CN116320160A - Method, device, electronic equipment and storage medium for multi-channel comprehensive anti-fraud intervention - Google Patents

The invention relates to a method, a device, electronic equipment and a storage medium for multi-channel comprehensive anti-fraud intervention. The multi-channel comprehensive anti-fraud intervention method comprises the following steps: s1, a multi-source early warning information research and judgment module collects communication original data, extracts and analyzes the communication original data to obtain fraud early warning information; s2, an external early warning data receiving module receives early warning data of an external partner of the system; s3, an intervention method decision module receives early warning data output by a multi-source early warning information research and judgment module and an external early warning data receiving module, and early warning intervention execution result feedback of the same early warning data fed back by a multi-channel intervention execution module, and decides an intervention mode to be adopted; s4, the multichannel intervention executing module receives early warning data and intervention mode decision results of the intervention method decision module, and executes early warning intervention according to the decision results. The multi-channel comprehensive anti-fraud intervention method can automatically decide to implement the most suitable method or comprehensively use a plurality of anti-fraud intervention methods.

Method, device, electronic equipment and storage medium for multi-channel comprehensive anti-fraud intervention

Technical Field

The invention relates to the field of communication, in particular to a method, a device, electronic equipment and a storage medium for comprehensively preventing fraud in multi-channel combination.

Background

With the continuous development of the internet and the mobile internet and the continuous improvement of communication technology, telecommunication phishing crimes are in a high-rise situation. Criminals elaborate fraud through internet, text messaging, telephony, etc. to fraudulently fraudsters the masses in the form of fraudsters such as fake information, fake others, fake government websites, gambling/investment/friends making, etc. The telecommunication phishing is characterized by remote implementation, hidden behaviors and wide coverage, the data quantity of the fraud early warning information obtained from research and judgment of various data channels is very large, a certain accuracy probability exists objectively, and the anti-fraud police force all-weather manual research and judgment treatment is difficult to be completely put into. Therefore, different intervention modes are adopted for different fraud information, the anti-fraud early warning coverage can be effectively improved, the anti-fraud early warning data processing efficiency is improved, and the anti-fraud police force is saved to a great extent.

Chinese patent CN113067947a: an anti-fraud solution method and system based on intelligent outbound mainly surrounds the anti-fraud system of the touch masses in a single channel, wherein the anti-fraud solution method and system mainly surrounds the anti-fraud system of the touch masses using different words through an AI voice machine.

However, in practical applications, the fraud situations are complex and various, and the single anti-fraud method cannot cope with the fraud situations. Therefore, it is needed to automatically decide to implement the most suitable anti-fraud intervention method or to comprehensively use a plurality of anti-fraud intervention methods on the basis of classifying the fraud early warning information in a grading manner.

Disclosure of Invention

The technical problem to be solved by the invention is how to classify the fraud early warning information with complex conditions and various types in a grading way, so as to realize the most suitable anti-fraud intervention method for automatic decision implementation of the system or comprehensively use a plurality of anti-fraud intervention methods.

To solve the above technical problem, according to an aspect of the present invention, there is provided a method of multi-channel integrated anti-fraud intervention, the method being implemented based on a device for multi-channel integrated anti-fraud intervention, the device comprising: the system comprises a multi-source early warning information research and judgment module, an external early warning data receiving module, an intervention method decision module and a multi-channel intervention execution module, wherein the modules are connected through an API interface. The method for comprehensively preventing the multi-channel fraud comprises the following steps: s1, a multi-source early warning information research and judgment module collects network communication original data of a mobile phone, a fixed phone and a broadband internet access in a communication network and extracts an application layer data packet in the network communication by using a deep packet detection technology; analyzing the extracted application layer data package by utilizing big data and machine learning technology, respectively analyzing and judging the big data including but not limited to APP downloading, surfing the internet, calling and transferring payment, obtaining near real-time fraud early warning information including downloading fraud APP, accessing fraud websites, answering fraud calls and transferring to fraud account, marking fraud type and fraud risk grade; s2, an external early warning data receiving module receives early warning data obtained by analysis and judgment of an external partner of the system through an own big data analysis model; s3, an intervention method decision module is provided with an intervention decision model of a machine learning supervised learning algorithm, receives early warning data output by a multi-source early warning information research and judgment module and an external early warning data receiving module through an API interface, and feeds back early warning intervention execution results of the same early warning data fed back by a multi-channel intervention execution module, so as to decide an intervention mode to be adopted next time for intervention; s4, the multichannel intervention execution module is provided with sub-modules corresponding to the intervention modes, receives early warning data of the intervention method decision module and intervention mode decision results through the API interface, and executes early warning intervention in each intervention sub-module according to the decision results.

