A method and apparatus for processing information related to a case, and related devices

Abstract

The application provides a case-related information processing method and device and related equipment thereof. The method comprises: based on the case-related information of a confirmed case-related card, obtaining the use data of the confirmed case-related card in a preset time range corresponding to a case-related time point, and based on the use data, filtering out case-related cards that are in an aggregated distribution or a hot spot distribution in time and space from the confirmed case-related cards by a time-space hot spot analysis method to form a time-space aggregated case-related card set; based on the time-space aggregated case-related card set and communication signaling data, constructing a communication relationship undirected graph; based on the similarity between any two connected nodes in the communication relationship undirected graph, updating the weight of the corresponding edge in the communication relationship undirected graph to form a similarity undirected graph; and based on the average similarity of all edges in each closed loop in the identified similarity undirected graph, determining a high-risk case-related card set.

Description

Technical Field

[0001] This application relates to the fields of data processing and artificial intelligence, and more specifically, to a method, apparatus and related equipment for processing information in question. Background Technology

[0002] In recent years, with the rapid development of mobile communication and Internet of Things (IoT) technologies, SIM cards and IoT cards have become important tools for various online fraud, telecommunications fraud, and other illegal and criminal activities. Fraud gangs illegally obtain large numbers of these cards and register accounts on social media and payment platforms on the devices to carry out various scams such as fake prize winnings and voice fraud, posing a serious threat to social order and citizens' property security. In particular, IoT cards, due to their low cost, large issuance volume, and relatively lax regulation, are more easily used in the "black and gray industry" chain to conduct illegal activities such as channel arbitrage, coupon fraud, and telecommunications fraud. Currently, fraudulent activities are characterized by organization, cross-regional operations, and strong concealment, making traditional methods relying on manual investigation and post-incident handling insufficient to meet the needs of large-scale, real-time anti-fraud governance.

[0003] Currently, there are two main technical solutions for monitoring and identifying cards involved in cases: one is the traditional model based on manual investigation and case cooperation, which involves obtaining clues through relevant departments receiving reports from the public and cyber police patrols, gradually deploying and tracking to eventually solve the case. This method relies on a large amount of police resources, has a long case-solving cycle, and is difficult to achieve large-scale, real-time monitoring across the entire network. The other is a risk identification method based on post-event behavior analysis, such as collecting multi-dimensional data on the location of IoT cards, internet access behavior, and subscription packages to comprehensively assess their risk level and issue warnings. Although this method can identify risky cards to a certain extent, it is essentially still a post-event monitoring method, that is, it only issues warnings and takes action after fraud has occurred and caused actual social harm and economic losses, and cannot achieve pre-event prevention and risk blocking.

[0004] Therefore, there is an urgent need for a method to monitor cards involved in fraud that can accurately identify and warn of fraud risks before they occur, so as to improve the initiative, accuracy and systematicness of anti-fraud work. Summary of the Invention

[0005] This application provides a method, apparatus, and related equipment for processing case-related information, and a case-related card monitoring method for accurately identifying and issuing early warnings before fraud risks occur, so as to improve the initiative, accuracy, and systematicness of anti-fraud work.

[0006] Firstly, a method for processing case-related information is provided, including: Based on the case-related information of the confirmed case-related cards, the usage data of the confirmed case-related cards within a preset time range corresponding to the case-related time point is obtained. Based on the usage data, the case-related cards that are clustered or hotspot-shaped in time and space are selected from the confirmed case-related cards by the spatiotemporal hotspot analysis method to form a spatiotemporally clustered case-related card set. Based on the spatiotemporally aggregated set of cards involved in the case and the communication signaling data, an undirected graph of communication relationships is constructed. The nodes in the undirected graph of communication relationships include all the cards in the spatiotemporally aggregated set of cards involved in the case and other cards that have had direct communication with them. The edges in the undirected graph of communication relationships represent direct communication between nodes. Based on the similarity between any two connected nodes in the undirected graph of communication relationships, the weights of the corresponding edges in the undirected graph of communication relationships are updated to form a similarity undirected graph; Based on the average similarity of all edges within each closed loop in the identified similarity undirected graph, a set of high-risk fraud-related cards is determined.

[0007] Secondly, a device for processing case-related information is provided, including: The acquisition module is used to acquire the usage data of the confirmed case-related cards within a preset time range corresponding to the time point of the case based on the case-related information of the confirmed case-related cards, and to filter out the case-related cards that are clustered or hotspot-shaped in time and space from the confirmed case-related cards based on the usage data through the spatiotemporal hotspot analysis method, thereby forming a spatiotemporally clustered case-related card set. The construction module is used to construct an undirected graph of communication relationships based on the spatiotemporally aggregated set of cards involved in the case and the communication signaling data. The nodes in the undirected graph of communication relationships include all cards in the spatiotemporally aggregated set of cards involved in the case and other cards that have had direct communication with them. The edges in the undirected graph of communication relationships represent direct communication between nodes. The update module is used to update the weights of corresponding edges in the undirected graph of communication relationships based on the similarity between any two connected nodes in the undirected graph of communication relationships, thereby forming a similarity undirected graph; The determination module is used to determine the set of high-risk fraud-related cards based on the average similarity of all edges within each closed loop in the identified similarity undirected graph.

[0008] Thirdly, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps in the information processing method described in the first aspect.

[0009] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the information processing method described in the first aspect.

[0010] Fifthly, a computer program product is provided, including a computer program / instructions that, when executed by a processor, follow the steps in the information processing method described in the first aspect.

[0011] The case information processing method provided in this application firstly analyzes the spatiotemporal hotspots based on the usage data of confirmed case-related cards, filtering out cards that exhibit clustered or hotspot-like distributions in time and space to form a spatiotemporally clustered card set. Then, based on this set and communication signaling data, an undirected graph of communication relationships containing directly associated cards is constructed, and the similarity between nodes in the graph is calculated to update the edge weights, forming a similarity undirected graph that simultaneously reflects communication connections and attribute similarity. Next, closed cycles in the graph are identified, and the average similarity of each cycle is calculated. Finally, a high-risk fraud-related card set is locked down based on the average similarity threshold. Thus, starting from a small number of known case-related cards, the method proactively identifies potential high-risk gang cards that are highly clustered in spatiotemporal behavior, closely associated on communication networks, and highly similar in attribute characteristics. By combining spatiotemporal analysis, graph computation, and similarity quantification, the organization and behavior patterns of real-world criminal gangs are effectively simulated. This enables precise early warning and proactive crackdown on criminal networks before fraudulent activities are carried out and actual harm occurs. It solves the problems of passivity, lag, and fragmentation in existing technologies, and significantly improves the timeliness, accuracy, and systematic nature of fraud risk monitoring. Attached Figure Description

[0012] Figure 1 A flowchart illustrating a method for processing case-related information provided as an exemplary embodiment of this application; Figure 2 A schematic diagram of the system module relationships in the information processing method provided as an exemplary embodiment of this application; Figure 3 A schematic diagram illustrating the temporal and spatial distribution types of the cards involved in the case in the case information processing method provided for an exemplary embodiment of this application; Figure 4 A schematic diagram of an undirected graph illustrating the communication behavior of the relevant cards in the case in the case processing method provided as an exemplary embodiment of this application; Figure 5 A schematic diagram of an undirected graph of similarity between cards involved in a case, provided as an exemplary embodiment of this application; Figure 6 A schematic diagram illustrating the pre-prediction of suspected fraudulent card risks in a case-related information processing method provided as an exemplary embodiment of this application; Figure 7A schematic diagram of the platform business process in the information processing method provided as an exemplary embodiment of this application; Figure 8 A schematic diagram of the structure of an information processing device provided for an exemplary embodiment of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. Detailed Implementation

[0013] The technical solutions in this application will now be described with reference to the accompanying drawings and specific embodiments. The described embodiments are some, but not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0014] The following is a description of the terms used in this application: SIM cards involved in criminal cases: SIM cards involved in criminal cases refer to mobile phone cards or IoT cards that have been confirmed by relevant authorities or preliminarily identified through technical means as being suspected of being used for illegal and criminal activities such as telecommunications fraud and online fraud. In this application, SIM cards involved in criminal cases include both confirmed SIM cards that have been officially notified by relevant departments and used as the starting point for analysis, and potential SIM cards involved in criminal cases that have not yet been notified but have high-risk characteristics and are discovered through this method.

[0015] Spatiotemporal hotspot analysis: Spatiotemporal hotspot analysis is a data mining method that integrates time and spatial dimensions to identify phenomena where events exhibit non-random clustering characteristics in time and space. In this application, the method encodes and estimates the density of the usage time and location of the cards involved in the case to determine whether they form a significantly concentrated distribution pattern within a specific time period and geographical area, and accordingly classifies the cards involved in the case into different categories such as discrete, clustered, and hotspot types.

[0016] GeoHash Algorithm: The GeoHash algorithm is a hierarchical spatial indexing algorithm that converts two-dimensional latitude and longitude coordinates of a geographic location into a one-dimensional string encoding. This algorithm repeatedly binary-divides latitude and longitude intervals, mapping location points to binary sequences, which are then Base32 encoded into strings. The length of the encoded string determines the precision of the side length of the represented rectangular area; the longer the string, the more accurate the geographic location description. In this application, GeoHash is used to divide the location of the card in question into grid cells with sides of approximately 5 kilometers, to achieve standardized and regionalized spatial location modeling.

[0017] Kernel density estimation: Kernel density estimation is a nonparametric statistical method used to estimate the probability density function of a random variable. In this application, kernel density estimation is applied to the spatial distribution analysis of the cards involved in the case. By placing kernel functions at each data point and superimposing them, a smooth density surface describing the degree of clustering of the cards in the spatial region is generated. This density estimation result is one of the core criteria for determining whether the cards involved in the case belong to a clustered or hotspot distribution.

[0018] Spatiotemporally clustered case-related card set: This set refers to a subset of case-related cards selected from confirmed case-related cards through spatiotemporal hotspot analysis. These cards are concentrated in a specific time period and a specific geographical region. This set serves as the seed node for subsequent graph calculations and analyses in this application, representing core case-related cards that exhibit spatiotemporal characteristics of gang-related crimes in terms of behavioral patterns.

[0019] Undirected Graph of Communication Relationships: An undirected graph of communication relationships is a graph structure model with cards as nodes and direct communication between cards as edges. In this application, the nodes of the graph include all cards in the spatiotemporally aggregated set of cards involved in the case, as well as other associated cards that have had voice or SMS communication with them; edges represent at least one direct communication between two cards, and the edge weight is initialized to the number of communications. This graph is used to model the communication network topology between the cards involved in the case and their associated cards.

