure 4 As shown, step 203b above can be implemented through steps 203b1 and 203b2.

[0106] Step 203b1: The early warning and dissuasion device calculates the dissuasion assessment value based on the dissuasion effect parameters, indicating the current stage of the event development in which the victim is located in the abnormal event.

[0107] In some embodiments, the higher the aforementioned dissuasion assessment value (i.e., the aforementioned optimal timing score), the more significant the effect of fraud dissuasion at that stage. Conversely, the lower the optimal timing score, the less significant the effect of fraud dissuasion at that stage.

[0108] Step 203b2: The early warning and dissuasion device determines the timing of dissuasion based on the dissuasion assessment value.

[0109] In some embodiments, when Score_timing ≥ 0.6, the current time is determined to be the optimal time, and "immediately dissuade" is output; when Score_timing ∈ [0.4, 0.6) and there is a better future time, "dissuade at an opportune time" is output; otherwise, "continuous monitoring" is output.

[0110] Step 204: The early warning and dissuasion device performs dissuasion operations based on the event type, event sequence information, the stage information of the victim's current stage of event development in the abnormal event, and the target dissuasion timing.

[0111] Thus, based on the aforementioned event type, event sequence information, the current stage of the event development of the victim in the abnormal event, and the target timing for dissuasion, dissuasion operations are carried out, thereby avoiding the lack of scientific basis in the selection of dissuasion timing, which makes it difficult to effectively persuade the victim, and thus improving the success rate of dissuasion in abnormal events.

[0112] In some embodiments, combined with Figure 2 ,like Figure 5 As shown, step 204 above can be implemented through steps 204a and 204b.

[0113] Step 204a: The early warning and dissuasion device generates a dissuasion plan based on the event type and the stage information of the victim's current stage of event development in the abnormal event.

[0114] In some embodiments, the aforementioned dissuasion plan includes the timing of dissuasion, the channels for dissuasion, the frequency of dissuasion, the text of dissuasion, and the subject responsible for implementing dissuasion.

[0115] In some embodiments, the dissuasive text generation can specifically adopt the following formula:

[0116] Text_output = Template_match(Case_type, Stage) + Slot_fill(User_features) (Formula 8)

[0117] Here, `Text_output` represents the generated dissuasion text. The `Template_match` function retrieves the most matching text template from the text template library based on the event type (i.e., `Case_type` in the above formula) and the time stage (i.e., `Stage` in the above formula). The template contains fixed text and dynamic slots (such as `{victim's name}`, `{fraudulent platform name}`, `{amount involved}`, etc.). The `Slot_fill` function fills the template slots with the specific information of the current victim (i.e., `User_features` in the above formula), generating personalized dissuasion text.

[0118] Step 204b: The early warning and dissuasion device performs the corresponding dissuasion operation based on the dissuasion plan.

[0119] In some embodiments, performing the corresponding dissuasion operation means performing the dissuasion operation through the configured channels according to the generated dissuasion plan.

[0120] In some embodiments, the early warning and dissuasion device can generate differentiated and personalized dissuasion plans based on the event type, the stage information of the victim's current stage of event development in the abnormal event, and the target dissuasion timing.

[0121] For example, the generation of the above-mentioned dissuasion scheme may include the following process:

[0122] (1) Dissuasion text generation: Based on the event type and the stage information of the victim's current stage of event development in the abnormal event, the corresponding dissuasion text template is retrieved from the text template library, and personalized generation is performed in combination with the user characteristics of the victim to generate a dissuasion document that is suitable for the victim.

[0123] For example, text generation can employ a slot-filling-based template generation method, as shown in the following formula:

[0124] Text_output = Template_match(Case_type, Stage) + Slot_fill(User_features)

[0125] The `Template_match` function retrieves the most matching text template from the text template library based on the event type and time sequence. The template contains fixed text and dynamic slots (such as {victim's name}, {fraudulent platform name}, {amount involved}, etc.). The `Slot_fill` function fills the template slots with the specific information of the current victim, generating personalized dissuasion text.

[0126] For example, the above-mentioned text generation rule base includes at least one text generation rule, and each text generation rule can be indexed based on the event type and at least one event development stage of the event sequence corresponding to the event type.

[0127] For example, the above text template includes: an opening statement (stating identity and purpose), a risk disclosure statement (revealing the modus operandi and characteristics of this type of fraud), a targeted reminder statement (addressing key dissuasion points at the current stage), action suggestions statement (suggesting actions to be taken by the victim), and a closing statement statement (providing channels for subsequent assistance).

[0128] For example, each text segment in the text template can be independently retrieved and dynamically combined to achieve differentiated generation of dissuasion text content.

[0129] (2) Configuration of dissuasion channels: Based on the type of event, its timing, and the characteristics of the victim, configure dissuasion channels, including:

[0130] Telephone dissuasion: Applicable to emergency situations where in-depth communication is required.

