A risk identification system based on multi-dimensional data verification

Abstract

The application discloses a risk identification system based on multi-dimensional data verification and relates to the technical field of communication monitoring. The system comprises data acquisition and verification, communication features of a calling number in a historical time period in user communication are acquired, power data of a called user are acquired for cross verification, and verification data sets are obtained; a model is established, a neural network model is constructed by taking historical fraud data as a training sample for training, and a fraud identification model is obtained. Through the setting of cross verification, the application not only depends on single communication features, but also introduces user power data for cross verification, effectively distinguishes normal service reminders from fraud behaviors, simultaneously identifies abnormalities from multiple angles through at least four verification rules such as regional consistency, communication behavior and power state, short message features and flow features, solves the problem of lagging identification response, and dynamically calculates a risk threshold based on a user historical behavior portrait, thereby reducing the probability of false positives and disturbing people.

Description

Technical Field

[0001] This invention relates to the field of communication monitoring technology, specifically a risk identification system based on multidimensional data verification. Background Technology

[0002] With the increasing digitalization of communication technology and power services, power-related fraud using communication channels such as telephone and SMS is on the rise. As telecommunications fraud methods become more diverse and sophisticated, various emerging fraudulent tactics are difficult to guard against. Traditional risk identification methods often rely on single-dimensional communication data (such as matching caller ID blacklists and analyzing call frequency), which is insufficient to effectively counter fraudsters' evasion techniques such as number spoofing and call pattern mutations. This results in insufficient accuracy and coverage of risk identification, leading to a high risk of financial loss for users.

[0003] For example, the vehicle loan fraud risk warning method and system disclosed in patent publication number CN117132392A includes: obtaining the caller ID in a vehicle loan call; obtaining multi-dimensional communication characteristics of the caller ID within a historical time period; using the multi-dimensional communication characteristics as input to a neural network model to obtain a fraud risk identification result for the vehicle loan call; if the fraud risk identification result indicates suspected fraud risk, converting the vehicle loan call into text to obtain the call text; identifying whether there are sensitive words related to personal privacy information in the call text; if there are sensitive words related to personal privacy information in the call text, using semantic recognition to identify whether there are query statements related to the sensitive words in the call text; if there are query statements related to the sensitive words, alerting the called user to the risk of vehicle loan fraud. This method can relatively accurately identify vehicle loan fraud risks and provide early warnings.

[0004] However, existing risk identification systems rely heavily on general blacklists for matching and interception, and can only identify whether a link domain is on the blacklist. They cannot cross-verify based on the user's actual situation, resulting in a large number of fraudulent messages being marked only after being reported by the user, leading to a delayed identification response. Therefore, we propose a more convenient and practical electricity bill fraud identification, early warning, and communication monitoring system to address this issue. Summary of the Invention

[0005] The purpose of this invention is to provide a risk identification system based on multidimensional data verification to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a risk identification system based on multidimensional data verification, comprising a data acquisition and verification module, a fraud identification module, and a fraud early warning module.

[0007] Data acquisition and verification: acquire the communication characteristics of the caller's number in the user's call within a historical time period, and simultaneously acquire the power data of the called user for cross-validation to obtain a verification dataset;

[0008] A model is built by training a neural network model using historical fraud data as training samples, thus obtaining a fraud detection model.

[0009] Fraud detection is based on a verification dataset. The verification dataset is input into the fraud detection model for fusion calculation, and the output is risk level data.

[0010] Fraud alerts are sent to users via communication, based on risk level data.

[0011] The communication features include geographical features of communication data, call features, SMS frequency features, and data traffic features, and are cross-validated with user power data. Cross-validation involves executing at least two validation rules, which include:

[0012] The first verification rule, the regional consistency verification, compares the location information of the caller's communication base station with the coverage area of ​​the base station of the user's electricity address, and at the same time compares it with other related numbers that share the same communication base station and the same IP exit, to obtain regional anomaly verification data;

[0013] The second verification rule, call behavior and power consumption status verification, obtains the call frequency characteristics, average call duration characteristics and call time distribution characteristics of the calling number within a unit of time, and compares them with the user's power data to obtain the abnormal overdue payment characteristic data.

