A method and system for anti-fraud defense based on lightweight voice semantic representation

Abstract

The application discloses a kind of anti-fraud defense methods and systems based on light weight voice semantic representation.The system includes voice acquisition module, audio preprocessing module, speech recognition module, rule engine submodule, BERT semantic classification submodule, result display module and data storage module.Voice data is converted into text string after being collected, preprocessed and speech recognized, and the rule engine submodule performs keyword matching on the text string, calculates the standard initial screening score, and then performs shunt control, directly outputs the judgment result when in the determination area, when in the fuzzy area, it is sent into BERT semantic classification submodule for semantic classification and outputs fraud probability, the result display module shows the judgment result or fraud probability, and the data storage module stores detection records.The application forms a double-track cascaded collaborative architecture by rule engine and BERT semantic classification submodule, improves the real-time performance and privacy security of voice anti-fraud in the limited computing power environment.

Description

Technical Field

[0001] This invention belongs to the field of speech semantic analysis and network information security technology, specifically relating to an anti-fraud defense method and system based on lightweight speech semantic representation. Background Technology

[0002] With the continuous upgrading of telecommunications network fraud methods, voice call-based fraud is showing a trend of high concealment, professionalized scripts, and diverse variations, posing a serious threat to personal privacy and property security. Traditional harassment call blocking and anti-fraud defense technologies mainly rely on methods such as number tagging, blacklist database matching, and simple keyword filtering, which are insufficient to combat advanced fraud techniques such as deep semantic spoofing, homophonic substitution, and leading dialogue. In recent years, deep semantic understanding technology based on artificial intelligence has been gradually introduced into the field of voice anti-fraud. By deeply analyzing the semantic content of the call, it identifies potential fraudulent intentions, significantly improving the intelligence level of detection.

[0003] Existing technologies mainly include the following three methods: The first is the pure rule or keyword matching method. This method deploys a keyword library on the device side, performs substring matching on the transcribed text, and uses efficient string matching algorithms such as the AC automaton to achieve fast filtering. This method has extremely low computational overhead, and the response time is usually within milliseconds. However, it relies solely on word list hit decisions and cannot capture word order, context, and implicit semantic information. It has almost no ability to identify variant fraud techniques such as homophonic substitution, slang disguise, and leading expressions.

[0004] The second approach is asynchronous processing via cloud collaboration. This method only completes audio acquisition and uploading on the client side, transmitting the speech stream or transcribed text over the network to a cloud-based inference platform. Semantic understanding and risk assessment are then performed using a large-scale pre-trained language model. While this method leverages the capabilities of cloud-based models, the entire dataset must be transmitted over the network, making it sensitive to bandwidth and latency. In weak network environments, this can easily lead to service unavailability. Furthermore, user call content is outside the client-side control, posing a security and compliance risk of data leakage.

[0005] The third approach is the deployment of a single lightweight model on the edge. This method involves structural pruning, parameter sharing, or knowledge distillation of a large pre-trained model, and then directly deploying a miniaturized classification network (such as a miniature CNN, RNN, or lightweight Transformer) on the edge for text classification. However, the expressive power of a single lightweight model is limited, and it lacks multi-level calibration mechanisms at ambiguous decision boundaries. When faced with atypical fraudulent samples or boundary samples mixed with everyday speech, the classification confidence often concentrates in the gray area, making reliable decision-making difficult.

[0006] Therefore, there is an urgent need to propose an anti-fraud defense method and system based on lightweight speech semantic representation to address the shortcomings of the existing technologies. Summary of the Invention

[0007] To address the challenges of balancing real-time performance and semantic understanding in existing technologies, the privacy and network risks associated with cloud processing, and the high misjudgment rate of boundary samples, this invention provides an anti-fraud defense method and system based on lightweight speech semantic representation. Through a dual-track cascaded collaborative architecture consisting of a rule engine and a BERT semantic classification submodule, it enables rapid direct judgment of deterministic samples and on-demand activation of deep models for precise judgment of boundary samples. This ensures millisecond-level real-time response on the device side while achieving accurate identification of concealed fraudulent statements. Furthermore, by operating in a closed-loop local loop across the entire chain, it fundamentally eliminates the risk of data privacy leakage and significantly improves the overall performance of speech anti-fraud in environments with limited computing power on the device side.