[0020] Similarity-based undirected graphs are weighted graph structures created by calculating the similarity between any two connected nodes and updating the weights of their corresponding edges, based on an undirected graph of communication relationships. The similarity calculation is based on multi-dimensional features, including card activation date, card number continuity, customer affiliation, terminal type, and subscription plan. This graph not only reflects the strength of communication links between nodes but also quantifies their similarity in attribute features, providing direct input for identifying the structure of criminal gangs.

[0021] Closed loop: A closed loop is a circular path in an undirected graph consisting of at least three nodes and edges connecting them. In this application, closed loops are used to simulate the internal communication structure of criminal gangs in real society: if a closed loop is formed between a case card and its associated cards in the graph, it indicates that these cards communicate with each other and are interconnected, demonstrating an organized structure. The closed loop is the core topological unit for identifying potential criminal gangs in this application.

[0022] Average similarity: Average similarity refers to the arithmetic mean of the sum of the weights of all edges (i.e., the similarity between connected nodes) within a closed loop, divided by the number of edges. This metric quantifies the consistency and strong association of attributes among the card sets corresponding to a closed loop. A higher average similarity indicates that the card nodes within the closed loop are more consistent in terms of card opening behavior and usage characteristics, and are more likely to belong to a batch of cards used collectively by the same criminal gang.

[0023] High-risk fraud-related card set: This set refers to the set of cards identified through the method described in this application as having an extremely high risk of fraud. This set originates from closed loops with an average similarity exceeding a preset threshold. After removing confirmed fraud-related cards, all remaining card nodes within the loop are marked as potential high-risk fraud cards requiring close monitoring. The output of this set achieves the technical goal of comprehensively mining all cards involved in a criminal gang's activities from a known limited number of cards.

[0024] As described in the background section, existing technologies still have significant shortcomings: First, traditional manual investigation and post-event analysis methods cannot identify risks before fraud occurs, leading to irreparable economic losses and social harm. Second, existing methods largely rely on monitoring cards that have already been flagged for fraud, lacking the ability to identify potentially risky cards with high-risk characteristics but not yet used for fraud. Third, existing methods often employ coarse-grained time and geographical divisions, making it difficult to accurately depict the spatiotemporal aggregation characteristics and gang connections of cards involved in cases. Finally, existing technologies lack a systematic analysis of the communication relationships and similar characteristics between cards involved in cases, failing to identify criminal gangs and their organizational networks as a whole, resulting in fragmented combat effectiveness and hindering the achievement of full-chain governance. Therefore, there is an urgent need for a method and system for monitoring cards involved in cases that can accurately identify and warn of fraud risks based on spatiotemporal aggregation characteristics and gang connections before fraud occurs, in order to improve the initiative, accuracy, and systematic nature of anti-fraud work.

[0025] This application proposes a method for processing case-related information. First, it performs spatiotemporal hotspot analysis based on the usage data of confirmed case-related cards on the day of the case, accurately selecting core case-related cards exhibiting clustered or hotspot-like distributions in time and space from a massive pool of reported case-related cards, forming a spatiotemporally clustered case-related card set. Then, starting from this set, it expands and mines all associated cards with direct communication behavior based on communication signaling data, constructing an undirected graph of communication relationships containing complete communication topology. Next, it introduces multi-dimensional attribute features to calculate the similarity between any connected nodes in the graph, upgrading the initial graph that only reflects communication relationships to a similarity undirected graph that simultaneously quantifies the consistency of attributes between nodes. Based on this, it identifies closed-loop structures in the graph that can simulate the internal interconnection patterns of real-world criminal gangs, and calculates the average similarity of each closed loop. Finally, by comparing the average similarity with a preset threshold, it identifies high-risk gangs with highly similar attributes and tightly closed communication loops, and accurately outputs all card nodes within their closed loops (excluding known case-related cards) as a set of potential high-risk fraud-related cards to be managed.

[0026] Through the aforementioned technical means, it is possible to proactively uncover potential high-risk gang cards that are highly clustered in terms of spatiotemporal behavior, closely linked in communication networks, and highly similar in attribute characteristics, starting from a small number of known cards involved in the case. This enables precise early warning and full-chain crackdown on criminal networks from point to area before fraudulent activities are carried out and actual harm occurs.

[0027] Specifically, the specific flow of the case-related information processing method provided in the embodiments of this application is as follows: Figure 1 As shown, it includes the following steps 110 to 140.

[0028] Step 110: Based on the case-related information of the confirmed case-related cards, obtain the usage data of the confirmed case-related cards within a preset time range corresponding to the case-related time point, and use the spatiotemporal hotspot analysis method to filter out the case-related cards that are clustered or hotspot-type in time and space from the confirmed case-related cards based on the usage data, thereby forming a spatiotemporally clustered case-related card set.

[0029] like Figure 2 As shown, the case-related information processing system provided in this application embodiment includes the following five core modules: information input module, data storage module, spatiotemporal processing module, graph calculation module, and fraud-related card prediction module.

[0030] The information entry module is responsible for receiving case-related card information manually entered by account managers from relevant departments, including the case card number, date of the case, location of the case, and the actions involved. This module provides a visual interface, supports data creation, deletion, modification, and retrieval operations, and writes the entered data to the data storage module.

[0031] The data storage module is responsible for persistently storing all data involved in this system, including the original fraud dataset A of the cards involved in the case, the dataset B of the cards used on the day of the case, the spatiotemporal dataset C of the cards involved, the spatiotemporal aggregated dataset D of the cards involved, as well as the intermediate calculation results and final output results generated in each step. This module adopts a distributed database architecture, supporting high-concurrency read and write and fast retrieval of massive amounts of data.

[0032] The spatiotemporal processing module is responsible for extracting spatiotemporal features and performing hotspot analysis on the usage data of the cards involved in the case. This module reads the dataset B of the cards involved in the case on the day of the case from the data storage module, performs time segmentation processing and geographic region coding, and generates the spatiotemporal dataset C of the cards involved in the case; then, through spatiotemporal hotspot analysis methods such as kernel density estimation, it filters out the cards involved in the case that exhibit clustered or hotspot-like distribution in time and space from dataset C, forming the spatiotemporal clustered dataset D of the cards involved in the case.

[0033] The graph computation module is responsible for constructing the communication relationship graph, calculating similarity, and updating the graph structure. Using a spatiotemporal aggregated dataset D as the seed node, this module expands and mines associated cards that have direct communication behavior with the seed node based on operator communication signaling data, constructing an undirected graph of communication relationships. Then, it calculates the similarity between connected nodes based on multi-dimensional features such as card activation date, card number continuity, customer identifier, terminal type, and subscription package type, updating the similarity values ​​to the weights of the corresponding edges, forming a similarity undirected graph. Finally, it identifies closed-loop structures in the similarity undirected graph and calculates the average similarity of each closed loop.

[0034] The fraud-related card prediction module is responsible for identifying high-risk fraud gangs and outputting potential cards involved in the case. This module reads the average similarity of each closed loop output by the graph calculation module, compares it with a preset threshold, and identifies closed loops with an average similarity greater than or equal to the threshold as high-risk fraud gang organizations. It then removes the confirmed cards involved from all card nodes contained in the high-risk closed loops, marks the remaining card nodes as the final set of high-risk fraud-related cards, and outputs them to the anti-fraud early warning platform or risk management system.

[0035] The data flow and control flow relationships among the above five modules are as follows: Figure 1 As shown: the information entry module receives external input and writes it to the data storage module; the data storage module provides data reading and writing services for the spatiotemporal processing module, the graph calculation module, and the fraud-related card prediction module; the output of the spatiotemporal processing module serves as the input of the graph calculation module; the output of the graph calculation module serves as the input of the fraud-related card prediction module; the fraud-related card prediction module finally outputs a list of suspected high-risk fraud-related cards.

[0036] In this embodiment, it has been confirmed that the information regarding the cards involved in the case was formally reported by the relevant authorities and manually entered into the system's information entry module by the account manager. As shown in Table 1, each piece of information related to the case includes at least the following fields: Table 1. Fields included in each piece of information related to the case.

[0037] After the above data is entered, it is stored in the data storage module as the original dataset A of the card fraud case.

[0038] To identify cards with spatiotemporal characteristics of group operations from a massive pool of confirmed cards involved in cases, and to form the seed node set for subsequent graph computation and analysis, this embodiment does not use all confirmed cards as the starting point for mining group connections. This is because some cards may be cards used sporadically, used by a single person, or abandoned cards that have been resold and escaped the control of the fraud group. These cards often exhibit discrete and random spatiotemporal distribution characteristics. If all of them are used as seeds for graph expansion without screening, a large amount of noise will be introduced, resulting in a bloated communication graph and the group structure being submerged in a massive number of irrelevant nodes.

[0039] To address this, this application's embodiments achieve precise screening through two sub-stages: spatiotemporal feature extraction and hotspot analysis. Spatiotemporal feature extraction transforms the original, unstructured time points and latitude / longitude coordinates into standardized time period labels and geographic grid codes, making the spatiotemporal behavior of different cards comparable. Hotspot analysis, based on a kernel density estimation algorithm, calculates the density distribution of the activity of involved cards within each geographic grid, and accordingly classifies the cards into three categories: discrete, clustered, and hotspot-type. Among them, discrete cards are discarded because they do not exhibit characteristics of gang-related crimes, while clustered and hotspot-type cards are retained and aggregated into a spatiotemporally clustered set of involved cards.

[0040] In some exemplary embodiments, obtaining usage data of the confirmed card within a preset time range corresponding to the time of the incident includes: Obtain billing message data from the operator's system within a preset time range corresponding to the time point in question for the card in question. From the billing message data, data records whose usage location information matches the geographical location in the case information are selected as usage data.

[0041] The billing message data refers to the raw data records generated by the operator's Business Support System (BSS) during the provision of communication services to users, used to record service usage and serve as the basis for billing. In this application, the billing message data mainly originates from RADIUS (Remote Authentication Dial-In User Service) protocol messages, containing key information such as the usage time of the SIM card in question, its location (base station latitude and longitude), communication duration, and data usage. This data is characterized by its strong real-time performance, wide coverage, and standardized recording fields, making it the core data source for reconstructing the true activity trajectory of the SIM card in question on the day of the incident.