[0014] Furthermore, the verification rules for cross-validation execution also include:

[0015] The third verification rule is SMS feature verification, which obtains the SMS sending frequency characteristics associated with the calling number and the number of historical calls and SMS interactions with the called user within a preset time window to obtain abnormal interaction data.

[0016] The fourth verification rule is traffic feature verification, which obtains the daily active duration characteristics and internet behavior data of the called user to obtain abnormal traffic access data.

[0017] Furthermore, the model building process includes the following steps:

[0018] A1. Sample construction: Collect communication record data and corresponding electricity user data from historical electricity bill fraud cases to form a fraud sample set. Label and classify the fraud sample set according to the type of fraud method to obtain a multi-label training sample set.

[0019] A2. Feature processing: Based on the multi-label training sample set, feature extraction and processing are performed on the communication features and power data in the multi-label training sample set to obtain feature data;

[0020] A3. Model Construction: Based on feature data, construct a heterogeneous feature separation and fusion neural network model.

[0021] The neural network model includes:

[0022] The first feature extraction branch performs time-series pattern extraction on communication features and SMS frequency features, and outputs a time-series feature vector.

[0023] The second feature extraction branch models the spatial relationship between the geographical features of communication data and the base station coverage area of ​​the user's electricity address, and obtains a spatial correlation feature vector.

[0024] The third feature extraction branch encodes the power data feature vector to obtain the power state feature vector;

[0025] The feature fusion unit fuses time-series feature vectors, spatial correlation feature vectors, and power state feature vectors to obtain a fused feature vector;

[0026] A4. Model training: Based on the fused feature vector, Ffusion is used to train the neural network model to obtain the original fraud detection model. The calculation formula for the fused feature vector Ffusion is as follows: Where ReLU is the activation function, Vtemporal is the temporal feature vector, Vspatial is the spatial correlation feature vector, Vpower is the power state feature vector, [.;.] is the vector concatenation operation, Wf is the weight matrix of the fusion layer, and bf is the bias vector of the fusion layer.

[0027] A5. Model update: Based on the original fraud identification model, user response behavior data to warning information is obtained as new positive samples and added to the fraud sample set. The data is then sent back to the fraud identification model for update, and the original risk level is output at the same time.

[0028] A6. Dynamic threshold adjustment: Obtain the power data and communication characteristics of the called user, generate a user baseline behavior profile, and calculate the deviation between the original risk level and the user baseline behavior profile to obtain the first threshold and the second threshold. Calculate the reliability score of the threshold through the calculation method and classify it to obtain the risk level.

[0029] Furthermore, the sample construction includes:

[0030] S1. Obtain communication characteristics and corresponding electricity user data from historical electricity bill fraud cases to construct an original fraud sample library;

[0031] S2. Compare and label the caller IDs in the original fraud sample database with the official service number database of the power company and the known fraud number blacklist database to form a positive sample set and a negative sample set.

[0032] S3. Based on the type of fraud method, the positive samples are subdivided into three categories: impersonating customer service, fake links, and fake overdue payments. The corresponding communication features and power status data are associated with each type of sample to obtain a multi-label training sample set.

[0033] Furthermore, the user baseline behavior profile includes: the user's historical average monthly electricity consumption and payment cycle deviation characteristics, the user's historical call frequency and average call duration with the power company's official number, and the user's response rate and hang-up rate when answering unknown numbers at different times.

[0034] Furthermore, the risk levels are categorized based on credibility scores, specifically as follows:

[0035] If the credibility score is below the first threshold, it is judged as low risk;

[0036] If the credibility score is greater than or equal to the first threshold and less than the second threshold, it is judged as medium risk;

[0037] If the credibility score is greater than or equal to the second threshold, it is judged as high risk;

[0038] The credibility score is calculated as follows:

[0039] Based on the fused feature vector Ffusion, a non-linear mapping is performed through a fully connected layer, and the calculation formula is as follows:

[0040] Where S is the output confidence score, Softmax is the activation function, Wo is the output layer weight matrix, and bo is the output layer bias vector.