[0008] The technical solution of the present invention is implemented as follows: an anti-fraud defense system based on lightweight speech semantic representation, including a speech acquisition module, an audio preprocessing module, a speech recognition module, a hybrid detection module entry, a rule engine sub-module, a BERT semantic classification sub-module, a result display module, and a data storage module; The voice acquisition module is connected to the audio preprocessing module, the audio preprocessing module is connected to the speech recognition module, the speech recognition module is connected to the entry point of the hybrid detection module, and the entry point of the hybrid detection module is connected to the rule engine submodule; the rule engine submodule includes a first output terminal and a second output terminal, the first output terminal is connected to the result display module, and the second output terminal is connected to the BERT semantic classification submodule; the BERT semantic classification submodule is connected to the result display module. The audio preprocessing module is used to standardize the raw speech data and output a standardized audio stream; The speech recognition module is used to convert the standardized audio stream into a text string; The rule engine submodule is used to perform keyword matching on the text string and calculate the standard initial screening score, and output the judgment result to the result display module through the first output terminal according to the standard initial screening score, or send the text string to the BERT semantic classification submodule through the second output terminal; The BERT semantic classification submodule is used to perform semantic classification on the text string and output the fraud probability to the result display module.

[0009] This invention constructs a dual-track cascaded architecture consisting of a rule engine submodule and a BERT semantic classification submodule. The rule engine submodule performs keyword matching on text strings and calculates a standard initial screening score. Based on the standard initial screening score, it performs traffic control, ensuring that only text that the rule engine cannot directly judge triggers the BERT semantic classification submodule for deep semantic classification, effectively reducing the computational load of edge-side inference. At the same time, the rule engine submodule directly connects to the result display module to achieve millisecond-level response, and the BERT semantic classification submodule receives text through a second output terminal and outputs the fraud probability, realizing deep semantic recognition of spoofed statements. This solves the technical problem of balancing real-time performance and detection accuracy under limited edge-side computing power.

[0010] As a further improvement to the above solution, the result display module is also connected to the history record module, the data visualization module, and the risk report module respectively; the history record module is used to filter, paginate, and export the detection records, the data visualization module is used to display risk control statistics, and the risk report module is used to generate and output a security audit report.

[0011] By setting up a history record module, a data visualization module, and a risk report module that are respectively connected to the results display module, the system can filter and export detection records, display risk control data in charts, and automatically generate security audit reports, thus expanding the system's data management and visualization output capabilities.

[0012] As a further improvement to the above solution, a data management module and a data analysis module are also included; the historical record module is connected to the data management module and the data analysis module respectively; the data management module and the data analysis module are connected to the data storage module respectively; the data management module is used to add, delete, modify, query and archive the detection records, and the data analysis module is used to perform statistical calculations on the stored data and push the statistical results to the data visualization module.

[0013] By setting up a data management module and a data analysis module that are connected to the historical record module and the data storage module respectively, the system realizes the addition, deletion, modification, query, archiving, migration and statistical calculation of detection records, and pushes the statistical results to the data visualization module, enabling the system to have the ability to manage and statistically analyze historical risk control data in the background.

[0014] A fraud prevention method based on lightweight speech semantic representation, characterized in that it is applied to the system described above, and characterized in that it includes the following steps: S1. Voice capture and preprocessing: Raw voice data is acquired through the voice acquisition module, and the raw voice data is standardized through the audio preprocessing module to output a standardized audio stream; S2. Speech-to-text conversion: The standardized audio stream is converted into a text string using a speech recognition module; S3. Rule Engine Initial Screening and Confidence Calculation: The rule engine submodule performs keyword matching on the text string, weights and accumulates the matched keywords, and performs negative feedback deduction in combination with the safety word library to calculate the basic confidence. Then, the basic confidence is normalized and corrected by the non-linear length smoothing operator to obtain the standard initial screening score. S4. Triage Control: Perform triage control based on the initial screening score: directly output the judgment result or send the text string to the BERT semantic classification submodule; S5. Deep semantic precision judgment: When the text string is sent to the BERT semantic classification submodule, the BERT semantic classification submodule performs deep semantic classification on the text string, outputs the fraud probability, compares the fraud probability with a preset threshold, and outputs the deep judgment result. S6. Defense Result Fusion and Active Blocking: The judgment result or the deep judgment result is fused to generate a unified defense package. When the judgment result is fraudulent, a local active blocking action is triggered. S7. Result Display and Storage: The judgment result or the deep judgment result is displayed through the result display module, and the detection record is stored through the data storage module.

[0015] By using a rule engine to perform keyword matching on text strings and calculate a standard initial screening score, and then implementing traffic control based on the standard initial screening score, deep semantic classification is only triggered on texts that are diverted to the BERT semantic classification submodule. This avoids performing deep model inference on all texts under the limited computing power of the edge, and achieves accurate identification of hidden fraudulent intentions while ensuring the real-time response capability of the system. Furthermore, by fusing the judgment results or deep judgment results to generate a unified defense package, local active blocking is triggered when fraud is detected, which effectively improves the real-time performance and detection accuracy of edge voice anti-fraud.

[0016] As a further improvement to the above scheme, the standard initial screening score is calculated as follows: ; Where L represents the total character length of the currently input transcribed Chinese text string. This represents the base confidence level of the text after initial screening by the rule engine. This is an adaptive, non-linear, dynamic scaling factor for text length.