[0042] The preset time range refers to a continuous time window extending forward and backward from the time point of the case-related information record. In this embodiment, the preset time range can be the day of the case, i.e., the calendar day containing the time point of the case (00:00:00 to 23:59:59). This time range is set based on the prior knowledge in fraud case investigation practice that the cards involved in the case usually exhibit regular activity patterns near the crime scene on the same day the fraudulent act is committed. Narrowing this time window to the day of the case can minimize the noise interference of historical data unrelated to the fraudulent act on the spatiotemporal analysis while ensuring the recall rate.

[0043] Specifically, data records whose usage location information matches the geographical location of the case in the billing message data are selected as usage data. This allows for precise correlation between the reported location of the case and the usage location recorded by the operator, ensuring that the data entering the subsequent analysis process has a direct spatiotemporal binding relationship with the fraudulent behavior itself. In particular, this application embodiment achieves data cleaning through the following two key operations: First, in the time dimension, the data collection scope is strictly limited to a preset time range corresponding to the time of the case, excluding regular activity records of the card outside the preset time range; second, in the spatial dimension, records whose usage location information matches the geographical location of the case are selected from the billing message data, excluding activity records of the card outside the crime scene on the day of the case. After these two rounds of filtering, the final usage data is actually a fragment of the card's activity trajectory near the time and location of the crime, rather than its full activity trajectory throughout the day.

[0044] For example, it can be connected to the operator's business support system to obtain the RADIUS billing message data of the confirmed SIM card involved in the case on the day of the case. The billing message data is the original data record generated by the operator in the process of providing communication services to users, used to record service usage and as the basis for billing, including key information such as the usage time of the SIM card involved in the case, the location of use (base station latitude and longitude), communication duration, and data usage.

[0045] From the billing message data, the platform filters out data records whose location information matches the reported geographical location of the card in question, and uses this as dataset B for the day the card was involved in the case. As shown in Table 2, this dataset contains the following fields: Table 2. Billing message data of the cards involved in the case within the preset time range corresponding to the time of the case.

[0046] In some exemplary embodiments, based on the usage data, a spatiotemporal hotspot analysis method is used to filter out cards involved in cases that exhibit a clustered or hotspot-like distribution in time and space from the confirmed cards involved in the case, including: Spatiotemporal features are extracted from the data to obtain the time period label and geographic region code for each data point; Based on time period labels and geographic region codes, the kernel density estimation method is used to analyze the degree of clustering of the cards involved in the case within the spatial region; Based on the degree of clustering, the spatiotemporal distribution types of the cards involved in the case are classified into discrete, clustered, and hotspot types; Select cards involved in the case that are clustered or hotspot-type in distribution.

[0047] Specifically, the original spatiotemporal data is first converted into standardized features through time period segmentation and GeoHash encoding. Then, based on these features, a smooth density surface representing spatial clustering is generated using a kernel density estimation algorithm. Finally, according to the density distribution pattern, the cards involved are categorized into three predefined classes. This classification system precisely corresponds to three typical scenarios in real-world fraud cases: discrete fraud corresponds to individual, occasional crimes; clustered fraud corresponds to frequent activities of gangs within a certain area; and hotspot fraud corresponds to highly concentrated activities of gangs in specific locations. By selecting the latter two types of cards as seeds for subsequent analysis, this embodiment achieves high recall and identification of core members of criminal gangs.

[0048] In some exemplary embodiments, the time period label is obtained by dividing a day into working hours, leisure hours, and rest hours; the geographic region code is generated using the GeoHash algorithm.

[0049] As an example, this application divides a 24-hour day into three time periods with typical social behavioral characteristics. The working period is from 08:00 to 17:00, corresponding to normal professional activities; the entertainment period is from 17:00 to 22:00, corresponding to non-professional activities such as socializing and leisure; and the rest period is from 22:00 to 08:00 the next day, corresponding to periods of low activity intensity such as sleep. This division method stems from empirical analysis of the time patterns of telecommunications fraud cases: different types of fraud gangs show significant differences in activity levels at different times. For example, cross-border fraud gangs often choose to commit crimes during rest periods (corresponding to daytime in overseas time zones). Discretizing continuous time into three semantically clear time period labels retains the important ability of the time dimension to distinguish fraud behavior patterns while avoiding the overfitting and decreased generalization problems caused by using specific minutes and hours as continuous feature inputs.

[0050] The GeoHash algorithm adjusts the precision of geographic location description by controlling the length of the encoded string. This embodiment uses a 5-bit GeoHash encoding, corresponding to a geographic grid width of approximately 4.89 kilometers, a height of approximately 4.89 kilometers, and a coverage area of ​​approximately 23.9 square kilometers. This precision selection is based on the analysis of the geographic characteristics of typical fraud dens: criminal dens, represented by fraud zones in northern Myanmar, typically concentrate their activities within an area of ​​several kilometers. A 5-kilometer grid granularity allows for the clustering of cards involved in cases from the same or adjacent zones into the same encoded grid, while preventing the inclusion of irrelevant cards due to an excessively large grid, achieving the optimal signal-to-noise ratio for spatial clustering analysis.

[0051] For example, the GeoHash algorithm is used to encode the geographical locations of the entire country, converting two-dimensional latitude and longitude coordinates into one-dimensional string codes. Each encoded string represents a rectangular grid area. The specific implementation steps of the GeoHash algorithm are as follows: First, the latitude is binary-coded. The global latitude range is [-90, 90]. The interval containing the target latitude is repeatedly divided into two halves. Each time, the result falls into the left interval and is coded as 0; if it falls into the right interval, it is coded as 1. For example, latitude 30.559545 is in the [0, 90] interval, so the first binary division result is 1; it is in the [0, 45] interval, so the second result is 0; and so on. The final binary code for the latitude is 1010101101110111.

[0052] Table 3 shows the GeoHash algorithm's binary division of latitude.

[0053] Similarly, by performing a binary code on longitude 104.059684, the binary code of longitude is obtained as 1100100111111111.

[0054] Then, merge the binary codes of latitude and longitude. Following the rule of placing longitude in even-numbered positions and latitude in odd-numbered positions, merge the binary codes of longitude and latitude into a new string: 11100100110001110011110111111101111111.

[0055] Finally, Base32 encoding is performed. The merged binary string is divided into groups of 5 bits each, and the corresponding decimal value for each group is calculated and converted according to the Base32 encoding table. Taking 11100 10011 00011 11011 1111101111 as an example, these correspond to decimal values ​​28, 19, 3, 27, 31, and 15 respectively. The Base32 encoding results are w, m, 3, v, z, and g, ultimately yielding the latitude and longitude code wm3vzg.

[0056] The length of the GeoHash encoded string determines the precision of the side length of the represented rectangular area; the longer the string, the more accurate the geographic location description. The correspondence between encoding length and actual geographic precision is shown in Table 4. Table 4 GeoHash Algorithm Accuracy Comparison Table

[0057] In this embodiment, the first 5 bits of the GeoHash encoding are used as the spatial location encoding field. The geographic accuracy is approximately 4.89 kilometers, close to 5 kilometers. The rectangular area is of moderate size, effectively simulating the geographic scale of a typical fraud den, while avoiding the problems of data sparsity and excessive computational overhead caused by overly fine grids.

[0058] After the above spatiotemporal feature extraction, each record in dataset B has been supplemented with a TimePeriod field (time period type) and a GeoHash encoding field, forming the spatiotemporal dataset C of the involved cards. See Table 5 for details. Table 5 Spatiotemporal Information of Cards Involved in the Case

[0059] The time-time label is derived by dividing the day into work, leisure, and rest periods, based on statistical analysis of the daily routines of fraudsters in numerous solved cases. Fraud gangs, especially cross-border, organized professional fraud gangs, exhibit activity cycles that significantly deviate from normal social routines. Preserving this time dimension's distinguishability is crucial for identifying specific types of fraud gangs. Similarly, the five-digit GeoHash code corresponding to a 5-kilometer grid scale can aggregate cards related to the same location into the same grid while maintaining differentiation even when different locations are relatively close. This parameter was chosen based on empirical values ​​determined after analyzing the geographical distribution characteristics of typical cross-border fraud locations in northern Myanmar and Cambodia.

[0060] The spatiotemporal processing module is based on the spatiotemporal dataset C of the cards involved in the case. It uses the kernel density estimation method to perform spatiotemporal hotspot analysis to identify the cards involved in the case that are clustered or hotspot distributed in time and space.

[0061] Kernel density estimation is a nonparametric statistical method for estimating the probability density function of a random variable. In this embodiment, kernel density estimation is used to generate a smooth density surface describing the degree of aggregation of the cards involved in the case within a spatial region. For any point y within the spatial region, its estimated probability density value is:

[0062] Where h represents the bandwidth of the kernel density function, which controls the smoothness of the estimated surface; K is the kernel function, usually a Gaussian kernel or an Epanechnikov kernel; and n is the number of case-related card usage record points falling within the spatial region. It is the spatial coordinate of the i-th recorded point.

[0063] Based on the above density estimation results and combined with the distribution characteristics in the time dimension, this application embodiment classifies the spatiotemporal distribution types of the cards involved in the case into the following three categories: The first type is the discrete type: these cards are evenly distributed spatially without a clear center of aggregation; they are also evenly distributed temporally without any concentration at specific times. These types of cards typically correspond to sporadic, solo, or unorganized use, and do not exhibit characteristics of gang-related crimes.

[0064] The second type is the clustered type: spatially, it exhibits a clustered distribution, with the usage records of the cards involved concentrated within a certain geographical area; temporally, it shows a relatively high concentration within a certain period, significantly higher than in other periods. These cards correspond to the frequent activities of the gang within a specific area.

[0065] The third category is the hotspot type: spatially, it shows a clustering of points, with usage records highly concentrated at a specific location (such as a building or a park); temporally, it shows a concentration at specific time periods. This type of case involves gangs operating with highly concentrated activity at fixed locations.

[0066] Figure 2 A schematic diagram illustrating the temporal and spatial distribution types of the case-related cards in the case-related information processing method provided as an exemplary embodiment of this application. Wherein, Figure 2 2.a, 2.b, and 2.c illustrate the spatial distribution characteristics of discrete, clustered, and hotspot types, respectively. Figure 2 A, B, and C respectively illustrate the corresponding time distribution characteristics.

[0067] The spatiotemporal processing module discards case cards that exhibit a discrete spatiotemporal distribution, deeming them lacking hotspot clustering characteristics, and performs no further processing. For case cards exhibiting a clustered or hotspot-like spatiotemporal distribution, the module determines they possess hotspot clustering characteristics, retains them, and extracts information from the case card spatiotemporal dataset C to form the case card spatiotemporal cluster dataset D. This dataset D serves as the seed node set for subsequent graph computation and analysis, representing core case cards exhibiting clear characteristics of organized crime in spatiotemporal behavior.