According to the embodiment of the invention, the multi-channel intervention execution module can feed back early warning intervention execution results to the intervention method decision module through the API interface, if the former intervention mode is not effective or is poor in effect after being executed, the intervention method decision module judges whether re-intervention is needed and the intervention mode of re-intervention is needed, and if so, the intervention method decision module selects more suitable intervention again and sends the more suitable intervention to the multi-channel intervention execution module again for intervention execution.

According to the embodiment of the invention, the multi-channel intervention execution module can also have an intervention execution frequency control function, and the multi-channel intervention execution module is used for preventing the system from continuously informing the same telephone number or harassing the crowd caused by outbound.

In step S3, according to an embodiment of the present invention, the intervention decision model may include: logistic regression (logistic regression), support vector machine (support vector machine), nearest neighbor method (k-nearest neighbor), adaptive enhancement (Adaboost), XGBoost, catBoost.

According to an embodiment of the present invention, in step S3, the intervention mode may include: information sending intervention, intelligent outbound intervention, manual outbound intervention, call blocking intervention and police dispatch and gate intervention.

Further, sending information interventions include, but are not limited to: various message notification modes of iMessaging information, weChat information, short message, flash message and 5G message.

According to an embodiment of the invention, the API interface may be: HTTP, webSocket or other custom protocols based on TCP, UDP.

According to a second aspect of the present invention, there is provided a multi-channel integrated anti-fraud intervention device, comprising: the multi-source early warning information research and judgment module is used for extracting application layer data packets in network communication by collecting network communication original data of mobile phones, fixed phones and broadband internet surfing in a communication network and using a deep packet inspection technology; analyzing the extracted application layer data package by utilizing big data and machine learning technology, respectively analyzing and judging the big data including but not limited to APP downloading, surfing the internet, calling and transferring payment, obtaining near real-time fraud early warning information including downloading fraud APP, accessing fraud websites, answering fraud calls and transferring to fraud account, marking fraud type and fraud risk grade; the external early warning data receiving module is used for receiving early warning data obtained by analyzing and judging an external partner of the system through an own big data analysis model; the intervention method decision module is provided with an intervention decision model of a machine learning supervised learning algorithm and is used for receiving early warning data output by the multi-source early warning information research and judgment module and the external early warning data receiving module through an API interface, feeding back early warning intervention execution results of the same early warning data fed back by the multi-channel intervention execution module, and deciding an intervention mode to be adopted next time for intervention; the multi-channel intervention execution module is used for receiving early warning data and intervention mode decision results of the intervention method decision module through the API interface and executing early warning intervention in each intervention sub-module according to the decision results. The system comprises a multi-source early warning information studying and judging module, an external early warning data receiving module, an intervention method decision module and a multi-channel intervention executing module, wherein the modules are connected through an API interface, the multi-channel intervention executing module feeds early warning intervention executing results back to the intervention method decision module through the API interface, if the former intervention mode is not effective or not good after execution, the intervention method decision module judges whether re-intervention and the re-intervention mode are needed, and if so, the intervention method decision module selects more suitable intervention again and sends the more suitable intervention to the multi-channel intervention executing module again for intervention execution.

According to a third aspect of the present invention, there is provided an electronic device comprising: the system comprises a memory, a processor and a multi-channel comprehensive anti-fraud intervention program stored on the memory and capable of running on the processor, wherein the multi-channel comprehensive anti-fraud intervention program realizes the steps of the multi-channel comprehensive anti-fraud intervention method when being executed by the processor.

According to a fourth aspect of the present invention, there is provided a computer storage medium, wherein a multi-channel integrated anti-fraud intervention program is stored on the computer storage medium, which when executed by a processor implements the steps of the multi-channel integrated anti-fraud intervention method described above.

Compared with the prior art, the technical scheme provided by the embodiment of the invention at least has the following beneficial effects:

according to the invention, through the multichannel intervention execution module, a better early warning data intervention mode can be automatically decided through a machine learning classification model or through a rule engine and other implementation modes. Multiple early warning intervention modes can be used simultaneously or in a combined and overlapped mode, and better anti-fraud early warning effect can be achieved compared with a single intervention mode.