[0017] By setting a standard initial screening score calculation method, the standard initial screening scores of long and short texts have a unified judgment benchmark, eliminating the statistical bias of long text base and effectively reducing the false alarm rate in long call scenarios.

[0018] As a further improvement to the above scheme, the basic confidence level is calculated as follows: ; Where M represents the total number of pre-defined fraud keyword categories in the system. This represents the absolute frequency count of the i-th type of fraudulent keyword actually hit in the time-domain transcribed Chinese standardized text string. This represents the specific static weight score corresponding to the i-th type of fraudulent keyword. α is the system's preset safety word weighting correction coefficient, which determines the frequency of the actual hits in the safety word library used for preventing misjudgment in the transcribed text.

[0019] By setting a method for calculating the basic confidence level, the confidence level can distinguish the risk intensity of different fraudulent terms and suppress the interference of safe terms, thereby improving the accuracy of confidence level calculation.

[0020] As a further improvement to the above scheme, the current splitting control is specifically as follows: Gradient scheduling is performed based on the interval in which the standard initial screening score falls: when the standard initial screening score reaches or exceeds a first preset threshold, the standard initial screening score is in a high-risk determination zone, and an interception decision is directly output; when the standard initial screening score is lower than or equal to a second preset threshold, the standard initial screening score is in a safe determination zone, and a release decision is directly output; when the standard initial screening score is between the second preset threshold and the first preset threshold, the standard initial screening score is in a boundary ambiguity zone, and the text string is sent to the BERT semantic classification submodule for deep semantic classification.

[0021] By performing three-segment gradient scheduling based on the interval of the standard initial screening score, the high-risk defined area, the safe defined area, and the ambiguous boundary area correspond to three different processing strategies: interception, release, and sending to BERT, respectively. This achieves accurate text splitting and reduces invalid deep model calls.

[0022] As a further improvement to the above solution, the standardization process specifically includes: The short-time energy and zero-crossing rate are calculated using a speech activity detection algorithm to identify and remove silent segments and breathing sounds from the original speech data.

[0023] By using a speech activity detection algorithm to calculate short-time energy and zero-crossing rate, silent segments and breathing sounds are identified and removed, reducing the amount of invalid audio data and lowering the computational overhead of subsequent modules.

[0024] As a further improvement to the above solution, the data storage module uses hash encryption to encrypt the user's sensitive account identifier before storing it.

[0025] By using hash encryption to encrypt and store sensitive user account identifiers, the storage of sensitive user information in plaintext is avoided, thus improving the security of data storage.

[0026] As a further improvement to the above solution, the rule engine submodule uses a string matching algorithm to perform keyword matching.

[0027] By employing a string matching algorithm for keyword matching, the rule engine submodule can quickly and accurately hit fraudulent keywords in text strings, ensuring processing efficiency in the initial screening stage.

[0028] Compared with traditional processing methods, the present invention has the following advantages: (1) By constructing a dual-track cascaded collaborative control architecture of the rule engine submodule and the BERT semantic classification submodule, the rule engine submodule performs keyword matching on the text string and calculates the standard initial screening score. Based on the standard initial screening score, the judgment result is directly output through the first output end or the text is sent to the BERT semantic classification submodule for deep semantic classification through the second output end. This ensures that only boundary samples that the rule engine cannot directly judge trigger the deep semantic model, avoiding the computational overhead of performing deep model inference on all texts under the limited computing power of the edge. While ensuring real-time response, it achieves accurate identification of hidden fraudulent intent.

[0029] (2) By setting a nonlinear length smoothing operator to normalize and correct the basic confidence score, a standard initial screening score is obtained, so that the standard initial screening scores of long and short texts have a unified judgment benchmark, eliminating the statistical bias caused by the large number of characters in long texts; at the same time, negative feedback deduction is carried out in combination with the security word library, and the risk score is corrected by using daily negative words, which effectively reduces the false alarm rate in daily long call scenarios.

[0030] (3) The voice acquisition module, audio preprocessing module, voice recognition module, rule engine sub-module, BERT semantic classification sub-module, result display module and data storage module are all deployed and run on the local end side. The entire chain from voice capture, voice transcription, mixed judgment to detection record storage is executed in a closed loop on the end side without relying on external networks, which fundamentally avoids the privacy leakage risk caused by uploading user call data to the cloud. Attached Figure Description