[0131] SMS dissuasion: suitable for mild warnings and information delivery scenarios.

[0132] Flash message dissuasion: Suitable for scenarios that require mandatory reminders.

[0133] Door-to-door persuasion: Applicable to high-risk scenarios where the victim has been deeply brainwashed.

[0134] Video dissuasion: Suitable for scenarios where face-to-face interaction is required but in-person visits are not possible.

[0135] (3) Frequency configuration of dissuasion: Configure the frequency of dissuasion according to the event type and time sequence, including:

[0136] One-time dissuasion: suitable for low-risk scenarios where a single contact is sufficient.

[0137] Repeated dissuasion: Applicable to scenarios requiring multiple rounds of communication and continuous follow-up.

[0138] Follow-up and dissuasion: Applicable to scenarios where the victim has cooperated but requires continued monitoring.

[0139] (4) Allocation of dissuasion personnel / robots: Based on the difficulty of the incident and the psychological state of the victim, the dissuasion execution personnel are allocated.

[0140] AI robots: suitable for standardized, large-scale scenarios.

[0141] Human agents: Suitable for complex scenarios that require flexible responses.

[0142] Expert support: Suitable for high-risk scenarios requiring professional psychological intervention.

[0143] (5) Output of dissuasion plan: The above configurations are integrated into a complete dissuasion plan, including dissuasion timing, dissuasion channels, dissuasion frequency, dissuasion text, implementing body, etc., and stored in the dissuasion plan library.

[0144] In this way, by integrating the allocation of dissuasion channels, the allocation of dissuasion frequency, the allocation of dissuasion personnel / robots, the timing of dissuasion, and the dissuasion text, a complete dissuasion plan can be obtained. Based on this dissuasion plan, the victim can be dissuaded in a precise, efficient, and personalized manner, thereby improving the success rate of dissuasion of abnormal events.

[0145] The early warning and dissuasion method provided in this application, by pre-setting multiple event sequence templates, after determining the event type of the abnormal event based on the early warning clue information corresponding to the abnormal event and the current behavioral characteristics of the victim of the abnormal event, can directly determine the stage information of the victim's current event development stage in the abnormal event based on the target event sequence template corresponding to the event type and the current behavioral characteristics of the victim of the abnormal event. Then, based on the target event sequence template corresponding to the event type and the stage information of the victim's current event development stage in the abnormal event, the most successful dissuasion opportunity can be determined and the dissuasion operation can be carried out. Ultimately, the goal of accurate early warning and dissuasion with "the right person, the right time, the right words, and the right method" is achieved, thereby improving the success rate of dissuasion for abnormal events.

[0146] In some embodiments, combined with Figure 2 ,like Figure 6 As shown, prior to step 202 above, the warning and dissuasion method provided in this application embodiment may further include the following step 205.

[0147] Step 205: Based on the event type of the abnormal event, the early warning and dissuasion device determines the target event time sequence template corresponding to the event type from the event time sequence template library.

[0148] The aforementioned event timeline template library includes at least one event timeline template. Each event timeline template corresponds to an event type and is generated based on historical event data and historical dissuasion data for the corresponding event type.

[0149] In this way, by determining the timeline template of the target event, the timeline information of the victim in different event types can be quickly identified, thereby enabling rapid dissuasion efforts and improving the efficiency of the dissuasion work.

[0150] In some embodiments, the process of constructing an event timing template will be described below.

[0151] For example, such as Figure 7 As shown, the early warning and dissuasion method provided in this application embodiment may further include the following steps 206 to 211.

[0152] Step 206: The early warning and dissuasion device acquires event data of at least one event of the first event type.

[0153] In some embodiments, the event data of the above-mentioned event includes: information on the victim of the event, event type data, event stage information, etc.

[0154] Step 207: The early warning and dissuasion device extracts the temporal behavioral feature sequence corresponding to each event.

[0155] In some embodiments, the temporal behavioral feature sequence corresponding to the above-mentioned events is used to characterize the behavioral features of the events in the crime process, ordered chronologically.

[0156] Step 208: The early warning and dissuasion device uses a time series clustering algorithm to cluster the temporal behavioral feature sequence corresponding to each event, and obtains the event time series information of the event corresponding to the first event type.

[0157] In some embodiments, the event timing information corresponding to the first event type includes stage information of each event development stage of the event corresponding to the first event type.

[0158] In some embodiments, the above clustering operation can be performed using a time series clustering algorithm (such as the K-Shape algorithm).

[0159] Step 209: The early warning and dissuasion device calculates the dissuasion effect parameters for each stage of the event's development based on the historical dissuasion data for each event.

[0160] In some embodiments, the calculation of the dissuasion effect parameters at each stage of event development can be performed using formulas 5 to 7 above. To avoid repetition, these will not be repeated here.