According to the invention, through integrating various intervention execution modes with characteristics, the characteristics of the intervention modes are fully utilized to expand the early warning intervention surface, and the early warning intervention effect is improved. If the information is sent, the information can be sent through various message types such as flash messages, short messages, 5G messages and the like. The flash message has the forced screen flicking function, and people can see the flash message when using the mobile phone; the short message has the characteristic of low cost, and is suitable for sending intervention reminding in batches; the 5G message has rich multimedia attributes, and the intervention effect is enhanced through pictures, videos and the like. The intelligent outbound intervention mode can carry out multi-round dialogue with the other party, so that the fraud situation of the fraudulent masses can be automatically recorded and the people have no rest all the year round; the manual outbound has the most flexibility and can flexibly cope with various emergency situations; police dispatch intervention is the most immediate way to contact the fraudster.

The technical scheme can organically integrate the characteristics of various intervention modes, intelligently select a better intervention mode and can adopt different intervention modes for multiple times to improve the anti-fraud intervention effect.

The invention can automatically decide to implement the most suitable anti-fraud intervention method or comprehensively use a plurality of anti-fraud intervention methods. When the former intervention mode is invalid, the new intervention mode is automatically adjusted and upgraded. If the early warning information of the low fraud risk level can be subjected to anti-fraud intervention in a message notification mode, the early warning information of the medium and high fraud risk level can be subjected to voice communication in a telephone mode, and the early warning information of the high fraud risk level, which is invalid in multiple contact, can be subjected to anti-fraud intervention in a direct police dispatch mode. Most of the fraud early warning information can be reminded and processed in an automatic mode, the anti-fraud early warning coverage is effectively improved, the anti-fraud early warning data processing efficiency is improved, the high-quality early warning intervention effect and the investment as low as possible are achieved, the purpose of high-efficiency anti-fraud is finally achieved, and the method has clear application scenes and wide social values.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following brief description of the drawings of the embodiments will make it apparent that the drawings in the following description relate only to some embodiments of the present invention and are not limiting of the present invention.

FIG. 1 is a flow chart illustrating a method of multi-channel integrated anti-fraud intervention according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. It will be apparent that the described embodiments are some, but not all, embodiments of the invention. All other embodiments, which can be made by a person skilled in the art without creative efforts, based on the described embodiments of the present invention fall within the protection scope of the present invention.

Unless defined otherwise, technical or scientific terms used herein should be given the ordinary meaning as understood by one of ordinary skill in the art to which this invention belongs. The terms "first," "second," and the like in the description and in the claims, are not used for any order, quantity, or importance, but are used for distinguishing between different elements. Likewise, the terms "a" or "an" and the like do not denote a limitation of quantity, but rather denote the presence of at least one.

FIG. 1 is a flow chart illustrating a method of multi-channel integrated anti-fraud intervention according to an embodiment of the present invention.

As shown in fig. 1, the method of multi-channel integrated anti-fraud intervention is implemented based on an apparatus of multi-channel integrated anti-fraud intervention, the apparatus comprising: the system comprises a multi-source early warning information research and judgment module, an external early warning data receiving module, an intervention method decision module and a multi-channel intervention execution module. Wherein, each module is connected through API interface.

The method for comprehensively preventing the multi-channel fraud comprises the following steps:

s1, a multi-source early warning information research and judgment module collects network communication original data of a mobile phone, a fixed phone and a broadband internet access in a communication network and extracts an application layer data packet in the network communication by using a deep packet detection technology; and analyzing the extracted application layer data package by utilizing big data and machine learning technology, respectively analyzing and judging the big data including but not limited to APP downloading, surfing the internet, calling and transferring payment, obtaining near real-time fraud early warning information including downloading fraud APP, accessing fraud websites, answering fraud calls and transferring to fraud account, marking fraud type and fraud risk level.

S2, the external early warning data receiving module receives early warning data obtained by analysis and judgment of an external partner of the system through the own big data analysis model.

S3, an intervention method decision module is provided with an intervention decision model of a machine learning supervised learning algorithm, receives early warning data output by a multi-source early warning information research and judgment module and an external early warning data receiving module through an API interface, feeds back early warning intervention execution results of the same early warning data fed back by a multi-channel intervention execution module, and decides an intervention mode to be adopted next time for intervention.

S4, the multichannel intervention execution module is provided with sub-modules corresponding to the intervention modes, receives early warning data of the intervention method decision module and intervention mode decision results through the API interface, and executes early warning intervention in each intervention sub-module according to the decision results.

According to the invention, through the multichannel intervention execution module, a better early warning data intervention mode can be automatically decided through a machine learning classification model or through a rule engine and other implementation modes. Multiple early warning intervention modes can be used simultaneously or in a combined and overlapped mode, and better anti-fraud early warning effect can be achieved compared with a single intervention mode.