[0031] Figure 1 This is a structural block diagram of an anti-fraud defense system based on lightweight speech semantic representation, provided for an embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] Example like Figure 1 As shown, this embodiment provides an anti-fraud defense system based on lightweight speech semantic representation, including a speech acquisition module, an audio preprocessing module, a speech recognition module, a hybrid detection module entry point, a rule engine submodule, a BERT semantic classification submodule (BERT is an abbreviation for Bidirectional Encoder Representations from Transformers), a result display module, a data storage module, a history recording module, a login / registration module, a data visualization module, a risk reporting module, a data management module, and a data analysis module. The system's functional structure can be divided into four layers from top to bottom: a user interaction layer, a business logic layer, the hybrid detection internal layer, and the user interaction layer and data storage layer. The user interaction layer includes the speech acquisition module; the business logic layer includes the audio preprocessing module, the speech recognition module, and the hybrid detection module entry point; the hybrid detection internal layer includes the rule engine submodule and the BERT semantic classification submodule; the user interaction layer includes the result display module, the history recording module, the login / registration module, the data visualization module, and the risk reporting module; and the data storage layer includes the data storage module.

[0034] The voice acquisition module provides a user-facing interactive interface, supporting real-time microphone recording or uploading of local offline audio files. After system startup, two data capture channels are opened in parallel in the local terminal background: the real-time voice stream interception and capture channel calls the local underlying audio hardware abstraction layer interface, deriving an independent real-time voice stream acquisition thread from the application layer. This thread directly interfaces with the hardware audio bus. In this embodiment, the audio capture control block parameters are hard-coded as follows: standard sampling rate 16000Hz, mono, 16-bit pulse code modulation quantization depth. Simultaneously, the thread supports dynamically setting the sliding duration of the single buffer, enabling real-time segmentation of continuous telephone call audio streams. The local offline audio file retrieval and input channel provides an open file upload API interface, allowing users or external applications to input unknown offline audio files into the system. Upon receiving a file, this channel immediately starts a format multi-channel verification state machine, reading the magic number and metadata of the file header. The system supports multiple mainstream audio formats, including WAV and MP3. If the verification indicates a non-standard format, internal transcoding logic is triggered.

[0035] The audio preprocessing module is used to standardize the input raw speech data, performing the following standardization time-domain operations in sequence: Unified resampling and channel merging: For compressed formats such as MP3, the local static decoding component is called to restore them to lossless WAV linear waveforms, and non-16000Hz audio is forcibly resampled to 16000Hz through a linear interpolation algorithm. At the same time, the two-channel signal is merged into a mono signal to ensure that the input feature dimensions of the subsequent ASR (Automatic Speech Recognition) network are consistent.

[0036] Temporal signal burden reduction: A lightweight speech activity detection algorithm is introduced. By calculating short-time energy and zero-crossing rate, useless silence segments and breathing sounds in the audio temporal waveform are identified, and these silence parts are physically cut and merged. This prevents subsequent speech recognition and semantic analysis networks from performing invalid inference on blank audio, reducing invalid computational overhead by up to 30% to 40% at the edge.

[0037] Amplitude normalization and smoothing noise reduction: A global volume normalization algorithm is executed to calculate the maximum peak amplitude of the audio signal and scale the overall waveform proportionally to a preset gain range, effectively preventing characteristic distortion caused by sudden changes in volume or bursts during calls. Finally, a time-domain adaptive filter or spectral subtraction is used to smooth and suppress background ambient noise and hardware current noise, ultimately outputting a high-quality, normalized audio stream, which is then pushed into the system's first-in-first-out middleware queue.

[0038] The speech recognition module is used to convert standardized audio streams into text strings. The speech recognition module employs a lightweight, compact pre-trained speech-to-text model with approximately 74M parameters. This model maintains a stable recognition accuracy of 85%–88% for Mandarin and regional accents, and its runtime memory and processor overhead are within the capacity of the limited computing power of the edge platform. In this embodiment, to completely eliminate the divergence and latency issues of general models when handling multiple languages, the target recognition language parameter is explicitly hard-coded as language='zh' in the core call chain of this module. During the text decoding stage, the system introduces a beam search algorithm based on the maximum likelihood probability of a word network. Let the input audio feature vector sequence be X, and the decoder searches for the optimal Chinese character text sequence by maximizing the conditional probability. Its mathematical control formula is as follows: ; Where Y represents all possible Chinese candidate text sequences. Indicates characters that have been decoded in a known history. Given acoustic feature X, output character at the current time. The conditional probability distribution, This represents the length penalty term for the current candidate text sequence. This represents the length reward adjustment coefficient. Introducing this penalty term and coefficient prevents the bundle search algorithm from tending to output extremely short and incomplete sentences due to local optima under limited computing power, and forcibly corrects the decoder output to a structurally complete and semantically coherent standardized Chinese text string.

[0039] In this embodiment, the entry point of the hybrid detection module is a traffic distribution gateway that connects the upper and lower layers, used to send the text string output by the speech recognition module into the core risk control engine inside the hybrid detection module.