[0068] Step 120: Based on the spatiotemporally aggregated set of cards involved in the case and the communication signaling data, construct an undirected graph of communication relationships. The nodes in the undirected graph of communication relationships include all cards in the spatiotemporally aggregated set of cards involved in the case and other cards that have had direct communication with them. The edges in the undirected graph of communication relationships represent direct communication between nodes.

[0069] Communication signaling data refers to the recorded data generated by control signaling used to establish, maintain, and terminate communication connections in a communication network. In this embodiment, communication signaling data mainly includes call detail records (CDRs), covering information such as the calling number, called number, communication start time, and communication duration for communication events like voice calls and SMS messages. Unlike billing message data, which focuses on user location, the core value of communication signaling data lies in depicting the social relationship network between users. This data is generated in real-time by the operator's core network equipment and features coverage of all network users, complete recording of communication relationships, and high time accuracy, making it the only reliable data source for constructing the communication relationship diagram of the SIM card in question.

[0070] Direct communication refers to point-to-point communication between two SIM cards without third-party number transfer or forwarding. In this embodiment, direct communication specifically refers to voice calls and SMS messages. This definition excludes indirect communication through intermediaries such as group calls, conference calls, and call forwarding to ensure that the constructed communication relationship diagram accurately reflects the direct connection strength between the SIM cards. Direct communication is the primary means of internal communication within telecommunications fraud gangs and is also an important basis for relevant authorities to determine the connections between gang members during case investigations.

[0071] An undirected graph of communication relationships is a graph structure data model with cards as nodes and direct communication between cards as edges. This application uses an undirected graph instead of a directed graph because communication between members of a fraud ring is often bidirectional, and this application focuses on whether a communication relationship exists rather than the directional information of who initiates and who is called. Undirected graphs can simplify the graph structure to the greatest extent while preserving core association information, reducing the complexity of subsequent graph calculations. The mathematical representation of this graph structure is G(V, E), where V is the set of nodes and E is the set of edges.

[0072] In the communication relationship undirected graph of this application embodiment, a node represents an independent SIM card or IoT card. Each node is identified by the unique identifier (MSISDN or IMSI) of the card. Nodes are divided into two categories: one category consists of cards from the spatiotemporally aggregated set of involved cards output in step 110, called seed nodes; the other category consists of cards mined from communication signaling data that have had direct communication with seed nodes, called associated nodes. Both types of nodes have equal status in the graph computation process and jointly participate in subsequent similarity calculations and closed loop identification.

[0073] In the undirected graph representing communication relationships in this application embodiment, an edge indicates that there is at least one direct communication interaction between two connected nodes. Edges are undirected, meaning that the edge from node A to node B and the edge from node B to node A are considered the same edge. Edges themselves do not carry direction information, but they do carry weight attributes. The weight is initialized to the total number of direct communication interactions between the two nodes within a preset statistical period (the sum of voice calls and SMS messages). The more communication interactions, the stronger the connection between the two nodes, and the higher the weight value.

[0074] Specifically, the graph calculation module uses each card in the spatiotemporally aggregated dataset D of involved cards as the starting point for querying. It traverses all communication signaling records of the card within the statistical period to find all other cards that have had direct communication with it and adds these cards to the node set. This embodiment adopts a single-layer expansion strategy, that is, only expanding cards that directly communicate with the seed node, without recursively expanding the associated nodes of associated nodes, in order to effectively control the graph size while maintaining the integrity of the core gang's topology. After the node set is determined, the graph calculation module traverses all node pairs. If two nodes have at least one direct communication interaction within the statistical period, an undirected edge is established between them. The edge weight is initialized to the total number of direct communication interactions between the two nodes within the statistical period (the sum of voice calls and text messages).

[0075] The statistical period refers to the time window used to collect communication signaling data. In this embodiment, the statistical period is set to 30 days prior to the date of the incident. This setting is based on the following prior knowledge: fraud gangs typically have a card-nurturing or testing phase before committing fraud, during which gang members maintain regular contact; simultaneously, after the fraud is exposed, the cards involved may be discarded or resold, and communication records after the date of the incident no longer reflect their true relationship as gang members. Locking the statistical period to 30 days before the date of the incident allows for the retention of valid gang-related information while minimizing irrelevant noise.

[0076] For example, firstly, the system receives a list of confirmed cards involved in a case from the relevant authorities. The case information for each card includes fields such as the card number, the date of the case, the geographical location of the case, and a description of the alleged conduct. For instance, consider a card with the last four digits of its number being 1234, the date of the case being August 15, 2024, and the location being Town C, City B, Province A.

[0077] A query was initiated with the operator's billing support system to obtain all RADIUS billing message data generated by the SIM card in question throughout the entire day of August 15, 2024 (00:00:00 to 23:59:59). This message data contained the latitude and longitude information of the base station connected to the card for each network attachment, call, SMS, and data service usage. Subsequently, records matching the geographical location description corresponding to the latitude and longitude of the usage location with Town C, City B, Province A were filtered out. Assuming three records were obtained after filtering, occurring at 09:15:22, 14:20:38, and 19:42:11 on the same day, with corresponding latitude and longitude coordinates all located in the vicinity of Street D, Town C, these three records constitute the usage dataset of the SIM card in question.

[0078] Next, for the above three records, the time period is determined based on their occurrence time: 09:15:22 is in the 08:00-17:00 interval and is marked as a working time period (1); 14:20:38 is also in the working time period and is marked as "1"; 19:42:11 is in the 17:00-22:00 interval and is marked as a leisure time period (2). Subsequently, the latitude and longitude coordinates of each record are GeoHash encoded. Taking (104.059684, 30.559545) as an example, after latitude and longitude interval binary division, binary merging, and Base32 encoding, a 5-bit encoded string "wm3vz" is obtained. At this time, each record carries two newly added fields: time period label and geographic grid code.

[0079] Subsequently, the spatiotemporal data of the card in question, along with thousands of other confirmed cards, were aggregated. Using a GeoHash grid as the spatial unit, the number of cards falling into each grid was counted. Taking grid "wm3vz" as an example, it was found that a total of 15 cards in question were found within this grid, with a total of 27 usage records. Among these, the usage time of 12 cards was highly concentrated during work and leisure time periods. Kernel density estimation results showed that the density of cards in question in this grid was significantly higher than that of surrounding grids, and a clear clustering center was formed within this grid. Based on this, the cards in question that fell within this grid (including cards with serial numbers ending in 1234) were determined to be of a clustered or hotspot distribution.

[0080] After traversing and analyzing all confirmed cards involved in the case, cards with spatiotemporal distribution patterns of clustering or hotspots were finally selected to form a spatiotemporally clustered card set. The data size in this set is usually only 30% to 50% of the original list of cards involved in the case, but its cards exhibit obvious characteristics of gang-related crimes in terms of spatiotemporal behavior, making them the most valuable seed nodes for subsequent graph computation and analysis.

[0081] As can be seen, the core function of step 120 is to use the spatiotemporally aggregated set of cards involved in the case output in step 110 as a seed, expand outward through communication signaling data, mine all related cards that have direct communication behavior with the seed card, and organize these cards and their communication relationships into a complete graph structure. This elevates the analytical perspective from individual cards to a network of card relationships. By introducing graph structure modeling, subsequent analysis can capture the organized characteristics of mutual connections and support among gang members. Step 120 includes two key operations: node expansion and graph expansion.

[0082] Step 120, node expansion, refers to using each card in the spatiotemporally aggregated set of involved cards as the starting point for querying, traversing all communication signaling records within the statistical period, identifying all other cards with which it has had direct communication, and adding these cards to the graph node set. This operation is iterative: for newly added associated nodes, should it continue to expand outwards from them? This application's embodiment adopts a single-layer expansion strategy, that is, only expanding cards that communicate directly with seed nodes, and not expanding next-level cards that communicate with associated nodes. This strategy is based on empirical analysis of the communication topology of fraud gangs: core members of the gang usually have direct communication connections, while the one-way connections between peripheral members and core members are insufficient to form a closed loop. Single-layer expansion can effectively control the graph size and avoid the excessive introduction of irrelevant nodes while preserving the integrity of the core gang's topology.

[0083] like Figure 3 As shown, nodes a, b, and c are the confirmed involved cards in the spatiotemporally aggregated involved card dataset D, denoted as set D1={a,b,c}; nodes d, e, f, g, h, i, and j are the associated cards that have had direct communication with the involved cards in D1, denoted as set E1={d,e,f,g,h,i,j}. The connections between nodes represent direct communication, and the numbers on the connections represent the total number of communications within the statistical period. For example, if node b and node j communicate 2 times via voice and 1 time via SMS, the edge weight is denoted as 3.

[0084] To upgrade undirected graphs of communication relationships into similarity undirected graphs that can simultaneously reflect the degree of attribute convergence, embodiments of this application establish a similarity evaluation system based on multi-dimensional features. Through retrospective analysis of solved cases reported by relevant departments, it was found that cards controlled by the same criminal gang often exhibit the following common characteristics: Table 6 Similarity Evaluation Criteria

[0085] The graph calculation module connects to the operator's customer relationship management system, billing system, and terminal management system to obtain the original values ​​of each card in the above five features, and performs feature encoding and quantification.

[0086] The graph construction in step 120 refers to, after determining the set of nodes, traversing all node pairs. If two nodes have at least one direct communication interaction within the statistical period, an undirected edge is established between them, and the number of communication interactions is initialized as the edge weight. This operation aggregates the scattered communication records into a compact graph structure, transforming the massive point-to-point communication data, which was originally stored in relational databases and was difficult to understand intuitively, into a graph data model with a clear topological structure that is easy to perform mathematical operations and visualize.

[0087] For example, a spatiotemporally aggregated set of case-related cards D can be received from step 110. Assume that this set contains three cards a, b, and c, all of which are case-related cards that have been reported and confirmed by relevant authorities and have been determined by spatiotemporal hotspot analysis to be of an aggregated or hotspot distribution.

[0088] Taking the case date of August 15, 2024 as an example, the statistical period can be set to 00:00:00 on July 16, 2024 to 23:59:59 on August 15, 2024 (30 days prior to the case date). Then, a query is initiated with the operator's communication signaling data platform to obtain all call records and SMS records of direct communication with cards a, b, and c within this statistical period.