According to one or some embodiments of the present invention, the multi-channel intervention execution module feeds back the early warning intervention execution result to the intervention method decision module through the API interface, if the previous intervention mode is not effective or is not effective after execution, the intervention method decision module decides whether re-intervention is required and the re-intervention mode is required, and if so, the intervention method decision module will select a more suitable intervention again and send the more suitable intervention to the multi-channel intervention execution module again for intervention execution.

The technical scheme can organically integrate the characteristics of various intervention modes, intelligently select a better intervention mode and can adopt different intervention modes for multiple times to improve the anti-fraud intervention effect.

According to one or some embodiments of the present invention, the multi-channel intervention execution module further has a frequency control function of intervention execution, for preventing the system from continuously notifying or calling out the same phone number multiple times to cause nuisance to the crowd.

According to one or some embodiments of the invention, in step S3, the intervention decision model comprises: logistic regression (logistic regression), support vector machine (support vector machine), nearest neighbor method (k-nearest neighbor), adaptive enhancement (Adaboost), XGBoost, catBoost.

According to one or some embodiments of the invention, in step S3, the intervention mode includes: information sending intervention, intelligent outbound intervention, manual outbound intervention, call blocking intervention and police dispatch and gate intervention.

Further, sending information interventions include, but are not limited to: various message notification modes of iMessaging information, weChat information, short message, flash message and 5G message.

According to the invention, through integrating various intervention execution modes with characteristics, the characteristics of the intervention modes are fully utilized to expand the early warning intervention surface, and the early warning intervention effect is improved. If the information is sent, the information can be sent through various message types such as flash messages, short messages, 5G messages and the like. The flash message has the forced screen flicking function, and people can see the flash message when using the mobile phone; the short message has the characteristic of low cost, and is suitable for sending intervention reminding in batches; the 5G message has rich multimedia attributes, and the intervention effect is enhanced through pictures, videos and the like. The intelligent outbound intervention mode can carry out multi-round dialogue with the other party, so that the fraud situation of the fraudulent masses can be automatically recorded and the people have no rest all the year round; the manual outbound has the most flexibility and can flexibly cope with various emergency situations; police dispatch intervention is the most immediate way to contact the fraudster.

According to one or some embodiments of the invention, the API interface is: HTTP, webSocket or other custom protocols based on TCP, UDP.

According to a second aspect of the present invention, there is provided a multi-channel integrated anti-fraud intervention device, comprising: the system comprises a multi-source early warning information research and judgment module, an external early warning data receiving module, an intervention method decision module and a multi-channel intervention execution module. The modules are connected through an API interface.

The multi-source early warning information research and judgment module is used for extracting application layer data packets in network communication by collecting network communication original data of mobile phones, fixed phones and broadband internet surfing in a communication network and using a deep packet detection technology; and analyzing the extracted application layer data package by utilizing big data and machine learning technology, respectively analyzing and judging the big data including but not limited to APP downloading, surfing the internet, calling and transferring payment, obtaining near real-time fraud early warning information including downloading fraud APP, accessing fraud websites, answering fraud calls and transferring to fraud account, marking fraud type and fraud risk level.

The external early warning data receiving module is used for receiving early warning data obtained by analyzing and judging the external partner of the system through the own big data analysis model.

The intervention method decision module is provided with an intervention decision model of a machine learning supervised learning algorithm, and is used for receiving early warning data output by the multi-source early warning information research and judgment module and the external early warning data receiving module through an API interface, feeding back early warning intervention execution results of the same early warning data fed back by the multi-channel intervention execution module, and deciding an intervention mode to be adopted next time for intervention.

The multi-channel intervention execution module is used for receiving early warning data and intervention mode decision results of the intervention method decision module through the API interface and executing early warning intervention in each intervention sub-module according to the decision results.

The multi-channel intervention execution module feeds back early warning intervention execution results to the intervention method decision module through the API interface, if the former intervention mode is not effective or is poor in effect after being executed, the intervention method decision module judges whether re-intervention and the re-intervention mode are needed, and if so, the intervention method decision module selects more suitable intervention again and sends the more suitable intervention to the multi-channel intervention execution module again for intervention execution.

In the embodiment of the invention, the multisource early warning information research and judgment module extracts the application layer data packet in the network communication by collecting the network communication original data of the mobile phone, the fixed phone and the broadband internet access in the communication network and using the deep packet detection technology. Analyzing and judging through big data and an artificial intelligent algorithm to obtain that a certain mobile phone is answering a telephone with a suspected medium threat degree. The multi-source early warning information research and judgment module immediately generates early warning data (including fields of warning time, occurrence region, telephone number, fraud type, fraud risk level, early warning data source and the like) from the research and judgment of the time, and informs the intervention mode decision module through an API interface.