[0040] The rules engine submodule is used to perform keyword matching on text strings and calculate a standard initial screening score. The rules engine submodule uses an efficient string matching algorithm (such as the Aho-Corasick automaton) to accurately match sensitive words, prohibited words, and security whitelists / blacklists on the text. The rules engine submodule locally builds and maintains a structured, multi-dimensional anti-fraud knowledge base, which is subdivided into eight major fraud types, including impersonating customer service scams, impersonating law enforcement scams, and prize-winning scams, and contains hundreds of core fraud keywords. To objectively reflect the fraudulent intent intensity of different words, the system establishes a differential weighted scoring state machine, setting words with strong targeting and high fraud relevance as high-risk keywords and assigning them high-risk weights. Keywords with potential for fraud or those used in common contexts are designated as ordinary keywords and assigned ordinary weight. Simultaneously, a dedicated safety lexicon was designed for noise reduction and error correction, used to negatively deduct risk scores.

[0041] After completing character scanning and match counting, the rule engine submodule calculates the base confidence score of the current text string using a weighted correction scoring formula. ; Conf represents the basic confidence level of the text after initial screening by the rule engine. The basic confidence level exhibits a discrete positive correlation distribution in the rational number domain. The higher the value, the higher the frequency and intensity of the intent to hit high-risk anti-fraud phrases in the current call text. M represents the total number of fraud keyword categories preset in the system. In this embodiment, it is set to a fixed value M=2, that is, the word library is differentially divided into "high-risk keywords" and "ordinary keywords" at the data structure layer. This represents the absolute frequency count of the i-th type of fraudulent keyword that actually appears in the Chinese standardized text string after time-domain transcribing. This represents the specific static weight score corresponding to the i-th type of fraudulent keyword. In the optimal embodiment of this invention, the weight of high-risk keywords (such as core terms that directly induce money transfers or require verification codes) is fixedly configured as follows: =2; The weight of general keywords (such as everyday sensitive words, generalized online lending scripts, etc.) is fixed at 2. =1. Through product The system is mathematically capable of nonlinearly accumulating and amplifying high-frequency, high-risk fraud signals; This indicates the frequency of anti-false positive words in the security dictionary that were actually matched in the transcribed text. This represents the system's preset safety word weighting correction coefficient, a negative feedback constant adjustment factor, set to a fixed value of 0.05 in this embodiment. In real telephone interaction scenarios, users may accidentally and passively mention certain high-risk words (such as repeating scammers' vocabulary) when encountering fraud, but if the user is subjectively aware, they will usually use a large number of everyday neutral words or negative / rejection-type safety confirmation words (such as "don't need," "hang up," "scammer," etc.). This mathematical correction term forcibly deducts 0.05 from the system's confidence score for each safe word hit. This negative feedback damping mechanism effectively suppresses the high misjudgment rate of the rule engine caused by occasional sensitive word triggering at the mathematical logic level.

[0042] To eliminate the cardinality statistical bias of long texts, the system further introduces a length smoothing operator based on nonlinear elastic scaling to normalize and correct the basic confidence score, and calculates the standard initial screening score: ; Where L represents the total character length of the currently input transcribed Chinese text string; As an adaptive non-linear dynamic scaling factor for text length, when the call is extremely short (L>0), With ln(e)=1, the smoothing operator degenerates, and the system maintains high sensitivity to short text keyword matching; as the call continues, the text length L increases linearly, while... The algorithm then uses a logarithmic scaling operator to perform elastic scaling on the Conf. This logarithmic elastic scaling operator, used as the denominator, performs non-linear scaling on the Conf, which perfectly offsets the random interference in keyword scores caused by word count advantages in long texts, ensuring that short and long texts have a unified and fair judgment benchmark in the same dimensional space.

[0043] The rules engine submodule calculates the standard initial screening score. Then, the three-segment traffic splitting control logic is executed based on two preset thresholds. In this embodiment, the first preset threshold is 0.85, and the second preset threshold is 0.10. when When the value is >0.85, it indicates that the density of high-risk fraudulent words in the current call text has reached an extremely high threshold and has not been effectively suppressed by safe words. The system determines that the sample belongs to a deterministic fraud event and has an extremely high risk. At this time, the rule engine submodule immediately stops the entire data processing link, directly skips the subsequent high-computing-power deep learning language model, and outputs the interception decision through the first output terminal, realizing the instant interception of strong feature fraud with minimal computing power.

[0044] when When the value is ≤ 0.10, it indicates that the current call text does not match the anti-fraud keyword database at all, or that the few sensitive words that are matched have been completely weighted down to near zero by the high-frequency security keyword database. The system determines that the call belongs to a high-probability routine secure communication. At this time, the system also triggers the suspension mechanism, no longer calling subsequent deep neural networks, and outputs the release decision through the first output terminal, so that more than 90% of normal routine calls are released in the initial screening stage, maximizing the saving of computing resources for the end device.