[0041] Furthermore, the response behavior data includes whether the caller ID was accessed through official channels for verification and whether the caller ID was reported to the anti-fraud platform. The caller ID number and its associated communication characteristics and power data are added as new positive samples to the fraud sample set. The parameters of the original fraud identification model are then fine-tuned to complete the model update.

[0042] Furthermore, the fraud detection model outputs risk levels including low risk, medium risk, and high risk, and sends warnings to users via communication, including:

[0043] Low risk: Record the caller's activity in the backend log and send an SMS alert to the user;

[0044] For medium-risk cases, a warning notification will be pushed through the official power company app, prompting users to verify the other party's identity and pay through official channels;

[0045] High risk, forced push of flash message, playing anti-fraud warning voice, the operator blocks the call in real time, and at the same time uploads the caller number and related characteristics to the power anti-fraud collaborative database.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] This risk identification system based on multi-dimensional data verification, through cross-validation settings, not only relies on a single communication feature but also introduces user data for cross-validation, effectively distinguishing between normal service reminders and fraudulent behavior. At the same time, through at least four verification rules, including regional consistency, call behavior and power consumption status, SMS characteristics, and data traffic characteristics, it identifies anomalies from multiple perspectives, solving the problem of delayed identification response. It is highly practical and suitable for promotion.

[0048] At the same time, risk thresholds are dynamically calculated based on users' historical behavior profiles, thereby reducing the probability of false alarms and disturbances. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the overall process of the present invention;

[0050] Figure 2 This is a schematic diagram of the cross-validation process of the present invention;

[0051] Figure 3 This is a schematic diagram illustrating the working principle of the fraud detection model of the present invention;

[0052] Figure 4 This is a schematic diagram illustrating the overall working principle of the present invention;

[0053] Figure 5 This is a schematic diagram illustrating the principle of credibility of the present invention. Detailed Implementation

[0054] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] like Figure 1As shown, this invention provides a technical solution: a risk identification system based on multi-dimensional data verification, comprising a data acquisition and verification module, a fraud identification module, and a fraud warning module. Its features include: data acquisition and verification, acquiring communication characteristics of the caller ID number during a user's call within a historical time period, and simultaneously acquiring the called user's power data for cross-verification to obtain a verification dataset; model building, using historical fraud data as training samples to construct a neural network model to obtain a fraud identification model; fraud identification, based on the verification dataset, inputting the verification dataset into the fraud identification model for fusion calculation, and outputting risk level data; fraud warning, based on the risk level data, issuing warnings to users via communication outreach; and communication... The features include geographical characteristics of communication data, call characteristics, SMS frequency characteristics, and data traffic characteristics, which are cross-validated with user power data. Cross-validation involves executing at least two verification rules: First, geographical consistency verification, comparing the caller's base station location information with the base station coverage area of ​​the user's power address, and simultaneously comparing it with other associated numbers sharing the same base station and IP address to obtain geographical anomaly verification data; Second, call behavior and power consumption status verification, obtaining the caller's call frequency characteristics, average call duration characteristics, and call time distribution characteristics within a unit of time, and comparing them with the user's power data to obtain overdue payment anomaly characteristic data. The cross-validation also includes: Third, SMS feature verification, obtaining the SMS sending frequency characteristics associated with the caller's number and the historical number of calls and SMS interaction frequency with the called user within a preset time window to obtain interaction anomaly data; Fourth, data traffic feature verification, obtaining the called user's daily active duration characteristics and internet behavior data to obtain data traffic anomaly access data.