[0161] Step 210: Based on the above event sequence information and the dissuasion effect parameters of each event development stage, the early warning and dissuasion device generates an event sequence template corresponding to the first event type.

[0162] In some embodiments, the above-mentioned event sequence template is a structured template obtained by encoding parameters such as event sequence information obtained by clustering, dissuasion effect parameters of each event development stage, and sequence behavior feature sequences.

[0163] Step 211: The early warning and dissuasion device stores the event sequence template corresponding to the first event type into the event sequence template library.

[0164] In this way, by integrating the event sequence templates of different events to obtain the event sequence template library, it is possible to quickly find the event sequence templates of different event types, thereby quickly locking the timing information of the victim in different event types, quickly launching dissuasion work, and thus improving the efficiency of dissuasion work.

[0165] The warning and dissuasion method of this application will be described below through specific embodiments.

[0166] This application proposes a method, device, equipment, medium, and program product for early warning and dissuasion, which aims to achieve accurate, efficient, and personalized early warning and dissuasion through event type identification, event timing location, optimal timing selection, differentiated text generation, and dynamic channel configuration.

[0167] like Figure 8 As shown, Figure 8 The overall process of the early warning and dissuasion scheme according to an embodiment of this application is shown. The following will take the scenario of dissuading a victim in a fraud case as an example to explain each step in the overall process in detail.

[0168] S1. Early warning clue access and analysis;

[0169] The system receives alerts from multiple channels, analyzes and standardizes these alerts, and includes the following steps:

[0170] (1) Multi-source clue access: Access warning clues from multiple channels such as operators, Internet platforms, public security anti-fraud system, and public reports. The forms of clues include: fraudulent phone / SMS records, fraudulent website access records, fraudulent APP installation records, abnormal transfer warnings, and victim inquiries.

[0171] (2) Analysis of clue content: Analyze the clue content and extract key information fields, including the victim's basic information (mobile phone number, geographical location, etc.), fraud-related element information (fraudulent phone number, fraudulent website, fraudulent APP, fraudulent account, etc.), behavioral information (call duration, access frequency, transfer amount, etc.), and time information (first contact time, most recent contact time, etc.).

[0172] (3) Standardization of clues: Standardize clue information from different sources and in different formats into a unified data structure to form early warning clue records and store them in the early warning clue database.

[0173] S2. Case type identification and classification;

[0174] Identifying case types from early warning leads to determine the type of fraud the victim may be encountering involves the following steps:

[0175] (1) Extraction of fraud-related features: Extract fraud-related features from early warning clues, including the location of the fraud-related number, the type of the fraud-related number, the characteristics of the domain name of the fraud-related website, the type of the fraud-related APP, and the bank affiliation of the fraud-related account.

[0176] (2) Victim behavior characteristics extraction: Analyze the victim’s behavior characteristics in the warning clues, including communication behavior (e.g., incoming / outgoing calls, duration, frequency), network behavior (e.g., access duration, access depth, whether to download APP), and financial behavior (e.g., whether to transfer money, transfer amount, transfer frequency).

[0177] (3) Case type identification model: Input the characteristics of fraud elements and the characteristics of victim behavior into the case type identification model, and output the case type identification results.

[0178] For example, the case type identification model described above may employ a rule-based classifier (such as a decision tree) or a machine learning-based classifier (such as a random forest, XGBoost, deep neural network, etc.), and the training data for the case type identification model comes from samples of historically confirmed fraud cases of the same type.

[0179] (4) Parallel identification of multiple types: When there are multiple possible case types in the early warning clues, the confidence probability of each type is output, supporting parallel identification of multiple types and subsequent multi-strategy dissuasion.

[0180] S3, Timing Position Determination and Location;

[0181] Based on the identified case type and combined with victim behavior data, the victim's current stage in the chronology of the crime is determined. Specific steps include:

[0182] (1) Construction of the time-series template library: A time-series template library for different types of fraud is pre-built. The time-series templates are stored in a structured data format, and each template contains the following fields:

[0183] Template identification fields: Template ID, Case Type Name, Version Number.

[0184] Time series stage field group: stage number (T1, T2, ..., Tn), stage name identifier, stage feature vector dimension.

[0185] The time series parameter field group includes: stage start time threshold, stage end time threshold, and stage duration standard deviation.

[0186] Feature mapping field group: Mapping function parameters from behavioral features to stage numbers (represented by a weight matrix of multidimensional feature vectors).

[0187] Intervention decision parameter field group: optimal intervention timing identifier, predicted intervention effect value, and intervention difficulty coefficient.