[0089] Upon investigation, it was found that card a communicated with cards d and e within the statistical period: a made 3 calls and sent 2 text messages to d, for a total of 5 communications; a made 1 call and sent 0 text messages to e, for a total of 1 communication. Card b communicated with cards j, i, and g: b made 2 calls and sent 1 text message to j, for a total of 3 communications; b made 4 calls and sent 0 text messages to i, for a total of 4 communications; b made 1 call and sent 1 text message to g, for a total of 2 communications. Card c communicated with cards f and g: c made 2 calls and sent 2 text messages to f, for a total of 4 communications; c made 1 call and sent 0 text messages to g, for a total of 1 communications.

[0090] Furthermore, a communication record was found between card d and card e, and between card f and card g. Although these records do not directly involve seed nodes a, b, and c, since d, e, f, and g have been included as associated nodes in the graph to be constructed, their communication relationships also require the establishment of edges.

[0091] At this point, the set of graph nodes V = {a, b, c, d, e, f, g, i, j} has been determined. Here, a, b, and c are seed nodes, and the rest are associated nodes.

[0092] Subsequently, all unordered node pairs in the aforementioned node set are traversed, and an undirected edge is constructed for each pair of nodes with communication records, using the total number of communications as the initial weight of the edge. The specific edge construction results are as follows: Edge ad, weight 5; edge ae, weight 1; edge bj, weight 3; edge bi, weight 4; edge bg, weight 2; edge cf, weight 4; edge cg, weight 1; edge de, weight 1; edge fg, weight 2.

[0093] The nodes and edges described above are organized into a graph data structure G(V, E) and stored in an in-memory graph database or a distributed graph computing framework for use in subsequent step 130. At this point, the undirected graph of communication relationships is complete.

[0094] It is important to note that a strict single-level expansion strategy is followed when expanding nodes. This means that only cards that have direct communication with a, b, and c are included in the node set, without further expanding the communication contacts of d, e, f, g, i, and j. For example, suppose card d also has a communication record with card x. Since x does not directly communicate with a, b, or c, x will not be included in the current graph structure. This strategy effectively controls the graph size and avoids the node explosion problem caused by over-expansion.

[0095] Step 130: Based on the similarity between any two connected nodes in the undirected graph of communication relationships, update the weights of the corresponding edges in the undirected graph of communication relationships to form a similarity undirected graph.

[0096] While the undirected graph of communication relationships constructed in step 120 can depict the social network topology between cards, its edge weights only represent the frequency of contact and cannot determine whether these frequently contacted cards are gang members or simply normal users with frequent business dealings based on the edge weights. This is because members of criminal gangs not only communicate frequently, but more importantly, they exhibit a high degree of consistency in their card opening, usage, and consumption patterns—a characteristic not found in normal social relationships. Based on this, this application's embodiments explicitly inject this identity convergence characteristic into the graph structure by introducing multi-dimensional attribute similarity calculation.

[0097] In some exemplary embodiments, updating the weights of corresponding edges in the undirected graph of communication relationships based on the similarity between any two connected nodes includes: Similarity is calculated based on one or more of the following features of the corresponding cards of any two connected nodes in the communication relationship undirected graph: card opening date, card number continuity, customer identifier, terminal type, and subscription package type. The calculated similarity values ​​are used as the weights of the corresponding edges in the undirected graph of communication relationships.

[0098] The activation date refers to the specific date on which a mobile communication operator completes the account activation process for a SIM card or IoT card in its Customer Relationship Management (CRM) system, recorded in YYYY-MM-DD format. This date marks the beginning of the card's lifecycle and is one of the most important fundamental attributes in the operator's user management system. In this embodiment, the activation date is used as a key feature to determine whether two cards belong to the same batch of tools used in the crime. Criminal gangs typically purchase or register a large number of cards involved in the crime within a specific time window to carry out fraudulent activities. The activation dates of these cards are often highly concentrated or even identical. Incorporating the activation date into similarity calculations can effectively capture the behavioral inertia of this criminal gang.

[0099] Card number continuity refers to the proximity of two cards in the number space allocated by the operator. Mobile phone cards or IoT cards are not randomly assigned, but issued sequentially within a specific number range. If two cards are activated around the same time and their card numbers are similar or consecutive, they are highly suspected of originating from the same batch and channel. In this embodiment, card number continuity is quantified using the binary variable "whether they are consecutive" or a continuous distance metric. This feature is an important supplement to the activation date feature: in some cases, criminal gangs may activate cards over multiple days, but when activated on the same day, due to the operator's number allocation mechanism, the card numbers will exhibit a clear continuity pattern.

[0100] The customer attribution identifier is an identity code used in a telecom operator's customer relationship management system to uniquely identify a natural person or legal entity customer. A single customer may hold multiple cards, including primary cards, secondary cards, and IoT card pools. In this embodiment, the customer attribution identifier is used to determine whether two cards belong to the same ultimate controlling person. If multiple cards involved in the case are registered under the same customer name, it is highly probable that they are controlled and used by the same entity, making it strong evidence of group affiliation. This characteristic is quantified using the binary variable "whether it is the same customer".

[0101] The terminal type refers to the device model identifier that the SIM card in question is associated with during use. When a card is attached to a mobile communication network, the network side can parse the terminal brand, model, operating system version, and other information through the International Mobile Equipment Identity (IMEI). In this embodiment, the terminal type is abstracted as a terminal model code. If multiple SIM cards are used alternately on the same terminal device, or all are used on the same model of terminal device, it indicates that these cards may be centrally managed and rotated by the same group. This characteristic is quantified by binary variables "whether it is the same terminal model" or "whether it is the same physical terminal".

[0102] The subscription package type refers to the tariff plan code that the SIM cards involved in the case are contracted with in the operator's billing system. To reduce operating costs and simplify management, criminal gangs often subscribe to the same tariff packages for SIM cards purchased in bulk, such as a unified IoT data package or a unified basic call package. In this embodiment, the subscription package type is identified by the package product code. This feature is particularly significant in IoT SIM card fraud scenarios: IoT SIM cards are often opened in bulk by industry clients, and cards in the same batch are almost inevitably bound to the same tariff package. This feature is quantified by the binary variable "whether it is the same package".

[0103] Cosine similarity is a metric that assesses the similarity between two vectors by measuring the cosine of the angle between them in a vector space. The value ranges from -1 to 1, with a value closer to 1 indicating greater similarity in direction between the two vectors. In this embodiment, cosine similarity is used to calculate the similarity of attributes between two cards in a multidimensional feature space. Each card is mapped to a five-dimensional feature vector, with each dimension corresponding to a quantized value of one of the aforementioned five features. The introduction of cosine similarity allows multiple features that were originally scattered, heterogeneous, and of different dimensions to be fused and calculated within a unified mathematical framework, resulting in a continuous and comparable similarity score within the interval [0, 1].

[0104] A feature vector is a multi-dimensional numerical array formed by numerically encoding the original attributes of a card, such as the card activation date, card number continuity, customer identifier, terminal type, and subscription package type. In this embodiment, each dimension of the feature vector is a normalized binary value or a continuous value. This mathematical representation of the vector allows the comparison of card attributes to move from a qualitative judgment based on whether enumerated features are equal to a quantitative calculation of the distance between vectors, providing a computational basis for the refined updating of graph edge weights.

[0105] Similarity-based undirected graphs are weighted graph structures derived from communication-related undirected graphs by updating the weights of each edge from the number of communications to the similarity between nodes. This graph retains all nodes and topological connections of the original communication-related undirected graph, but the semantics of the edge weights undergo a fundamental shift. The original weights represented the frequency of connections, while the updated weights represent the degree of attribute convergence. This transformation transforms the graph structure from a social network graph reflecting who has connected with whom to a risk-homogeneous graph reflecting who is more likely to belong to the same group.

[0106] The card opening date feature captures the time concentration of bulk card purchases by the group; the card number continuity feature captures the spatial proximity of the same batch of cards; the customer identification feature captures the multiple card holding relationships of the same controller; the terminal type feature captures the clustering of devices used for centralized card insertion and rotation; and the subscription package type feature captures the group's unified procurement and operation cost management behavior. These five features, from the five dimensions of time, space, ownership, equipment, and pricing, provide a comprehensive characterization of the correlation between the cards involved in the case. Any single feature may be a coincidence (such as different groups opening cards on the same day), but the probability of all five features converging simultaneously is extremely low, thus ensuring the high specificity of the similarity index in identifying genuine group members.

[0107] In real-world business scenarios, card feature vectors from different operators, regions, and time periods may exhibit systematic shifts. For example, the commonly used fraudulent terminal models in region A are completely different from those in region B. If Euclidean distance is used to calculate similarity, the similarity between genuine gang members in the two regions may actually be lower than the accidental similarity between non-gang members in the same region. Cosine similarity, by measuring the angle between vectors rather than the distance between vector endpoints, effectively eliminates the interference caused by the absolute numerical differences in feature vectors, enabling this method to generalize across regions and operators. Furthermore, the calculation result of cosine similarity naturally falls within the [-1, 1] interval, which can be mapped to the [0, 1] interval after taking the absolute value or normalization, seamlessly connecting with the threshold comparison operation in subsequent steps.

[0108] For any two nodes in an undirected graph with communication relationships, the graph computation module calculates cosine similarity based on their feature vectors. Cosine similarity assesses the degree of similarity by measuring the cosine of the angle between two vectors in the vector space, and the calculation formula is:

[0109] in, This represents the quantized value of card A on the i-th feature. The quantized value of card B on the i-th feature is represented by n, where n is the feature dimension, and in this embodiment, n=5. The calculated cosine similarity falls within the [0,1] interval (after normalization). The closer the value is to 1, the more similar the two cards are in terms of multi-dimensional attribute features. The graph calculation module updates the calculated similarity value into the weight of the corresponding edge in the communication relationship undirected graph, replacing the original communication frequency weight, thus forming a similarity undirected graph.

[0110] Figure 4 This is a schematic diagram of an undirected graph illustrating the similarity of cards involved in a case, provided as an exemplary embodiment of this application. For example... Figure 4 As shown, the figure is similar to Figure 3 They have the exact same set of nodes and topological connections, but the weight of each edge has been updated from the number of communications to the attribute similarity between the nodes. For example, the edge weight between node b and node j has been updated from 3 to 0.89, the edge weight between node b and node i has been updated from 4 to 0.94, and the edge weight between node b and node g has been updated from 2 to 0.60.