[0056] It is important to note that the caller ID's communication data, including geographical characteristics, call characteristics, SMS frequency characteristics, and traffic characteristics, is obtained in real time from the operator's signaling gateway. Simultaneously, electricity data such as the called user's electricity address, historical electricity consumption, and payment records are retrieved from the electricity marketing system database. The first verification rule spatially overlays and compares the caller ID's base station location information with the base station coverage area of ​​the user's electricity address. If the caller ID's base station location deviates from the user's electricity address's base station coverage area for three consecutive time windows, and a known fraudulent number exists among the associated numbers sharing the same base station and IP exit, then regional anomaly verification data is generated and marked as a high-risk clue. The second verification rule obtains the caller ID's call frequency within a unit of time... The average call duration and call time distribution are aligned with the overdue payment time and payment cycle offset in the user's electricity data. If the calling number is found to be making frequent calls within 24 hours after the user's overdue payment and the call duration is concentrated between 30 and 90 seconds, it is judged as an abnormal overdue payment characteristic data. The third verification rule analyzes the SMS sending frequency of the calling number and the number of historical calls and SMS interactions with the called user within a 48-hour time window, and outputs abnormal interaction data. The fourth verification rule obtains the daily active duration characteristics and internet behavior data of the called user. If it is detected that the user accessed a non-official payment page or a counterfeit site with an edit distance of less than or equal to 2 from the official website within 30 minutes after being called, it is marked as abnormal traffic access data.

[0057] The model establishment includes the following steps: Sample construction: Collect communication record data and corresponding electricity user data from historical electricity fraud cases to form a fraud sample set. Classify the fraud sample set according to the type of fraud method to obtain a multi-label training sample set; Feature processing: Based on the multi-label training sample set, extract and process the communication features and electricity data in the multi-label training sample set to obtain feature data; Model construction: Based on the feature data, construct a heterogeneous feature separation and fusion neural network model. The neural network model includes: a first feature extraction branch, which extracts time-series patterns from communication features and SMS frequency features, outputting a time-series feature vector; a second feature extraction branch, which models the spatial relationship between the geographical features of communication data and the base station coverage area of ​​the user's electricity address, obtaining a spatial correlation feature vector; a third feature extraction branch, which encodes the electricity data feature vector to obtain an electricity status feature vector; Feature fusion unit, which fuses the time-series feature vector, spatial correlation feature vector, and electricity status feature vector to obtain a fused feature vector; Model training: Based on the fused feature vector (Ffusion), train the neural network model to obtain the original fraud identification model. The calculation formula for the fused feature vector Ffusion is: Where ReLU is the activation function, Vtemporal is the temporal feature vector, Vspatial is the spatial correlation feature vector, Vpower is the power state feature vector, [.;.] is the vector concatenation operation, Wf is the fusion layer weight matrix, and bf is the fusion layer bias vector; Model update: Based on the original fraud detection model, user response behavior data to warning information is acquired as new positive samples and added to the fraud sample set, which is then fed back to the fraud detection model for update, while outputting the original risk level; Dynamic threshold adjustment: The power data and communication characteristics of the called user are acquired to generate a user baseline behavior profile, and the deviation between the original risk level and the user baseline behavior profile is calculated to obtain the first threshold and the second threshold. The credibility score of the threshold is calculated using a calculation method, and the risk level is obtained by classification. Sample construction includes: acquiring communication characteristics and corresponding user data of electricity users from historical electricity bill fraud cases to construct an original fraud sample library; comparing and labeling the caller ID numbers in the original fraud sample library with the official service number library of the power company and the blacklist of known fraud numbers to form positive and negative sample sets; based on the type of fraud method, the positive samples are further subdivided into three categories: impersonating customer service, fake links, and forging overdue payments, and each category is associated with corresponding communication characteristics and electricity status data to obtain a multi-label training sample set; user baseline behavior profiles include: the user's historical average monthly electricity consumption and payment cycle deviation characteristics, the user's historical call frequency and average call duration with the official number of the power company, and the statistical characteristics of the user's response rate and hang-up rate when answering unknown numbers at different times. Risk levels are divided based on credibility scores, specifically as follows:

[0058] If the credibility score is below the first threshold, it is judged as low risk;

[0059] If the credibility score is greater than or equal to the first threshold and less than the second threshold, it is judged as medium risk;

[0060] If the credibility score is greater than or equal to the second threshold, it is judged as high risk;

[0061] The credibility score is calculated as follows:

[0062] Based on the fused feature vector Ffusion, a non-linear mapping is performed through a fully connected layer, and the calculation formula is as follows:

[0063] Where S is the output confidence score, Softmax is the activation function, Wo is the output layer weight matrix, and bo is the output layer bias vector.