[0188] Taking the "pig butchering scam" as an example, its time sequence template T is structured as follows:

[0189] T = {

[0190] "template_id": "TPL-001",

[0191] "case_type": "pig butchering scam",

[0192] "version": "1.0",

[0193] "stages": [

[0194] {

[0195] "stage_id": "T1",

[0196] "stage_name": "Establish Contact",

[0197] "feature_vector_dims": ["Add Friend", "First Message", "Social Platforms"],

[0198] "time_window": {"min": 0, "max": 3, "unit": "day"},

[0199] "feature_weights": [0.4, 0.35, 0.25],

[0200] "intervention_params": {

[0201] "optimal_timing": true,

[0202] "predicted_success_rate": 0.82,

[0203] "difficulty_coefficient": 0.3

[0204] }

[0205] },

[0206] {

[0207] "stage_id": "T2",

[0208] "stage_name": "Establish Trust",

[0209] "feature_vector_dims": ["chat frequency", "emotional vocabulary", "trust-building behaviors"],

[0210] "time_window": {"min": 3, "max": 14, "unit": "day"},

[0211] "feature_weights": [0.35, 0.40, 0.25],

[0212] "intervention_params": {

[0213] "optimal_timing": false,

[0214] "predicted_success_rate": 0.75,

[0215] "difficulty_coefficient": 0.5

[0216] }

[0217] },

[0218] ... / / Subsequent stages omitted ]

[0220] }

[0221] For example, the structured template is constructed as follows:

[0222] 1) Collect data on confirmed historical fraud cases and extract the temporal behavioral characteristic sequences of the cases;

[0223] 2) Use time series clustering algorithms (such as K-Shape algorithm) to automatically divide the case into time-series stages;

[0224] 3) Statistically analyze the typical characteristics and time window range of each stage;

[0225] 4) Calculate intervention effect parameters for each stage based on historical dissuasion data;

[0226] 5) Encode the above parameters into a structured template and store it in the template library.

[0227] (2) Temporal feature vector encoding: The victim's current behavioral features are encoded into a feature vector V_user = (v1,v2, ..., vm), where m is the number of feature dimensions.

[0228] For example, the above behavioral characteristics include: communication behavior characteristics, network behavior characteristics, financial behavior characteristics, and time characteristics. It should be noted that each feature value can be normalized: vi = normalize(raw_feature_i).

[0229] (3) Temporal Feature Matching: Calculate the similarity between the victim's feature vector and the feature templates of each stage. The cosine similarity method is used for calculation.

[0230] Sim(V_user, Tj) = (V_user · W_j) / (||V_user|| × ||W_j||)

[0231] Where Tj is the template for the j-th stage, and W_j is the feature weight vector for the j-th stage. A time window matching factor is also introduced.

[0232] Time_match(t, Tj) = exp(-|t - μ_tj|^2 / (2 × σ_tj^2))

[0233] Where t is the time span from the first contact with the victim to the present, and μ_tj and σ_tj are the mean and standard deviation of the time window in the j-th stage.

[0234] (4) Temporal position determination: Calculate the overall matching degree for each stage by combining feature similarity and temporal matching factor.

[0235] Match_score(Tj) = α × Sim(V_user, Tj) + β × Time_match(t, Tj)

[0236] Where α and β are weighting coefficients (α=0.7, β=0.3). The stage with the highest overall matching degree is selected as the victim's current temporal location determination result:

[0237] Stage_current = argmax(Match_score(Tj)), j ∈ {1, 2, ..., n}

[0238] (5) Remaining window estimation: Calculate the remaining dissuasion time window based on the time window parameters of the determination location:

[0239] T_remaining = Time_window_max(Stage_next) - t_current

[0240] Where Time_window_max(Stage_next) is the upper bound of the time window for the next stage, and t_current is the current time span.

[0241] S4. Choosing the optimal time to dissuade someone;

[0242] Based on the time-series location determination results, and combined with historical data on the dissuasion effectiveness of case types, the optimal dissuasion timing is selected. Specific steps include:

[0243] (1) Historical analysis of the dissuasion effect: Analyze historical dissuasion data, and statistically analyze indicators such as the success rate, average response time, and victim cooperation of dissuasion in different time stages for different case types, and construct a matrix of "case type-time stage-dissuasion effect".

[0244] (2) Optimal timing calculation: Construct an optimal timing scoring function to quantitatively evaluate whether the current time is the optimal time for dissuasion:

[0245] Score_timing = α × P_success(stage) + β × T_normalized - γ × D_next + δ × U_urgency

[0246] Wherein, P_success(stage): the historical dissuasion success rate of the current time series stage, obtained from the historical dissuasion effect database. T_normalized: the normalized remaining time window, T_normalized = T_remaining / T_window_max, where T_remaining is the remaining window time and T_window_max is the standard time window of the current stage. D_next: the dissuasion difficulty coefficient for the next stage (value range 0-1, the larger the value, the higher the difficulty), obtained from the intervention_params of the time series template. U_urgency: the urgency factor, which takes a value of 1 if there is an urgent behavior (such as transferring money, downloading a fraudulent APP, or talking to a fraudulent party), otherwise takes a value of 0. α, β, γ, and δ are weighting coefficients, determined by fitting historical data (α=0.35, β=0.25, γ=0.20, δ=0.20).