[0045] When 0.10 < When the score is ≤ 0.85, the rule engine, due to its inherent limitation of not being able to understand contextual semantics, cannot definitively rule out fraud (fraudsters may use homophones, deceptive language, or complex deceptive phrases to bypass keyword matching), nor can it directly perform circuit breaker interception. The system determines that the text belongs to a sample with ambiguous boundaries. At this point, the rule engine submodule releases control, activates the diversion interaction interface, and uses the current text string and its corresponding standard initial screening score as strong feature context. This is pushed to the BERT semantic classification submodule through the second output, and high computing power is introduced to perform deep intent essence mining.

[0046] The BERT semantic classification submodule is used to perform deep semantic classification on text strings and output fraud probabilities. The BERT semantic classification submodule uses a lightweight BERT model dynamically quantized and compressed using ONNX (Open Neural Network Exchange, a technology that uses ONNX to dynamically quantize semantic models to compress their size and improve edge inference speed). In the offline stage, cross-platform model middleware dynamic quantization technology is used to perform linear, uniform, and symmetric quantization compression on the weight matrix of the Transformer architecture model, reducing the original high-precision 32-bit floating-point matrix parameters. Convert to 8-bit fixed-point integer matrix parameters The quantization mapping formula is as follows: ; in, Represents the quantization step size (Scale Factor); This represents the maximum absolute value in the current weight tensor, which is mapped to a bounded integer space of B bits. In this embodiment, B = 8-bit fixed-point number. This represents the zero-point offset, which is fixed at 0 due to the use of symmetrical quantization in this embodiment. This represents the nearest integer operator.

[0047] By using the quantization mapping formula, the original language model size is compressed to 11MB (compression ratio of over 75%), and the word reasoning prediction time on the edge node is controlled to around 320ms, while also ensuring real-time protection on the edge.

[0048] The quantized model utilizes its multi-head self-attention mechanism to perform full contextual analysis on the input text with ambiguous boundaries, capturing hidden intentions. The model calculates the raw unnormalized log-probability values ​​of two mutually exclusive categories at the output layer, denoted as the normal call intention, respectively. and fraudulent intent To transform the log-odds value into a probability index that can be directly used for online threshold decisions, the system introduces a Softmax normalization mapping function to convert the log-odds value into a fraud probability p: .

[0049] In this embodiment, the system introduces a preset decision threshold γ=0.7. This threshold is the result of engineering optimization based on the anti-fraud system's extreme security defense requirements of "extremely low tolerance for false negatives and allowing a small number of false positives". If the model calculates p≥0.7, the system determines the current boundary sample as fraudulent; otherwise, it determines it as normal.

[0050] The result display module receives the judgment result directly output by the rule engine submodule or the fraud probability output by the BERT semantic classification submodule, and displays it in real time on the front-end UI interface via highlighting or pop-up prompts. Once the judgment result identifies fraud, the local processing node immediately triggers the proactive defense linkage state machine: it sends an electrical signal blocking command to the underlying communication hardware to force the call to end, or it pops up an offline high-risk warning window with the highest priority on the user terminal's visual screen, achieving proactive blocking and local protection against fraudulent behavior within milliseconds.

[0051] The history recording module is used to filter, paginate, and export detection records. The login and registration module is used for user authentication and role-based access control. The data visualization module is used to perform multi-dimensional statistics on risk control data, such as displaying the percentage of violation types with pie charts, daily risk trends with line charts, and sensitive word trigger frequencies with bar charts. The risk reporting module is used to automatically or manually generate periodic security audit reports, providing one-click download or one-click submission functionality.

[0052] The data management module is used to add, delete, modify, query, archive, and migrate detection records. The data analysis module is used to perform in-depth offline analysis of user behavior and risk characteristics.

[0053] The data storage module is used to store detection records. In this embodiment, the data storage module is a lightweight embedded relational database SQLite, which stores user information, detection text, risk classification, trigger keywords, timestamps, and structured data required for visualization and statistics.

[0054] Based on the above system architecture, this embodiment also provides an anti-fraud defense method applied to the system, including the following steps: S1. Voice Capture and Standardization Processing: Two data capture channels are opened in parallel on the local terminal background through the voice acquisition module: the real-time voice stream interception and capture channel captures call audio with a sampling rate of 16000Hz, mono, and 16-bit pulse code modulation quantization depth by calling the local underlying audio hardware abstraction layer interface; the local offline audio file retrieval input channel provides a file upload API interface, supporting mainstream audio formats such as WAV and MP3. If the format is not a standard format, the internal transcoding logic is triggered.

[0055] In this embodiment, the audio preprocessing module sequentially performs unified resampling and channel merging on the original speech data, resampling non-16000Hz audio to 16000Hz and fusing two channels into one channel; speech activity detection silence removal, by calculating short-time energy and zero-crossing rate to identify silence segments and breathing sounds and cut them, amplitude normalization and smoothing noise reduction, outputting a standardized audio stream and pushing it into the FIFO middleware queue.