[0064] The response behavior data includes whether the caller accessed official channels for verification and whether the call was reported to the anti-fraud platform. The caller ID number and its associated communication characteristics, along with electricity data, are added as new positive samples to the fraud sample set. The parameters of the original fraud identification model are fine-tuned to complete the model update. The risk level output by the fraud identification model includes three levels: low risk, medium risk, and high risk. Warnings are sent to users through communication outreach: Low risk: the caller ID number's behavior is recorded in the background log, and a text message warning is sent to the user; Medium risk: a warning notification is pushed through the official electricity app, prompting the user to verify the other party's identity and pay through official channels; High risk: a flash message is forcibly pushed, an anti-fraud warning voice is played, the operator blocks the call in real time, and the caller ID number and associated characteristics are uploaded to the electricity anti-fraud collaborative database.

[0065] It is important to note that dynamic threshold adjustment is based on the called user's electricity data and communication characteristics. A time-decay weighted approach is used to generate a user baseline behavior profile. This profile includes the user's historical average monthly electricity consumption and payment cycle offset features, the user's historical call frequency and average call duration with the power company's official number, and statistical features of the user's response rate and hang-up rate when answering unknown numbers at different times. The system calculates the deviation between the original risk level and the user baseline behavior profile. Specifically, it calculates the Mahalanobis distance between the current user's communication behavior characteristics and historical behavior characteristics, and dynamically generates a first and second threshold based on the ternary digits of the distance distribution. Subsequently, the system performs a non-linear mapping on the fused feature vector through a fully connected layer to calculate a credibility score, and compares the score with the two thresholds to classify it into three levels: low risk, medium risk, and high risk. The dynamic threshold adjustment method is as follows:

[0066] Formula for calculating user baseline score: .

[0067] Dynamic threshold calculation formula: Threshold 1 动态 =threshold1 全局 - ×baseline

[0068] Threshold 2 动态 =threshold2 全局 -β×baseline

[0069] Among them: Threshold 1 is global, Threshold 2 is global: global fixed thresholds (such as 0.3 and 0.7).

[0070] α, β: Adjustment coefficients (between 0.1 and 0.3)

[0071] Baseline > 0 (users are more sensitive than average) → Threshold lowered (easier to trigger alerts)

[0072] Baseline < 0 (users are less sensitive than average) → Threshold increases (early warnings are harder to trigger)

[0073] For example, a user: a retired elderly person

[0074]

[0075] The composite baseline is calculated as follows: Average = (-1.13 + 1.2 + 2.33 - 1.33) ÷ 4 = 0.27

[0076] Dynamic threshold calculation: Threshold 1 动态 =0.3 - 0.2 × 0.27 = 0.3 - 0.054 = 0.246

[0077] Threshold 2 动态 =0.7-0.15×0.27=0.7-0.0405=0.6595, thus obtaining the first threshold and the second threshold.

[0078] It is important to note that when a called user receives a call from someone claiming to be customer service from the power company, with the caller ID being +861234567890, the system first obtains the called user's communication characteristics and power data. Simultaneously, it verifies the caller ID against the first and second verification rules (i.e., the presence of a known fraudulent number among related numbers sharing the same base station and call durations concentrated between 30-90 seconds). Subsequently, the fraud detection model uses a fusion feature vector formula:

[0079] Extracting the caller's information:

[0080] The Vtemporal temporal feature vector is [0.85, 0.92, 0.78, 0.63].

[0081] The Vspatial spatial correlation feature vector is [0.95, 0.88, 0.45].