[0247] For example, when Score_timing ≥ 0.6, the current time is determined to be the optimal time, and "immediately dissuade" is output; when Score_timing ∈ [0.4, 0.6) and there is a better future time, "dissuade at an appropriate time" is output; otherwise, "continuous monitoring" is output.

[0248] (3) Timing type output: Output the optimal timing type for dissuasion, including:

[0249] Immediate dissuasion: If the current situation is the best time or an emergency, dissuasion should be initiated immediately.

[0250] Dissuade when the opportunity arises: If a better future opportunity exists, set a reminder and wait for that opportunity.

[0251] Continuous monitoring: The current dissuasion efforts are ineffective, and continuous monitoring is needed while waiting for the next stage.

[0252] Multiple dissuasions: It is necessary to dissuade someone multiple times at several key points.

[0253] Timing weight calculation: For scenarios involving multiple dissuasions, calculate the weight of each dissuasion to provide a basis for subsequent resource allocation.

[0254] S5. Generation and configuration of dissuasion schemes;

[0255] It should be noted that the relevant description of step 204 can be referred to above, and will not be repeated here to avoid repetition.

[0256] S6. Implementation of dissuasion and evaluation of its effectiveness;

[0257] For example, a dissuasion plan is implemented, and the effectiveness of the dissuasion is evaluated and feedback is provided after the plan is implemented.

[0258] For example, the specific steps of the above-mentioned dissuasion implementation and effectiveness evaluation process include:

[0259] (1) Execution of dissuasion: Execute dissuasion through the configured channels according to the generated dissuasion plan. Furthermore, dissuasion logs can be recorded during the execution process, including connection status, call duration, victim response, and commitment behavior.

[0260] (2) Effectiveness evaluation: After implementing the dissuasion plan, the effectiveness of the dissuasion is evaluated. The evaluation dimensions include the immediate effect of whether the victim promises to stop the relevant behavior, the short-term effect of whether there are any abnormal behaviors (continued transfers, continued contact with the fraudulent party), and the final effect of whether property loss is successfully avoided.

[0261] (3) Effect attribution: Analyze the reasons for the success or failure of dissuasion. The attribution dimensions include case type, time sequence, timing of dissuasion, text content, dissuasion channel, frequency of dissuasion, and victim characteristics.

[0262] (4) Strategy iteration: Feedback the data on the dissuasion effect and the results of the attribution analysis to the model for iterative optimization of the case type identification model, the data on the dissuasion effect in the time-series template library, the algorithm for optimizing the timing of dissuasion, the content of the text template library, and the rules for channel and frequency configuration.

[0263] (5) Early warning escalation: For high-risk cases where dissuasion fails, an early warning escalation mechanism is triggered, such as escalating to door-to-door dissuasion, joint intervention with public security organs, and emergency payment suspension.

[0264] (6) Effect verification experiment.

[0265] For example, an experimental group and a control group were set up, wherein the experimental group used the dissuasion method provided in this application, and the control group used the traditional dissuasion method. The sample size for each group was 2000 warning cues. The experimental results are shown in Table 1.

[0266]

[0267] Table 1

[0268] Experimental results show that, compared with traditional methods, the dissuasion method provided in this application has a 23 percentage point higher success rate, a more than 16 percentage point higher victim cooperation rate, and an 8.3 percentage point lower rate of false disturbance, verifying the technical effectiveness of differentiated dissuasion based on case type and time stage.

[0269] It should be noted that the core technical points and protected content of this application mainly focus on the following aspects:

[0270] 1) Structured Temporal Template Library and Automated Construction Method for Fraud Cases: This application proposes for the first time the construction of a structured temporal template library for different types of fraud. Each template adopts a structured data representation, supporting automated stage division based on time series clustering algorithms and parameter fitting based on historical data, providing a data foundation for temporal location determination and differentiated dissuasion. The data organization structure and automated construction method of this structured template library are innovative.

[0271] 2) Victim Stage Location Method Based on Temporal Features: This application proposes encoding victim behavioral characteristics into feature vectors and using a comprehensive matching algorithm combining cosine similarity calculation and time window matching factors to accurately determine the victim's current stage in the crime process and estimate the remaining dissuasion time window. This method uses a computable mathematical model to replace manual experience judgment, solving the problem that existing technologies cannot locate the crime stage.

[0272] 3) Optimal Dissuasion Timing Selection Method Based on Time-Series Scoring Function: This application proposes an optimal timing scoring function (Score_timing = α×P_success + β×T_normalized - γ×D_next + δ×U_urgency) that comprehensively considers factors such as historical success rate, remaining window, difficulty changes, and urgency to quantitatively calculate the optimal dissuasion timing. This scoring function provides a calculable basis for timing selection, solving the problem of the lack of scientific basis in existing dissuasion timing selection techniques.