[0056] S2. Speech Transcription: The standardized audio stream is retrieved from the queue by the speech recognition module and input into a lightweight automatic speech recognition model with 74M parameters. The target recognition language parameter is hard-coded as language='zh', and the text string is generated by decoding through the beam search algorithm.

[0057] S3. Rule Engine Initial Screening and Confidence Calculation: The rule engine submodule performs keyword matching on the transcribed text string. Utilizing the efficient string matching algorithm of the AC automaton, it scans eight major categories of fraud dictionaries and hundreds of core fraud keywords, assigning high-risk keyword weights to matched words. And the weight of ordinary keywords Differential weighted scoring is performed, while negative feedback deduction is applied using a secure thesaurus.

[0058] S4. Diversion Control: Based on the preset first and second preset thresholds, and according to the standard initial screening score... Implement three-section traffic diversion control: when When the value is >0.85, it is in the high-risk determination zone. The rule engine submodule immediately stops the entire data processing link, directly skips the subsequent high-computing-power deep learning language model, and outputs the interception decision through the first output terminal. when When the value is ≤ 0.10, it is in the absolute safe zone. The system also triggers the suspension mechanism, no longer calls the subsequent deep neural network, and outputs the release decision through the first output terminal, so that more than 90% of daily normal calls are released in the initial screening stage. When 0.10 < When the value is ≤ 0.85, it is in the boundary ambiguity zone. The rule engine submodule releases control, activates the diversion interaction interface, and uses the current text string and its corresponding standard initial screening score as strong feature context, which is pushed to the BERT semantic classification submodule through the second output end.

[0059] S5. Deep Semantic Judgment: For samples with ambiguous boundaries that are diverted, the BERT semantic classification submodule calls the lightweight BERT model that has been dynamically quantized and compressed by ONNX to perform inference. It uses a multi-head self-attention mechanism to perform full context association analysis on the input text, calculates the fraud probability p according to the aforementioned Softmax normalization formula, and compares p with a preset threshold γ. If p ≥ γ, it is judged as fraud; otherwise, it is normal.

[0060] S6. Defense Result Fusion and Proactive Blocking: The deterministic results directly output by the rule engine or the deep decision results output by the BERT model are standardized and integrated from multiple sources to generate a standard defense package. This package includes the final defense decision result, multi-level cascaded confidence scores, and the encoding of the specific fraud type identified. Once the judgment result identifies fraud, the local processing node immediately triggers the proactive defense linkage state machine, sending an electrical signal blocking command to the underlying communication hardware to forcibly disconnect the call, or displaying an offline high-risk warning window on the user terminal interface.

[0061] S7. Result Display and Storage: The result display module displays the judgment result or in-depth judgment result in real time on the front-end UI interface, and highlights or pop-up prompts. The data storage module performs structured feature extraction on detected events, extracting fields such as timestamp, audio identifier, transcribed text, confidence level, and fraud type. It then uses hash encryption to encrypt user-sensitive identifiers before writing them into the local SQLite database.

[0062] The visualization module performs deep full extraction and multi-dimensional indicator statistics on the local database in an asynchronous, non-blocking manner, either on a timed basis or based on events. The system calculates the total detection frequency, the total number of fraud interceptions, the overall fraud rate, and details for each category in real time, focusing on extracting the trend data for the past 7 days and the distribution data for 24 hours. The data analysis module uses the local graphics engine to map and render the extracted statistical matrix into pie charts, line charts, and bar charts.

[0063] In this embodiment, a report assembly engine is also triggered based on fraud type and hit keywords to automatically generate a document-level risk report containing risk classification, privacy leakage cause analysis and prevention suggestions, which is then presented offline on the terminal.

[0064] Based on the disclosure and teachings of the foregoing specification, those skilled in the art can make changes and modifications to the above embodiments. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and some modifications and changes to the invention should also fall within the protection scope of the claims of the present invention. Furthermore, although some specific terms are used in this specification, these terms are only for convenience of explanation and do not constitute any limitation on the present invention.

Claims

1. A fraud prevention system based on lightweight speech semantic representation, characterized in that, It includes a voice acquisition module, an audio preprocessing module, a speech recognition module, a hybrid detection module entry point, a rule engine submodule, a BERT semantic classification submodule, a results display module, and a data storage module; The voice acquisition module is connected to the audio preprocessing module, the audio preprocessing module is connected to the speech recognition module, the speech recognition module is connected to the entry point of the hybrid detection module, and the entry point of the hybrid detection module is connected to the rule engine submodule; the rule engine submodule includes a first output terminal and a second output terminal, the first output terminal is connected to the result display module, and the second output terminal is connected to the BERT semantic classification submodule; the BERT semantic classification submodule is connected to the result display module. The audio preprocessing module is used to standardize the raw speech data and output a standardized audio stream; The speech recognition module is used to convert the standardized audio stream into a text string; The rule engine submodule is used to perform keyword matching on the text string and calculate the standard initial screening score, and output the judgment result to the result display module through the first output terminal according to the standard initial screening score, or send the text string to the BERT semantic classification submodule through the second output terminal; The BERT semantic classification submodule is used to perform semantic classification on the text string and output the fraud probability to the result display module.

