arXiv:2605.16363cs.LGcs.CY2026-05

通过分析用户应用使用轨迹,提前预警潜在诈骗行为。

ORACLE: Anticipating Scams from Partial Trajectories in Streaming App Usage

论文配图:ORACLE: Anticipating Scams from Partial Trajectories in Streaming App Usage
图 1 · 摘自论文原文
  • 构建自进化上下文管理器,整合跨时间碎片化使用证据。
  • 采用在线自蒸馏机制,提升对早期诈骗信号的敏感度。
  • 适用于实时反诈系统,尤其适合多阶段诈骗识别场景。

智能手机诈骗日益普遍,通常表现为多阶段、跨应用的过程,其意图逐步显现。有效干预需在意图明确前进行预警,但挑战在于决策依赖于时间分散的局部轨迹数据。本文提出首个面向流式应用使用轨迹的早期诈骗预警框架ORACLE(Online Reasoning for Anticipating Cross-temporal Latent thrEats)。为支持该任务,我们构建了一个真实世界长时程基准数据集,涵盖12类诈骗,平均持续15天,涉及95种应用,且正常与诈骗行为交织。针对证据碎片化问题,引入自进化上下文管理器,动态聚合以实体为中心的交互信息,实现跨时间证据重建。为增强对早期隐性信号的敏感性,提出一种无监督的在线自蒸馏方案:教师模型基于总结的反诈线索与技能指导学生模型,后者无法访问此类反思信息。该机制将证据感知知识进行迁移,显著提升从局部轨迹中识别新兴欺诈模式的能力。实验表明,该方法在真实流式场景下能持续提升早期预警性能,在减少误报的同时提供及时警示。

原文摘要 · Abstract (English)

Smartphone scams are increasingly prevalent and typically manifest as multi-stage, cross-application processes with gradually emerging intent. Effective intervention thus requires anticipating scams before the intent becomes explicit. This is inherently challenging, as decisions must rely on partial trajectories with temporally distributed evidence. In this paper, we propose \textbf{ORACLE} Online Reasoning for Anticipating Cross-temporal Latent thrEats, the first agentic framework for early scam anticipation from \textit{streaming app-usage} trajectories. To support this setting, we curate a real-world long-horizon benchmark of streaming app-usage trajectories, covering 12 scam types, spanning extended periods (15 days on average), involving diverse applications (95 apps), and interleaving normal and scam behaviors. To address fragmented evidence, we introduce a self-evolving context manager that adaptively consolidates entity-centric interactions over time, enabling more effective reconstruction of cross-temporal evidence from partial observations. To enhance sensitivity to latent early-stage signals, we propose an on-policy self-distillation scheme in which a teacher model, conditioned on summarized anti-scam reflections and clues by skills, supervises a student model without access to such reflections. This scheme thereby distills evidence-informed knowledge and improves recognition of emerging fraud patterns from partial trajectories. Experiments show that \method{} consistently improves early scam anticipation, yielding timely warnings while reducing false alerts in realistic streaming scenarios.

反诈骗流式分析早期预警智能监控

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。