[0273] 4) A dual-dimensional text generation and personalized configuration method based on case type and time sequence: This application proposes a text generation rule base organized according to case type and time sequence, and adopts a slot-filling-based template generation method to produce personalized dissuasion texts. The text generation process incorporates victim characteristics for dynamic slot filling, ensuring that the text content accurately matches the fraudulent operation logic, thereby improving the targeting of the text and the success rate of dissuasion.

[0274] 5) Dynamic channel frequency configuration and closed-loop effect iteration mechanism: This application proposes to dynamically configure the dissuasion channels and frequencies according to the case type, time sequence, and victim characteristics, and to establish a closed-loop mechanism for dissuasion effect evaluation and strategy iteration to achieve continuous optimization of dissuasion strategies.

[0275] It should be noted that the above-described method embodiments, or the various possible implementations of the method embodiments, can be executed individually, or, provided there is no conflict, they can be combined with each other. The specific implementation can be determined according to actual usage requirements, and this application embodiment does not impose any restrictions on this.

[0276] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0277] This application embodiment can divide the early warning and dissuasion device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0278] In some embodiments, this application also provides an early warning and dissuasion device. This device may include one or more functional modules for implementing the early warning and dissuasion methods described in the above embodiments.

[0279] For example, Figure 10 This is a schematic diagram of a warning and dissuasion device provided in an embodiment of this application. Figure 10 As shown, the early warning and dissuasion device 900 includes: a determination module 1001 and an execution module 1002.

[0280] The aforementioned determining module 1001 is used to determine the event type of the aforementioned abnormal event based on the early warning clue information corresponding to the abnormal event and the current behavioral characteristic information of the victim of the aforementioned abnormal event.

[0281] The aforementioned determining module 1001 is further configured to determine the stage information of the current event development stage of the aforementioned abnormal event based on the target event time sequence template corresponding to the event type of the aforementioned abnormal event and the current behavioral characteristic information of the victim of the aforementioned abnormal event; the aforementioned target event time sequence template includes the event time sequence information corresponding to the aforementioned event type, as well as the dissuasion effect parameters of each event development stage in the aforementioned event time sequence.

[0282] The aforementioned determining module 1001 is also used to determine the timing of target dissuasion based on the aforementioned target event timeline template and the stage information of the current stage of event development of the aforementioned victim in the aforementioned abnormal event.

[0283] The execution module 1002 is used to perform a dissuasion operation based on the above-mentioned event type, the above-mentioned event sequence information, the stage information of the current event development stage of the above-mentioned victim in the above-mentioned abnormal event, and the above-mentioned target dissuasion timing.

[0284] The early warning and dissuasion device provided in this application, by pre-setting multiple event sequence templates, after determining the event type of the abnormal event based on the early warning clue information corresponding to the abnormal event and the current behavioral characteristics of the victim of the abnormal event, can directly determine the stage information of the victim's current event development stage in the abnormal event based on the target event sequence template corresponding to the event type and the current behavioral characteristics of the victim of the abnormal event. Then, based on the target event sequence template corresponding to the event type and the stage information of the victim's current event development stage in the abnormal event, it can determine the dissuasion time with the highest success rate and execute the dissuasion operation, ultimately achieving the goal of accurate early warning and dissuasion with "the right person, the right time, the right words, and the right method", thereby improving the success rate of dissuasion of abnormal events.

[0285] In some embodiments, the determining module 1001 is specifically used to: determine the dissuasion effect parameter corresponding to the current stage of the event development of the victim in the abnormal event based on the target event timeline template and the stage information of the current stage of event development of the victim in the abnormal event; the dissuasion effect parameter includes the historical dissuasion success rate corresponding to the current stage of event development of the victim in the abnormal event, and the dissuasion difficulty coefficient corresponding to the next stage of event development of the event development stage; and determine the target dissuasion timing based on the dissuasion effect parameter.

[0286] In some embodiments, the determining module 1001 is specifically used to: calculate the persuasion assessment value of the current stage of event development of the victim in the abnormal event based on the persuasion effect parameters; and determine the target persuasion timing based on the persuasion assessment value.

[0287] In some embodiments, the execution module 1002 is specifically used to: generate a dissuasion plan based on the event type and the stage information of the victim's current stage of event development in the abnormal event, the dissuasion plan including dissuasion timing, dissuasion channels, dissuasion frequency, dissuasion text, and dissuasion execution subject; and execute corresponding dissuasion operations based on the dissuasion plan.

[0288] In some embodiments, the determining module 1001 is further configured to: determine a target event time sequence template corresponding to the event type from the event time sequence template library based on the event type of the abnormal event; wherein the event time sequence template library includes at least one event time sequence template, each event time sequence template corresponds to an event type, and each event time sequence template is generated based on historical event data and historical dissuasion data of the corresponding event type.