In this embodiment of the present invention, the intervention mode decision-making module is implemented by a machine learning model. The intervention mode decision module builds feature engineering on early warning data and feedback data of the multi-channel intervention execution module, and builds dozens of features such as early warning data occurrence time features (year, month, day, hour, week, holiday, double holiday), regional features (province, city, district), fraud type features, fraud risk level features, fraud information source features, information sending intervention features (information sending type and sending result), intelligent outbound intervention features (whether intelligent anti-fraud outbound, outbound times, whether shodded or shodded by people fed back or not), manual outbound intervention features (whether manual outbound times, whether shodded or shodded by people fed back or not, call blocking intervention features (whether or not call blocking or call blocking results are used), police intervention features (whether or not sending police to go on intervention, whether or not shodded by shodded money fed back) and the like as models, trains various intervention modes as models by supervised learning algorithms and generates intervention models. After model training is completed, the intervention mode decision module automatically researches and judges the next intervention method to be adopted after receiving early warning data of the API interface, and informs the multi-channel intervention executing module to execute early warning intervention through the interface.

When the intelligent intervention mode decision module predicts the first intervention mode of the received early warning data by using the intervention decision model, the system does not send intervention information or performs outbound intervention on the early warning data, and the intelligent intervention mode decision module only uses the early warning information to generate model features, and other features are all null. The intervention decision model computes features and predicts the way an intervention is needed or not. After the early warning data is finished for the first time, the system is formed into characteristics consisting of early warning data and intervention results to calculate and predict the mode of intervention or no intervention required to be performed subsequently. The early warning data and the intervention mode calculated by the module are sent to the multi-channel intervention execution module through an API calling mode.

And after receiving the early warning data and the determined intervention modes, the multi-channel intervention execution module executes the designated intervention modes. Different intervention modes generate respective feedback results. And the early warning data and the feedback result are sent back to the intelligent intervention mode decision module through an API calling mode to judge the intervention mode needed by the next round until the model judges that the data does not need to be appointed for the next intervention. The frequency control function can perform frequency control on early warning intervention behaviors of a victim crowd, and prevent the system from continuously informing or calling outwards the same telephone number at high frequency to cause disturbance to the crowd.

The invention can automatically decide to implement the most suitable anti-fraud intervention method or comprehensively use a plurality of anti-fraud intervention methods. When the former intervention mode is invalid, the new intervention mode is automatically adjusted and upgraded. If the early warning information of the low fraud risk level can be subjected to anti-fraud intervention in a message notification mode, the early warning information of the medium and high fraud risk level can be subjected to voice communication in a telephone mode, and the early warning information of the high fraud risk level, which is invalid in multiple contact, can be subjected to anti-fraud intervention in a direct police dispatch mode. Most of the fraud early warning information can be reminded and processed in an automatic mode, the anti-fraud early warning coverage is effectively improved, the anti-fraud early warning data processing efficiency is improved, the high-quality early warning intervention effect and the investment as low as possible are achieved, the purpose of high-efficiency anti-fraud is finally achieved, and the method has clear application scenes and wide social values.

According to a further aspect of the present invention, there is provided a multi-channel integrated anti-fraud intervention device, comprising: the system comprises a memory, a processor and a multi-channel comprehensive anti-fraud intervention program stored on the memory and capable of running on the processor, wherein the multi-channel comprehensive anti-fraud intervention program realizes the steps of the multi-channel comprehensive anti-fraud intervention method when being executed by the processor.

There is also provided a computer storage medium according to the present invention.

The computer storage medium is stored with a multi-channel comprehensive anti-fraud intervention program, and the steps of the multi-channel comprehensive anti-fraud intervention method are realized when the multi-channel comprehensive anti-fraud intervention program is executed by the processor.

The method implemented when the multi-channel integrated anti-fraud intervention program running on the processor is executed may refer to various embodiments of the multi-channel integrated anti-fraud intervention method of the present invention, which are not described herein.

The invention also provides a computer program product.

The computer program product of the present invention comprises a multi-channel integrated anti-fraud intervention program, which when executed by a processor implements the steps of the multi-channel integrated anti-fraud intervention method as described above.

The method implemented when the multi-channel integrated anti-fraud intervention program running on the processor is executed may refer to various embodiments of the multi-channel integrated anti-fraud intervention method of the present invention, which are not described herein.

From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) as described above, comprising instructions for causing a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the method according to the embodiments of the present invention.

The foregoing is merely exemplary embodiments of the present invention and is not intended to limit the scope of the invention, which is defined by the appended claims.