[0111] In a complete exemplary implementation, step 130 can be performed as follows: Receive the undirected graph G(V, E) representing the communication relationships from step 120. The current graph structure contains nodes V = {a, b, c, d, e, f, g, i, j}, edge set E, and corresponding initial weights (number of communications) as follows: Figure 3 As shown.

[0112] First, the feature quantization subprocess is initiated. For each node (i.e., each card) in Graph G, the system queries the operator's customer relationship management system, billing system, and terminal management system to obtain the original values ​​of the five features corresponding to that card: Taking node a as an example, suppose the following information is found: card opening date is July 15, 2024; card number is 13800138001; customer ID is CUST_9527; the terminal model used during the statistical period is IMEI_TAC_864392 (corresponding to a mid-to-low-end smartphone of a certain brand); and the subscription package type is PLAN_1099 (basic package with a monthly fee of 59 yuan).

[0113] Taking node b as an example, suppose the query results show: card opening date is July 15, 2024; card number is 13800138002; customer ID is CUST_9527; the terminal model used during the statistical period is also IMEI_TAC_864392; and the subscription package type is also PLAN_1099.

[0114] Taking node j as an example, suppose the following information is found: card opening date is August 1, 2024; card number is 13987654321; customer ID is CUST_3344; terminal model used during the statistical period is IMEI_TAC_521478 (another brand model); subscription package type is PLAN_2033 (monthly fee of 99 yuan unlimited package).

[0115] After traversing all nodes and completing feature acquisition, the feature encoding subprocess begins. For each pair of nodes with an edge, their original feature values ​​are converted into comparable vector components: For nodes a and b: the card opening date is the same, so the code is 1; the card numbers are consecutive (001 and 002), so the code is 1; the customer is the same (CUST_9527), so the code is 1; the terminal model is the same, so the code is 1; and the subscription package is the same, so the code is 1. Therefore, the feature vectors of nodes a and b are both [1, 1, 1, 1, 1]. The cosine similarity is calculated as (1×1+1×1+1×1+1×1+1×1) / (√5 × √5) = 5 / 5 = 1.0.

[0116] For nodes a and j: Different card activation dates (July 15th vs. August 1st), encoded as 0; non-consecutive card numbers, encoded as 0; different customer affiliations, encoded as 0; different terminal models, encoded as 0; different subscription packages, encoded as 0. The feature vectors are [1, 1, 1, 1, 1] and [0, 0, 0, 0, 0] respectively (Note: This is a simplified example; in actual encoding, the difference in activation dates needs to be normalized instead of simply 0 / 1), and the cosine similarity is 0.

[0117] For nodes b and g: Assume the query results are as follows—card activation date: b is July 15th, g is July 16th, the dates are close but not the same, the code is 0.8 (after normalization); the card numbers are not consecutive, the code is 0; the customers are different, the code is 0; the terminal models are the same, the code is 1; the subscription packages are the same, the code is 1. Then the feature vector of b is [1, 1, 1, 1, 1] (example), and the feature vector of g is [0.8, 0, 0, 1, 1], with a cosine similarity of approximately 0.63.

[0118] After calculating the similarity for all node pairs with edges, the system proceeds to the weight update subprocess. For each edge in graph G, the system updates the edge weight from the original communication count value to the calculated similarity value. After update: Edge ad: weight updated from 5 to 0.45 (example value); Edge ae: weight updated from 1 to 0.30 (example value); Edge bj: weight updated from 3 to 0.89 (example value); Edge bi: weight updated from 4 to 0.94 (example value); Edge bg: weight updated from 2 to 0.60 (example value); Edge cf: weight updated from 4 to 0.75 (example value); Edge cg: weight updated from 1 to 0.38 (example value); Edge de: weight updated from 1 to 0.55 (example value); Edge fg: weight updated from 2 to 0.68 (example value).

[0119] At this point, the original undirected graph G(V, E) representing communication relationships has been upgraded to an undirected graph G'(V, E) representing similarity. The two graphs have the exact same set of nodes and topological connections, but the semantics of edge weights have been completely transformed from communication frequency to attribute similarity.

[0120] Step 140: Based on the average similarity of all edges within each closed loop in the identified similarity undirected graph, determine the set of high-risk fraud-related cards.

[0121] In some exemplary embodiments, a closed loop refers to a ring-shaped structure in a similarity undirected graph consisting of at least three nodes and edges connecting these nodes.

[0122] Identifying closed cycles refers to traversing all possible circular paths in a similar undirected graph G'(V,E) to find all closed loops consisting of at least three nodes without duplicate nodes (except for overlapping beginnings and ends). This operation is a typical graph theory algorithm problem and can be implemented using depth-first search (DFS) or breadth-first search (BFS) combined with path backtracking. This application does not limit the specific cycle detection algorithm; any computer program capable of enumerating all simple cycles in an undirected graph is applicable. It is important to note that overlapping nodes may exist between different closed cycles—that is, the same card may belong to multiple closed cycles simultaneously. This overlap does exist in real-world criminal gangs: core members often form closed-loop relationships with multiple peripheral members simultaneously. Step 140 independently identifies and calculates all closed cycles, and overlapping nodes will be repeatedly counted in the average similarity calculation of multiple cycles.

[0123] In an undirected graph, an edge between two nodes can be considered a cycle of length 2 (A→B→A). If such a second-order cycle is also included in the category of closed cycles, any two cards with a direct communication relationship will be identified as a group, causing group identification algorithms to completely fail. This embodiment fundamentally eliminates this risk by explicitly limiting the number of nodes to at least three.

[0124] In some exemplary embodiments, a set of high-risk fraud-related cards is determined based on the average similarity of all edges within each closed loop in the identified similarity undirected graph, including: The average similarity of each closed loop is compared with a preset threshold. All card nodes contained in a closed loop with an average similarity greater than or equal to a preset threshold are identified as a preliminary set of high-risk fraud-related cards.

[0125] The average similarity calculation and threshold comparison involves summing the weights of all edges within each identified closed loop, dividing by the number of edges to obtain the average similarity of the loop, and then comparing this average similarity with a system-preset threshold X. If the average similarity is ≥ X, the closed loop is marked as a high-risk closed loop; if the average similarity is < X, the closed loop is determined to be non-high-risk and will not proceed to the next processing step.

[0126] In some exemplary embodiments, after determining the preliminary set of high-risk fraud-related cards, the method further includes: From the initial set of high-risk cards suspected of fraud, remove the cards that have been confirmed to be involved in the case, and mark the remaining card nodes as the final set of high-risk cards suspected of fraud.

[0127] From the initial set of high-risk fraud-related cards, confirmed cards involved in the case are removed, and the remaining card nodes are marked as the final set of high-risk fraud-related cards. Specifically, all node sets marked as high-risk closed loops are merged and deduplicated to obtain the initial set of high-risk fraud-related cards. Subsequently, confirmed cards involved in the case are removed from this set. The card nodes that are finally retained are the output result of this embodiment of the application—the final set of high-risk fraud-related cards. This achieves the full-scale mining of gang members from point to surface. A closed loop is regarded as a whole. As long as the average similarity of the loop meets the standard, all cards within the loop—whether known seed cards or newly mined related cards—are identified as members of the same high-risk gang.

[0128] In this embodiment, closed loops are used to simulate the internal communication structure of criminal gangs in real society: if a closed loop is formed between the case card and its associated cards in the graph, it indicates that these cards communicate with each other and are interconnected, demonstrating an organized structure. A third-order loop represents the smallest gang sample, corresponding to the basic criminological principle of three-person gangs; fourth-order and higher loops correspond to larger and more tightly organized criminal groups. The graph calculation module uses a depth-first search algorithm to traverse the similarity undirected graph, enumerating all simple loops consisting of at least three nodes. Figure 4 Taking the similarity undirected graph shown as an example, the identified closed cycles include: closed cycle P1: aceda, containing nodes a, c, e, d, with 4 edges; closed cycle P2: bijb, containing nodes b, i, j, with 3 edges; closed cycle P3: bghb, containing nodes b, g, h, with 3 edges; closed cycle P4: cfgc, containing nodes c, f, g, with 3 edges.

[0129] For each identified closed loop, the graph calculation module calculates the average similarity of the closed loop by dividing the sum of the weights of all edges within the loop by the number of edges. The calculation formula is as follows:

[0130] Where P represents a closed loop, N is the number of edges contained in the closed loop, and Ws is the weight of the s-th edge (i.e., the similarity between nodes). Taking the closed loop P2(bij) as an example, the weight of edge bi inside the loop is 0.94, the weight of edge ij is 0.60, the weight of edge jb is 0.89, and the average similarity is (0.94 + 0.60 + 0.89) / 3 = 0.81.

[0131] The average similarity calculation results for each closed loop by the graph calculation module are shown in Table 7. Table 7. Average similarity of closed loops in this region

[0132] The fraud-related card prediction module reads the average similarity of each closed loop and compares it with the preset threshold X. In the embodiments of the present application, the preset threshold X is set to 0.8. This value is an empirically optimal value derived from retrospective statistical analysis of a large number of solved telecom fraud cases, which achieves the best balance between recognition recall rate and false alarm rate.

[0133] The determination rules are as follows: If the average similarity of the closed loop is greater than or equal to X, it is determined that the closed loop corresponds to a high-risk fraud gang organization, and all card nodes included in the closed loop are included in the preliminary high-risk fraud-related card set; If the average similarity of the closed loop is less than X, it is determined that the similarity of the card nodes in the closed loop is low, and no processing is performed for the time being.

[0134] Figure 5 This is a schematic diagram of pre-risk prediction for suspected fraud-related cards in the case information processing method provided by the exemplary embodiment of the present application. As Figure 5 shown, after calculating the average similarity of the closed loop in the corresponding area, the threshold comparison branch is executed: if the average similarity is greater than or equal to the threshold, the determination path of "suspected high-risk fraud-related card" is entered, and the cards requiring key supervision are output; if the average similarity is less than the threshold, the determination path of "non-suspected fraud-related card" is entered, and no disposal is performed for the time being.

[0135] According to the average similarity calculation results in Table 7, the closed loop a-c-e-d (0.8575) and the closed loop b-i-j (0.81) are both greater than or equal to the threshold of 0.8, and are determined as high-risk closed loops; the closed loop b-g-h (0.53) and the closed loop c-f-g (0.68) are less than the threshold of 0.8, and are not processed for the time being.

[0136] The fraud-related card prediction module merges and deduplicates all card nodes included in the two high-risk closed loops to obtain the preliminary high-risk fraud-related card set S_pre = {a, b, c, d, e, i, j}. Subsequently, the confirmed case-related card set D = {a, b, c} input in step 110 is removed from the preliminary high-risk fraud-related card set, and the final high-risk fraud-related card set S_final = {d, e, i, j} is obtained.