[0289] In some embodiments, the aforementioned warning and dissuasion device further includes: an acquisition module, configured to acquire event data of at least one event of a first event type; an extraction module, configured to extract a temporal behavioral feature sequence corresponding to each event; a clustering module, configured to cluster the temporal behavioral feature sequence corresponding to each event using a time series clustering algorithm to obtain event time series information of the event corresponding to the first event type; the event time series information includes stage information of each event development stage of the event corresponding to the first event type; a calculation module, configured to calculate the dissuasion effect parameters of each event development stage based on the historical dissuasion data of each event; a generation module, configured to generate an event time series template corresponding to the first event type based on the event time series information and the dissuasion effect parameters of each event development stage; and a storage module, configured to store the event time series template corresponding to the first event type in the event time series template library.

[0290] It should be noted that the warning and dissuasion device can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0291] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 11 As shown, the electronic device 110 includes: a processor 112, a communication interface 113, and a bus 114. Optionally, the electronic device 110 may also include a memory 111.

[0292] Processor 112 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 112 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 112 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0293] Communication interface 113 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0294] The memory 111 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0295] As one possible implementation, the memory 111 can exist independently of the processor 112. The memory 111 can be connected to the processor 112 via a bus 114 and is used to store instructions or program code. When the processor 112 calls and executes the instructions or program code stored in the memory 111, it can implement the warning and dissuasion method provided in the embodiments of this application.

[0296] In another possible implementation, the memory 111 can also be integrated with the processor 112.

[0297] Bus 114 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 114 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 11 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0298] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0299] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described warning and dissuasion method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0300] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0301] This application also provides a readable storage medium storing a program or instructions. When executed by a computer, the program or instructions implement the warning and dissuasion method provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The readable storage medium can be any of the foregoing embodiments or memory. The readable storage medium can also be an external storage device of the service invocation device, such as a plug-in hard drive, Smart MediaCard (SMC), Secure Digital (SD) card, flash card, etc., equipped on the service invocation device. Further, the readable storage medium can include both internal storage units of the service invocation device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the service invocation device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0302] This application also provides a computer program product, which is stored in a storage medium and implements the warning and dissuasion method provided in the above embodiments when the computer program product is executed by a computer.

[0303] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0304] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0305] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for early warning and dissuasion, characterized in that, The aforementioned warning and dissuasion methods include: Based on the early warning clues corresponding to the abnormal event and the current behavioral characteristics of the victim of the abnormal event, the event type of the abnormal event is determined. Based on the target event timeline template corresponding to the event type of the abnormal event and the current behavioral characteristic information of the victim of the abnormal event, the stage information of the current event development stage of the victim in the abnormal event is determined; the target action timeline template includes the event timeline information corresponding to the event type, as well as the dissuasion effect parameters of each event development stage in the event timeline. Based on the target event timeline template and the stage information of the victim's current stage of event development in the abnormal event, the timing of the target dissuasion is determined. Based on the event type, the event sequence information, the stage information of the victim's current stage of event development in the abnormal event, and the target dissuasion timing, a dissuasion operation is performed.

2. The early warning and dissuasion method according to claim 1, characterized in that, The determination of the timing of targeted dissuasion based on the target event timeline template and the stage information of the victim's current stage of event development in the abnormal event includes: Based on the target event timeline template and the stage information of the current event development stage of the victim in the abnormal event, the dissuasion effect parameter corresponding to the current event development stage of the victim in the abnormal event is determined; the dissuasion effect parameter includes the historical dissuasion success rate corresponding to the current event development stage of the victim in the abnormal event, and the dissuasion difficulty coefficient corresponding to the next event development stage of the event development stage. Based on the aforementioned dissuasion effectiveness parameters, the timing for dissuasion is determined.

3. The early warning and dissuasion method according to claim 2, characterized in that, Determining the target dissuasion timing based on the dissuasion effect parameters includes: Based on the dissuasion effect parameters, calculate the dissuasion assessment value for the current stage of event development in the abnormal event that the victim is currently in. Based on the aforementioned dissuasion assessment value, the timing for the target dissuasion is determined.

4. The early warning and dissuasion method according to claim 1, characterized in that, The dissuasion operation, based on the event type, the event sequence information, the stage information of the victim's current stage of event development in the abnormal event, and the target dissuasion timing, includes: Based on the event type and the stage information of the victim's current stage of event development in the abnormal event, a dissuasion plan is generated. The dissuasion plan includes the timing of dissuasion, the channels for dissuasion, the frequency of dissuasion, the dissuasion text, and the subject responsible for carrying out the dissuasion. Based on the aforementioned dissuasion plan, the corresponding dissuasion operation is performed.