2. The anti-fraud defense system based on lightweight speech semantic representation according to claim 1, characterized in that, The results display module is also connected to the history record module, the data visualization module, and the risk report module. The history record module is used to filter, paginate, and export the detection records. The data visualization module is used to display risk control statistics. The risk report module is used to generate and output a security audit report.

3. The anti-fraud defense system based on lightweight speech semantic representation according to claim 1, characterized in that, It also includes a data management module and a data analysis module; the historical record module is connected to the data management module and the data analysis module respectively; the data management module and the data analysis module are connected to the data storage module respectively; the data management module is used to add, delete, modify, query and archive the detection records, and the data analysis module is used to perform statistical calculations on the stored data and push the statistical results to the data visualization module.

4. A fraud prevention method based on lightweight speech semantic representation, characterized in that, Applied to the system as described in claims 1-3, characterized by comprising the following steps: S1. Voice capture and preprocessing: Raw voice data is acquired through the voice acquisition module, and the raw voice data is standardized through the audio preprocessing module to output a standardized audio stream; S2. Speech-to-text conversion: The standardized audio stream is converted into a text string using a speech recognition module; S3. Rule Engine Initial Screening and Confidence Calculation: The rule engine submodule performs keyword matching on the text string, weights and accumulates the matched keywords, and performs negative feedback deduction in combination with the safety word library to calculate the basic confidence. Then, the basic confidence is normalized and corrected by the non-linear length smoothing operator to obtain the standard initial screening score. S4. Triage Control: Perform triage control based on the initial screening score: directly output the judgment result or send the text string to the BERT semantic classification submodule; S5. Deep semantic precision judgment: When the text string is sent to the BERT semantic classification submodule, the BERT semantic classification submodule performs deep semantic classification on the text string, outputs the fraud probability, compares the fraud probability with a preset threshold, and outputs the deep judgment result. S6. Defense Result Fusion and Active Blocking: The judgment result or the deep judgment result is fused to generate a unified defense package. When the judgment result is fraudulent, a local active blocking action is triggered. S7. Result Display and Storage: The judgment result or the deep judgment result is displayed through the result display module, and the detection record is stored through the data storage module.

5. The anti-fraud defense method based on lightweight speech semantic representation according to claim 4, characterized in that, The standard initial screening score is calculated as follows: ； Where L represents the total length of the currently input Chinese text string to be transcribed. This represents the base confidence level of the text after initial screening by the rule engine. This is an adaptive, non-linear, dynamic scaling factor for text length.

6. The anti-fraud defense method based on lightweight speech semantic representation according to claim 4, characterized in that, The basic confidence level is calculated as follows: ； Where M represents the total number of pre-defined fraud keyword categories in the system. This represents the absolute frequency count of the i-th type of fraudulent keyword actually hit in the time-domain transcribed Chinese standardized text string. This represents the specific static weight score corresponding to the i-th type of fraudulent keyword. α is the system's preset safety word weighting correction coefficient, which determines the frequency of the actual hits in the safety word library used for preventing misjudgment in the transcribed text.

7. The anti-fraud defense method based on lightweight speech semantic representation according to claim 4, characterized in that, The shunt control specifically refers to: Gradient scheduling is performed based on the interval in which the standard initial screening score falls: when the standard initial screening score reaches or exceeds a first preset threshold, the standard initial screening score is in a high-risk determination zone, and an interception decision is directly output; when the standard initial screening score is lower than or equal to a second preset threshold, the standard initial screening score is in a safe determination zone, and a release decision is directly output; when the standard initial screening score is between the second preset threshold and the first preset threshold, the standard initial screening score is in a boundary ambiguity zone, and the text string is sent to the BERT semantic classification submodule for deep semantic classification.

8. The anti-fraud defense method based on lightweight speech semantic representation according to claim 4, characterized in that, The standardization process specifically includes: The short-time energy and zero-crossing rate are calculated using a speech activity detection algorithm to identify and remove silent segments and breathing sounds from the original speech data.

9. The anti-fraud defense method based on lightweight speech semantic representation according to claim 4, characterized in that, The data storage module uses hash encryption to encrypt and store sensitive user account identifiers.

10. The anti-fraud defense method based on lightweight speech semantic representation according to claim 4, characterized in that, The rule engine submodule uses a string matching algorithm to perform keyword matching.

Images