[0137] Each card in this set satisfies the following three conditions: Condition 1: Highly aggregated with the confirmed case-related cards of this batch in terms of spatiotemporal behavior (derived from the screening in step 110); Condition 2: Having a direct association with the confirmed case-related cards of this batch in terms of communication relationship (derived from the graph construction in step 120); Condition 3: Highly convergent with other cards in the closed loop in terms of multi-dimensional attribute features (derived from the similarity calculation in step 130 and the threshold determination in step 140).

[0138] Cards d, e, i, and j in the final set of high-risk fraud-related cards are marked as suspected high-risk fraud-related cards and output to the anti-fraud early warning platform or risk control system for key monitoring and handling. These cards are potential cards involved in cases that have not yet been reported by relevant authorities but are highly likely to belong to the same criminal gang. This achieves the technical goal of proactively identifying potential high-risk gang cards that are highly clustered in time and space, closely linked in communication networks, and highly similar in attribute characteristics, starting from a small number of known cards involved in cases.

[0139] Figure 6 The platform business process diagram in the case-related information processing method provided for the exemplary embodiment of this application fully presents the entire business process from data entry to risk output: the account manager enters the case-related card information reported by relevant departments into the system through the information entry module, and the data is stored in the data storage module; the platform connects to the operator's business support system to obtain RADIUS billing message data and business card opening system data; the spatiotemporal processing module performs spatiotemporal feature extraction and hotspot analysis on the case-related card usage data to screen out case-related cards with spatiotemporal aggregation; the graph calculation module constructs an undirected graph of communication relationships based on communication signaling data, calculates the similarity between nodes and updates the weights to form a similarity undirected graph, and then identifies closed loops and calculates the average similarity; the fraud-related card prediction module compares the average similarity of the closed loop with a preset threshold, determines high-risk fraud gangs, excludes confirmed case-related cards, and outputs a list of suspected high-risk fraud-related cards.

[0140] The case information processing method provided in this application firstly analyzes the spatiotemporal hotspots based on the usage data of confirmed case-related cards, filtering out cards that exhibit clustered or hotspot-like distributions in time and space to form a spatiotemporally clustered card set. Then, based on this set and communication signaling data, an undirected graph of communication relationships containing directly associated cards is constructed, and the similarity between nodes in the graph is calculated to update the edge weights, forming a similarity undirected graph that simultaneously reflects communication connections and attribute similarity. Next, closed cycles in the graph are identified, and the average similarity of each cycle is calculated. Finally, a high-risk fraud-related card set is locked down based on the average similarity threshold. Thus, starting from a small number of known case-related cards, the method proactively identifies potential high-risk gang cards that are highly clustered in spatiotemporal behavior, closely associated on communication networks, and highly similar in attribute characteristics. By combining spatiotemporal analysis, graph computation, and similarity quantification, the organization and behavior patterns of real-world criminal gangs are effectively simulated. This enables precise early warning and proactive crackdown on criminal networks before fraudulent activities are carried out and actual harm occurs. It solves the problems of passivity, lag, and fragmentation in existing technologies, and significantly improves the timeliness, accuracy, and systematic nature of fraud risk monitoring.

[0141] Figure 8 This is a schematic diagram of the structure of an information processing device 800 provided in an exemplary embodiment of this application. Figure 8As shown, the information processing device 800 involved in the case includes: an acquisition module 810, a construction module 820, an update module 830, and a determination module 840, wherein: The acquisition module 810 is used to acquire the usage data of the confirmed case-related cards within a preset time range corresponding to the time point of the case based on the case-related information of the confirmed case-related cards, and to filter out the case-related cards that are clustered or hotspot-type in time and space from the confirmed case-related cards based on the usage data through the spatiotemporal hotspot analysis method, thereby forming a spatiotemporally clustered case-related card set. The construction module 820 is used to construct an undirected graph of communication relationships based on the spatiotemporally aggregated set of cards involved in the case and the communication signaling data. The nodes in the undirected graph of communication relationships include all the cards in the spatiotemporally aggregated set of cards involved in the case and other cards that have had direct communication with them. The edges in the undirected graph of communication relationships represent direct communication between nodes. The update module 830 is used to update the weights of corresponding edges in the undirected graph of communication relationships based on the similarity between any two connected nodes in the undirected graph of communication relationships, thereby forming a similarity undirected graph; The determination module 840 is used to determine a set of high-risk fraud-related cards based on the average similarity of all edges within each closed loop in the identified similarity undirected graph.

[0142] Using the case-related information processing device 800 provided in this application embodiment, firstly, spatiotemporal hotspot analysis is performed based on the usage data of confirmed case-related cards to filter out cards that exhibit clustered or hotspot-like distributions in time and space, forming a spatiotemporally clustered card set; then, based on this set and communication signaling data, an undirected graph of communication relationships containing cards with direct communication associations is constructed, and the similarity between nodes in the graph is calculated to update the edge weights, forming a similarity undirected graph that can simultaneously reflect communication connections and attribute similarity; furthermore, closed cycles in the graph are identified and the average similarity of each cycle is calculated; finally, a high-risk fraud-related card set is locked based on the average similarity threshold. Thus, starting from a small number of known case-related cards, potential high-risk gang cards that are highly clustered in spatiotemporal behavior, closely associated on communication networks, and highly similar in attribute characteristics are proactively identified. By combining spatiotemporal analysis, graph computation, and similarity quantification, the organization and behavior patterns of real-world criminal gangs are effectively simulated. This enables precise early warning and proactive crackdown on criminal networks before fraudulent activities are carried out and actual harm occurs. It solves the problems of passivity, lag, and fragmentation in existing technologies, and significantly improves the timeliness, accuracy, and systematic nature of fraud risk monitoring.

[0143] Optionally, the acquisition module 810 is specifically used for: Obtain billing message data from the operator's system within a preset time range corresponding to the time point in question; From the billing message data, data records whose usage location information matches the geographical location of the case in the case information are selected as the usage data.

[0144] Optionally, the acquisition module 810 is specifically used for: Spatiotemporal features are extracted from the data to obtain the time period label and geographic region code for each data point; Based on the time period labels and the geographical region codes, the degree of clustering of the cards involved in the case within the spatial region is analyzed using the kernel density estimation method; Based on the degree of aggregation, the spatiotemporal distribution types of the cards involved in the case are classified into discrete, clustered, and hotspot types; Select cards involved in the case that are clustered or hotspot-type in distribution.

[0145] Optionally, the time period label is obtained by dividing a day into work periods, entertainment periods, and rest periods; the geographic region code is generated using the GeoHash algorithm.

[0146] Optionally, the update module 830 is specifically used for: The similarity is calculated based on one or more of the following features of the corresponding cards of any two connected nodes in the undirected graph of the communication relationship: card opening date, card number continuity, customer identifier, terminal type, and subscription package type. The calculated similarity value is used as the weight of the corresponding edge in the undirected graph of the communication relationship.

[0147] Optionally, the closed loop refers to a ring-shaped structure in the similarity undirected graph consisting of at least three nodes and the edges connecting these nodes.

[0148] Optionally, the determining module 840 is specifically used for: The average similarity of each closed loop is compared with a preset threshold. All card nodes contained in a closed loop with an average similarity greater than or equal to the preset threshold are identified as a preliminary set of high-risk fraud-related cards.

[0149] Optionally, after determining the preliminary set of high-risk fraud-related cards, the device further includes a removal module for: Remove the confirmed cards involved in the case from the preliminary high-risk fraud card set, and mark the remaining card nodes as the final high-risk fraud card set.

[0150] The case-related information processing device 800 is capable of achieving Figure 1 For details of the method implementation examples, please refer to [link / reference]. Figures 1-7 The method for processing multiple case-related information in the illustrated embodiment will not be described in detail here.

[0151] Figure 9 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. For example... Figure 9 As shown, the device includes a memory 91 and a processor 92.

[0152] Memory 91 is used to store computer programs and can be configured to store various other data to support operation on the computing device. Examples of this data include instructions for any application or method operating on the computing device, contact data, phone book data, messages, images, videos, etc.

[0153] Processor 92, coupled to memory 91, is used to execute computer programs in memory 91 for: obtaining usage data of the confirmed involved cards within a preset time range corresponding to the time of the incident, based on the case-related information of the confirmed involved cards; and using a spatiotemporal hotspot analysis method to filter out involved cards that exhibit a clustered or hotspot-like distribution in time and space from the confirmed involved cards based on the usage data, forming a spatiotemporally clustered involved card set; constructing an undirected graph of communication relationships based on the spatiotemporally clustered involved card set and communication signaling data, wherein the nodes in the undirected graph of communication relationships include all cards in the spatiotemporally clustered involved card set and other cards that have had direct communication with them, and the edges in the undirected graph of communication relationships represent direct communication between nodes; updating the weights of corresponding edges in the undirected graph of communication relationships based on the similarity between any two connected nodes, forming a similarity undirected graph; and determining a set of high-risk fraud-related cards based on the average similarity of all edges within each closed loop in the identified similarity undirected graph.

[0154] The electronic device provided in this application first performs spatiotemporal hotspot analysis based on the usage data of confirmed cards involved in cases, filtering out cards that exhibit clustered or hotspot-like distributions in time and space, forming a spatiotemporally clustered card set. Then, based on this set and communication signaling data, it constructs an undirected graph of communication relationships containing cards with direct communication associations, and calculates the similarity between nodes in the graph to update edge weights, forming a similarity undirected graph that simultaneously reflects communication connections and attribute similarity. Next, it identifies closed cycles in the graph and calculates the average similarity of each cycle. Finally, it locks down a set of high-risk fraud-related cards based on the average similarity threshold. Thus, it achieves the proactive discovery of potential high-risk gang cards that are highly clustered in spatiotemporal behavior, closely associated with each other on the communication network, and highly similar in attribute characteristics, starting from a small number of known cards involved in cases. By combining spatiotemporal analysis, graph computation, and similarity quantification, the organization and behavior patterns of real-world criminal gangs are effectively simulated. This enables precise early warning and proactive crackdown on criminal networks before fraudulent activities are carried out and actual harm occurs. It solves the problems of passivity, lag, and fragmentation in existing technologies, and significantly improves the timeliness, accuracy, and systematic nature of fraud risk monitoring.