5. The warning and dissuasion method according to any one of claims 1 to 4, characterized in that, Before the target event timeline template corresponding to the event type of the abnormal event and the current behavioral characteristic information of the victim of the abnormal event, the early warning and dissuasion method further includes: Based on the event type of the abnormal event, a target event time sequence template corresponding to the event type is determined from the event time sequence template library; The event timeline template library includes at least one event timeline template, each event timeline template corresponds to an event type, and each event timeline template is generated based on historical event data and historical dissuasion data of the corresponding event type.

6. The early warning and dissuasion method according to claim 5, characterized in that, The aforementioned warning and dissuasion methods also include: Retrieve event data for at least one event of the first event type; Extract the temporal behavioral feature sequence corresponding to each event; A time series clustering algorithm is used to cluster the temporal behavioral feature sequences corresponding to each event to obtain the event time series information of the events corresponding to the first event type; the event time series information includes the stage information of each event development stage of the events corresponding to the first event type. Based on the historical dissuasion data for each event, calculate the dissuasion effect parameters for each stage of the event's development; Based on the event sequence information and the dissuasion effect parameters of each event development stage, an event sequence template corresponding to the first event type is generated; Store the event sequence template corresponding to the first event type into the event sequence template library.

7. A warning and dissuasion device, characterized in that, The warning and dissuasion device includes: The determination module is used to determine the event type of the abnormal event based on the early warning clue information corresponding to the abnormal event and the current behavioral characteristics information of the victim of the abnormal event. The determining module is further configured to determine the stage information of the current event development stage of the victim in the abnormal event based on the target event time sequence template corresponding to the event type of the abnormal event and the current behavioral characteristic information of the victim of the abnormal event; the target event time sequence template includes the event time sequence information corresponding to the event type, and the dissuasion effect parameters of each event development stage in the event time sequence. The determining module is also used to determine the timing of the target dissuasion based on the target event timeline template and the stage information of the current stage of event development of the victim in the abnormal event. The execution module is used to perform a dissuasion operation based on the event type, the event timing information, the stage information of the victim's current stage of event development in the abnormal event, and the target dissuasion timing.

8. The early warning and dissuasion device according to claim 7, characterized in that, The determining module is specifically used for: Based on the target event timeline template and the stage information of the current event development stage of the victim in the abnormal event, the dissuasion effect parameter corresponding to the current event development stage of the victim in the abnormal event is determined; the dissuasion effect parameter includes the historical dissuasion success rate corresponding to the current event development stage of the victim in the abnormal event, and the dissuasion difficulty coefficient corresponding to the next event development stage of the event development stage. Based on the aforementioned dissuasion effectiveness parameters, the timing for dissuasion is determined.

9. The early warning and dissuasion device according to claim 8, characterized in that, The determining module is specifically used for: Based on the dissuasion effect parameters, calculate the dissuasion assessment value for the current stage of event development in the abnormal event that the victim is currently in. Based on the aforementioned dissuasion assessment value, the timing for the target dissuasion is determined.

10. The early warning and dissuasion device according to claim 7, characterized in that, The execution module is specifically used for: Based on the event type and the stage information of the victim's current stage of event development in the abnormal event, a dissuasion plan is generated. The dissuasion plan includes the timing of dissuasion, the channels for dissuasion, the frequency of dissuasion, the dissuasion text, and the subject responsible for carrying out the dissuasion. Based on the aforementioned dissuasion plan, the corresponding dissuasion operation is performed.

11. The warning and dissuasion device according to any one of claims 7 to 10, characterized in that, The determining module is further configured to: Based on the event type of the abnormal event, a target event time sequence template corresponding to the event type is determined from the event time sequence template library; The event timeline template library includes at least one event timeline template, each event timeline template corresponds to an event type, and each event timeline template is generated based on historical event data and historical dissuasion data of the corresponding event type.

12. The early warning and dissuasion device according to claim 11, characterized in that, The warning and dissuasion device also includes: The acquisition module is used to acquire event data for at least one event of the first event type; The extraction module is used to extract the temporal behavioral feature sequence corresponding to each event; The clustering module is used to cluster the temporal behavioral feature sequences corresponding to each event using a time series clustering algorithm to obtain the event time series information of the event corresponding to the first event type; the event time series information includes the stage information of each event development stage of the event corresponding to the first event type. The calculation module is used to calculate the dissuasion effect parameters for each stage of the event based on the historical dissuasion data for each event. The generation module is used to generate an event sequence template corresponding to the first event type based on the event sequence information and the dissuasion effect parameters of each event development stage. The storage module is used to store the event timing template corresponding to the first event type into the event timing template library.

13. An electronic device, characterized in that, It includes a processor and a memory, the memory storing programs or instructions that can run on the processor, the programs or instructions being executed by the processor to implement the warning and dissuasion method as described in any one of claims 1-6.

14. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions, which, when executed by a computer, implement the warning and dissuasion method as described in any one of claims 1-6.

15. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when executed by a computer, the computer program product implements the warning and dissuasion method as described in any one of claims 1-6.

Images