[0082] Vpower electrical state feature vector, [0.90, 0.82, 0.70],

[0083] Then, the vectors are concatenated to obtain [Vtemporal;Vspatial;Vpower]=[0.85,0.92,0.78,0.63,0.95,0.88,0.45,0.90,0.82,0.70], a 1×10 vector. Then, the weight matrix and bias are calculated to obtain:

[0084]

[0085]

[0086] Simultaneously, the following calculations were performed using matrix multiplication:

[0087]

[0088] The following is obtained through bias calculation:

[0089]

[0090] Finally, the ReLU activation function is applied:

[0091]

[0092] Calculations show that:

[0093]

[0094] The three components of the fused feature vector represent the intensity of temporal anomalies, spatial offsets, and electrical anomalies, respectively. The higher the value, the more significant the anomaly in that dimension.

[0095] And , input

[0096]

[0097] S is divided into S 低、 S 中、 S 高 ,get:

[0098] A subsequent linear transformation yields:

[0099]

[0100] Adding the bias, we get:

[0101] pass: The calculated exponent is:

[0102]

[0103] Then summation is performed. ,get:

[0104]

[0105]

[0106]

[0107]

[0108] And the final credibility score is =0.374、 = , = The first threshold is 0.246, and the second threshold is 0.6595. If the threshold is greater than or equal to the second threshold, the high-risk condition is not met. If the value is ≥ the first threshold, the condition for medium risk is met, and the user is identified as medium risk. An early warning notification will be pushed through the official power company app, prompting the user to verify the other party's identity and pay through official channels.

[0109] This system, through cross-validation, not only relies on a single communication feature but also incorporates user power data for cross-validation, effectively distinguishing between normal service alerts and fraudulent behavior. Furthermore, it identifies anomalies from multiple angles through at least four verification rules, including geographical consistency, call behavior and power consumption status, SMS characteristics, and data usage characteristics, thus solving the problem of delayed response in fraud detection. Additionally, it dynamically calculates risk thresholds based on user historical behavior profiles (such as average monthly electricity consumption, payment cycles, and habits of answering unknown numbers), thereby reducing the probability of false alarms and disturbances.

[0110] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended embodiments and their equivalents.

Claims

1. A risk identification system based on multidimensional data verification, comprising a data acquisition and verification module, a fraud identification module, and a fraud early warning module, characterized in that: Data acquisition and verification: acquire the communication characteristics of the caller's number in the user's call within a historical time period, and simultaneously acquire the power data of the called user for cross-validation to obtain a verification dataset; A model is built by training a neural network model using historical fraud data as training samples, thus obtaining a fraud detection model. Fraud detection is based on a verification dataset. The verification dataset is input into the fraud detection model for fusion calculation, and the output is risk level data. Fraud alerts are sent to users via communication, based on risk level data. The communication features include geographical features of communication data, call features, SMS frequency features, and data traffic features, and are cross-validated with user power data. Cross-validation involves executing at least two validation rules, which include: The first verification rule, the regional consistency verification, compares the location information of the caller's communication base station with the coverage area of ​​the base station of the user's electricity address, and at the same time compares it with other related numbers that share the same communication base station and the same IP exit, to obtain regional anomaly verification data; The second verification rule, call behavior and power consumption status verification, obtains the call frequency characteristics, average call duration characteristics and call time distribution characteristics of the calling number within a unit of time, and compares them with the user's power data to obtain the abnormal overdue payment characteristic data.

2. The risk identification system based on multidimensional data verification according to claim 1, characterized in that: The verification rules for cross-validation also include: The third verification rule is SMS feature verification, which obtains the SMS sending frequency characteristics associated with the calling number and the number of historical calls and SMS interactions with the called user within a preset time window to obtain abnormal interaction data. The fourth verification rule is traffic feature verification, which obtains the daily active duration characteristics and internet behavior data of the called user to obtain abnormal traffic access data.