[0155] Furthermore, such as Figure 9 As shown, the electronic device also includes other components such as a communication component 93, a display 94, a power supply component 95, and an audio component 96. Figure 9 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 9 The components shown. Additionally, depending on the implementation of the traffic playback device, Figure 9 The components within the dashed box are optional, not mandatory. For example, when an electronic device is implemented as a terminal device such as a smartphone, tablet, or desktop computer, it may include... Figure 9 The components within the dashed box; when the electronic device is implemented as a server-side device such as a conventional server, cloud server, data center, or server array, it may be excluded. Figure 9 The component within the dashed box.

[0156] The above Figure 9 The communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as WiFi, 2G, or 9G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component may further include a Near Field Communication (NFC) module, Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, etc.

[0157] The above Figure 9 The memory in the memory can be implemented by any class of volatile or non-volatile storage devices or combinations thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0158] The above Figure 9 The display includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of the touch or swipe action, but also the duration and pressure associated with the touch or swipe operation.

[0159] The above Figure 9The power supply component provides power to the various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0160] The above Figure 9 The audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0161] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the above-described method embodiments.

[0162] Accordingly, this application also provides a computer program product, which stores instructions that, when executed by a computer, cause the computer to perform the steps in the method embodiments provided in this application.

[0163] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0164] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0165] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0166] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0167] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0168] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0169] It should be understood that the training and prediction processes of the AI ​​models involved in the various embodiments of this specification all adhere to multiple legal and compliant principles, including legal data sources, compliant data content, compliant data governance, compliant training objectives and schemes, compliant training processes, compliant training environments and tools, and compliant ethical verification of training results, and comply with the requirements of Article 5 of the Patent Law. Among them: Data Source Legality: All datasets used for AI model training were obtained through legal channels, covering three categories: publicly authorized data, data authorized by partners, and self-collected compliant data. Publicly authorized data originates from compliant data sources following open-source licenses such as Apache 2.0, with complete copyright attribution and authorization scope clearly marked, and no unauthorized open-source code or data reuse. Data authorized by partners has been subject to formal data usage agreements, clearly defining the scope, duration, and confidentiality obligations, and possessing a complete authorization chain. For self-collected data involving personal information, strict informed consent procedures have been followed, and anonymization processes (including but not limited to field masking, feature anonymization, and differential privacy technology applications) have been implemented to remove personally identifiable information, fully complying with the requirements of the "Interim Measures for the Administration of Generative Artificial Intelligence Services," the "Personal Information Protection Law," and other relevant laws and regulations.

[0170] Data Content Compliance: The AI ​​model's dataset undergoes multiple screening and cleaning processes to remove all content that may violate social morality or harm public interests. It contains no information that endangers national or public safety, nor does it involve the illegal acquisition or use of genetic resources. For data in sensitive areas (such as healthcare and finance), an additional privacy-preserving computation module (including federated learning and secure multi-party computation technologies) ensures that the data is "usable but not visible," avoiding compliance risks during the original data transmission process and ensuring that the data application scenarios and uses comply with public order and good morals and industry regulatory requirements.

[0171] Data governance compliance: A complete data traceability system is established during the AI ​​model training process to automatically record the source, collection time, annotation process, cleaning rules, and permission allocation of training data, generating traceable compliance reports to ensure that the data is verifiable throughout its entire lifecycle. The dataset annotation process for AI models is completed by a professional human R&D team, clearly defining the proportion of human creative contributions, avoiding reliance on AI-generated data that has not undergone substantial human modification, and complying with the examination requirements for "human main contributions" in AI patent applications.

[0172] Training objectives and compliance: The AI ​​model training objective focuses on building a multimodal correlation analysis model that can accurately identify potentially high-risk fraudulent cards and their criminal organizations. The training scheme and the final output results do not violate any mandatory provisions of laws and administrative regulations, do not harm the public interest or the legitimate rights and interests of others, and do not pose any potential risks of being used for illegal activities, privacy violations, or public safety violations. The training scheme and the final output results strictly adhere to the ethical principle of "intelligent for good".

[0173] Compliance of the training process: A closed-loop training framework is adopted to ensure compliance and controllability of the training process. The specific process is as follows: First, training samples are obtained through compliant data sources. After the aforementioned data cleaning and desensitization, they are input into the neural network model to generate preliminary training results. Second, an expert system is introduced to verify the preliminary results. Based on preset rules and human expert experience, the feasibility of the results is evaluated, and outputs that may pose ethical risks or compliance hazards are corrected (such as removing decision logic that violates public order and good morals, and adjusting model parameters that do not comply with safety regulations). Finally, the loss function weights are dynamically optimized based on the feedback from the expert system to strengthen the model's learning of compliant results, avoid overfitting errors or non-compliant labels, and form a closed-loop control of "data input - model training - expert verification - parameter optimization - result feedback" to ensure that the entire training process complies with A5 ethical review requirements.

[0174] Training Environment and Tools Compliance: AI model training is implemented based on nationally licensed chips and a compliant training platform. All open-source frameworks and components used in the training process have obtained their corresponding licenses, and copyright statements and patent citation information are fully retained, with no instances of infringement or reuse. The training environment is constructed using virtual devices (containers / virtual machines) with fixed random seeds and initial parameter configurations to ensure the reproducibility of the training process. Furthermore, through access control and operation log recording, risks such as data leakage and parameter tampering during training are prevented, ensuring the security and compliance of the training process.

[0175] Training results ethical verification and compliance: After the model is trained, it undergoes additional third-party ethical compliance assessment and algorithm filing review to verify that the model output does not violate social morality or harm public interests. For potentially sensitive scenarios (such as public services and intelligent decision-making), a special result verification mechanism is established to ensure that the model always complies with Article 5 of the Patent Law and relevant laws and regulations in practical applications.

[0176] In summary, the data and training process used in the AI ​​model of this specification strictly comply with the relevant provisions of Article 5 of the Patent Law and the Patent Examination Guidelines (2023 Edition), and there are no violations of laws, social ethics, public interests, or illegal use of genetic resources. It fully meets the compliance requirements for patent authorization.

[0177] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for processing case-related information, characterized in that, include: Based on the case-related information of the confirmed case-related cards, the usage data of the confirmed case-related cards within a preset time range corresponding to the case-related time point is obtained. Based on the usage data, the case-related cards that are clustered or hotspot-shaped in time and space are selected from the confirmed case-related cards by the spatiotemporal hotspot analysis method to form a spatiotemporally clustered case-related card set. Based on the spatiotemporally aggregated set of cards involved in the case and the communication signaling data, an undirected graph of communication relationships is constructed. The nodes in the undirected graph of communication relationships include all the cards in the spatiotemporally aggregated set of cards involved in the case and other cards that have had direct communication with them. The edges in the undirected graph of communication relationships represent direct communication between nodes. Based on the similarity between any two connected nodes in the undirected graph of communication relationships, the weights of the corresponding edges in the undirected graph of communication relationships are updated to form a similarity undirected graph; Based on the average similarity of all edges within each closed loop in the identified similarity undirected graph, a set of high-risk fraud-related cards is determined.

2. The method as described in claim 1, characterized in that, The step of obtaining usage data of the confirmed card involved in the case within a preset time range corresponding to the time point in the case includes: Obtain billing message data from the operator's system within a preset time range corresponding to the time point in question; From the billing message data, data records whose usage location information matches the geographical location of the case in the case information are selected as the usage data.

3. The method as described in claim 1, characterized in that, The method of using spatiotemporal hotspot analysis to filter out cards from the confirmed case-related cards that exhibit clustered or hotspot-like distributions in time and space based on the usage data includes: Spatiotemporal features are extracted from the data to obtain the time period label and geographic region code for each data point; Based on the time period labels and the geographical region codes, the degree of clustering of the cards involved in the case within the spatial region is analyzed using the kernel density estimation method; Based on the degree of aggregation, the spatiotemporal distribution types of the cards involved in the case are classified into discrete, clustered, and hotspot types; Select cards involved in the case that are clustered or hotspot-type in distribution.

4. The method as described in claim 3, characterized in that, The time period label is obtained by dividing a day into work periods, entertainment periods, and rest periods; the geographical region code is generated using the GeoHash algorithm.

5. The method as described in claim 1, characterized in that, The step of updating the weights of corresponding edges in the undirected graph of communication relationships based on the similarity between any two connected nodes includes: The similarity is calculated based on one or more of the following features of the corresponding cards of any two connected nodes in the undirected graph of the communication relationship: card opening date, card number continuity, customer identifier, terminal type, and subscription package type. The calculated similarity value is used as the weight of the corresponding edge in the undirected graph of the communication relationship.

6. The method as described in claim 1, characterized in that, The closed loop refers to a ring-shaped structure in the similarity undirected graph consisting of at least three nodes and the edges connecting these nodes.

7. The method as described in claim 1, characterized in that, The process of determining a set of high-risk fraud-related cards based on the average similarity of all edges within each closed loop in the identified similarity undirected graph includes: The average similarity of each closed loop is compared with a preset threshold. All card nodes contained in a closed loop with an average similarity greater than or equal to the preset threshold are identified as a preliminary set of high-risk fraud-related cards.

8. The method as described in claim 7, characterized in that, After determining the initial set of high-risk fraud-related cards, the method further includes: Remove the confirmed cards involved in the case from the preliminary high-risk fraud card set, and mark the remaining card nodes as the final high-risk fraud card set.

9. A device for processing case-related information, characterized in that, include: The acquisition module is used to acquire the usage data of the confirmed case-related cards within a preset time range corresponding to the time point of the case based on the case-related information of the confirmed case-related cards, and to filter out the case-related cards that are clustered or hotspot-shaped in time and space from the confirmed case-related cards based on the usage data through the spatiotemporal hotspot analysis method, thereby forming a spatiotemporally clustered case-related card set. The construction module is used to construct an undirected graph of communication relationships based on the spatiotemporally aggregated set of cards involved in the case and the communication signaling data. The nodes in the undirected graph of communication relationships include all cards in the spatiotemporally aggregated set of cards involved in the case and other cards that have had direct communication with them. The edges in the undirected graph of communication relationships represent direct communication between nodes. The update module is used to update the weights of corresponding edges in the undirected graph of communication relationships based on the similarity between any two connected nodes in the undirected graph of communication relationships, thereby forming a similarity undirected graph; The determination module is used to determine the set of high-risk fraud-related cards based on the average similarity of all edges within each closed loop in the identified similarity undirected graph.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, Includes a computer program / instruction that is executed by a processor as the steps of the method as described in any one of claims 1 to 8.

Images