基于攻击经济学的移动虚拟运营商诈骗检测  

Attack Economics Based Fraud Detection for MVNO

作　　者：李洋 李振华[1] 辛显龙 LI Yang;LI Zhenhua;XIN Xianlong(School of Software,Tsinghua University,Beijing 100084,China;Xiaomi Technology Co.LTD.,Beijing 100085,China)

机构地区：[1]清华大学软件学院,北京100084 [2]小米科技有限公司,北京100085

出　　处：《计算机科学》2023年第8期260-270,共11页Computer Science

基　　金：国家重点研发计划(2022YFB4500703);国家自然科学基金(61902211,62202266)。

摘　　要：受电信资源充分利用和激发良性市场竞争的双重驱动,移动虚拟运营商(虚商)近年来迅速流行,其依靠基础运营商的基础设施为用户提供更灵活优惠的服务。考虑到线下实体店维护成本较高,虚商基本上采取完全线上的服务方式,这给用户监管带来很大困难;很多不法分子利用在线身份认证漏洞,大量购买虚商电话卡拨打诈骗电话,严重损害了虚商及其用户声誉,成为目前虚商存续发展的瓶颈。为解决该难题,与拥有超两百万用户的主流虚商“小米移动”合作研究,发现相关工作普遍假设诈骗电话是随意的、零散的或隐蔽的,导致其检测方法对于虚商场景低效甚至无效。然而,通过人工分析发现,不同于传统假设,虚商场景中几乎所有的诈骗电话都是有组织、按计划、成规模的,从而提出基于攻击经济学、合理分析诈骗电话时空特征的新型检测方法,成功提取出有效甄别的关键特征,再结合机器学习分类,将诈骗用户的比例降低至0.023‰,远低于基础运营商在信息充分的前提下所达到的0.1‰。在避免所提方案被破解的前提下,已将部分代码和数据开源,以帮助净化整个产业生态。Driven by the full utilization of telecommunication resources and stimulating healthy market competition,mobile virtual network opera-tors(MVNOs)become popular rapidly in recent years.MVNOs rely on the infrastructures of mobile network ope-rators(MNOs)to provide users with cheaper and more flexible services.Due to the high maintenance costs of physical stores,MVNOs mostly provide fully online service.However,scammers use vulnerabilities in online authentication to purchase SIM cards and make scam calls,which seriously affects the reputation of MVNOs and their users.This has become a bottleneck problem for the survival and development of MVNOs.To address this issue,we collaborate with a large commercial MVNO with over 2 million users named Xiaomi Mobile.Related work generally assumes that scam calls are random,scattered or hidden,ma-king the detection methods inefficient or even invalid for the scenario of MVNOs.However,by analyzing the crowdsourced dataset,almost all scam calls are found to be organized,planned,and scaled.Thus,a method based on attack economics and reasonable analysis of the spatio-temporal characteristics of scam calls is proposed.This method successfully extracts the key features,and by combining with machine learning-based classification,it greatly reduces the proportion of scammers in Xiaomi Mobile to 0.023‰,which is far lower than the 0.1‰achieved by the MNOs that have sufficient information.Under the premise of excluding the risk of being cracked,part of the code and data has been open sourced to help purify the ecology of entire telecom industry.

关 键 词：移动虚拟运营商 诈骗检测 攻击经济学 时空特征分析 机器学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]