3. The risk identification system based on multidimensional data verification according to claim 1, characterized in that: The model building process includes the following steps: A1. Sample construction: Collect communication record data and corresponding electricity user data from historical electricity bill fraud cases to form a fraud sample set. Label and classify the fraud sample set according to the type of fraud method to obtain a multi-label training sample set. A2. Feature processing: Based on the multi-label training sample set, feature extraction and processing are performed on the communication features and power data in the multi-label training sample set to obtain feature data; A3. Model Construction: Based on feature data, construct a heterogeneous feature separation and fusion neural network model. The neural network model includes: The first feature extraction branch performs time-series pattern extraction on communication features and SMS frequency features, and outputs a time-series feature vector. The second feature extraction branch models the spatial relationship between the geographical features of communication data and the base station coverage area of ​​the user's electricity address, and obtains a spatial correlation feature vector. The third feature extraction branch encodes the power data feature vector to obtain the power state feature vector; The feature fusion unit fuses time-series feature vectors, spatial correlation feature vectors, and power state feature vectors to obtain a fused feature vector; A4. Model training: Based on the fused feature vector, Ffusion, the neural network model is trained to obtain the original fraud detection model. The calculation formula for the fused feature vector Ffusion is as follows: Where ReLU is the activation function, Vtemporal is the temporal feature vector, Vspatial is the spatial correlation feature vector, Vpower is the power state feature vector, [.;.] is the vector concatenation operation, Wf is the weight matrix of the fusion layer, and bf is the bias vector of the fusion layer. A5. Model update: Based on the original fraud identification model, user response behavior data to warning information is obtained as new positive samples and added to the fraud sample set. The data is then sent back to the fraud identification model for update, and the original risk level is output at the same time. A6. Dynamic threshold adjustment: Obtain the power data and communication characteristics of the called user, generate a user baseline behavior profile, and calculate the deviation between the original risk level and the user baseline behavior profile to obtain the first threshold and the second threshold. Calculate the reliability score of the threshold through the calculation method and classify it to obtain the risk level.

4. The risk identification system based on multidimensional data verification according to claim 1, characterized in that: The sample construction includes: S1. Obtain communication characteristics and corresponding electricity user data from historical electricity bill fraud cases to construct an original fraud sample library; S2. Compare and label the caller IDs in the original fraud sample database with the official service number database of the power company and the known fraud number blacklist database to form a positive sample set and a negative sample set. S3. Based on the type of fraud method, the positive samples are subdivided into three categories: impersonating customer service, fake links, and fake overdue payments. The corresponding communication features and power status data are associated with each type of sample to obtain a multi-label training sample set.

5. The risk identification system based on multidimensional data verification according to claim 1, characterized in that: The user baseline behavior profile includes: the user's historical average monthly electricity consumption and payment cycle deviation characteristics, the user's historical call frequency and average call duration with the power company's official number, and the user's response rate and hang-up rate when answering unknown numbers at different times.

6. The risk identification system based on multidimensional data verification according to claim 3, characterized in that: The risk levels are classified based on credibility scores, specifically as follows: If the credibility score is below the first threshold, it is judged as low risk; If the credibility score is greater than or equal to the first threshold and less than the second threshold, it is judged as medium risk; If the credibility score is greater than or equal to the second threshold, it is judged as high risk; The credibility score is calculated as follows: Based on the fused feature vector Ffusion, a non-linear mapping is performed through a fully connected layer, and the calculation formula is as follows: Where S is the output confidence score, Softmax is the activation function, Wo is the output layer weight matrix, and bo is the output layer bias vector.

7. A risk identification system based on multidimensional data verification according to claim 3, characterized in that: The response behavior data includes whether the caller ID was accessed through official channels for verification and whether the caller ID was reported to the anti-fraud platform. The caller ID number and its associated communication characteristics and power data are added as new positive samples to the fraud sample set. The parameters of the original fraud identification model are fine-tuned to complete the model update.

8. The risk identification system based on multidimensional data verification according to claim 1, characterized in that: The fraud detection model outputs risk levels of three tiers: low risk, medium risk, and high risk. The method of sending warnings to users via communication includes: Low risk: Record the caller's activity in the backend log and send an SMS alert to the user; For medium-risk cases, a warning notification will be pushed through the official power company app, prompting users to verify the other party's identity and pay through official channels; High risk, forced push of flash message, playing anti-fraud warning voice, the operator blocks the call in real time, and at the same time uploads the caller number and related characteristics to the power anti-fraud collaborative database.

Images