CN108513303B - Abnormity monitoring method and device for same number terminal - Google Patents
Abnormity monitoring method and device for same number terminal Download PDFInfo
- Publication number
- CN108513303B CN108513303B CN201810562003.2A CN201810562003A CN108513303B CN 108513303 B CN108513303 B CN 108513303B CN 201810562003 A CN201810562003 A CN 201810562003A CN 108513303 B CN108513303 B CN 108513303B
- Authority
- CN
- China
- Prior art keywords
- terminal
- event
- abnormal
- cell
- identifiers
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention provides a method and a device for monitoring the abnormity of a same-number terminal, which are characterized in that according to a terminal identifier corresponding to the same telephone number, when acquiring event information sent by a terminal indicated by the terminal identifier, the event time of an event is acquired; when the event time interval corresponding to at least 2 terminal identifications is determined to be smaller than a preset time interval, acquiring cell identifications of cells connected with the terminals corresponding to the at least 2 terminal identifications respectively; if the cell identifications corresponding to the at least 2 terminal identifications respectively contain non-adjacent cell identifications, determining abnormal terminals in the terminals indicated by the at least 2 terminal identifications respectively, automatically monitoring the use conditions of the plurality of terminals with the same number without requiring a user to actively inquire the use conditions of the plurality of terminals, and determining the abnormal terminals when the at least two terminals operate in different cells at the same time, so that the initiative and the accuracy of monitoring the use conditions of the terminals are improved.
Description
Technical Field
The invention relates to a communication technology, in particular to an abnormity monitoring method and device for a same-number terminal.
Background
The telephone number is an important identification of a user in social contact and communication, terminals such as a mobile phone, an intelligent watch and a tablet personal computer are set to be the same number terminal through one number and multiple terminal services, the same telephone number is used for the outside, and the user can use the same telephone number on multiple same number terminal devices. The mobile phone is used as a main terminal, other terminals are used as auxiliary terminals, a user can simultaneously use one or more terminals with the same number to perform operations such as answering or making a call, browsing a webpage, downloading data and the like, and the operation of multiple terminals does not cause disordered number identification, so that the communication convenience is greatly improved. The one-number multi-terminal service brings convenience to users and also brings information security problems. For example, if a smart watch that is the same number as a cell phone is obtained by an illegal party, the illegal party can be used to make fraudulent calls, thereby increasing the risk of phone fraud.
In the prior art, the abnormality monitoring method for the same-number terminal mainly adopts manual active inquiry, for example, a user carries out position inquiry on other terminals such as a watch or a tablet personal computer and the like through a mobile phone in a same-account geographical position sharing mode, and when finding that other same-number terminals are located at strange positions, the inquired other same-number terminals can be determined to be lost or stolen.
The abnormal monitoring method in the prior art is relatively passive, and the monitoring efficiency for abnormal use conditions of the same-number terminal is not high.
Disclosure of Invention
The invention provides a method and a device for monitoring the abnormity of a same-number terminal, which can automatically monitor the use condition of a plurality of terminals with the same number, determine the abnormal terminal when finding that at least two terminals operate in different cells at the same time, and improve the initiative and the accuracy of monitoring the use condition of the terminal.
According to a first aspect of the present invention, there is provided a method for monitoring an abnormality of a terminal with the same number, including:
according to a terminal identification corresponding to the same telephone number, when acquiring event information sent by a terminal indicated by the terminal identification, acquiring event time of an event;
when the event time interval corresponding to at least 2 terminal identifications is determined to be smaller than a preset time interval, acquiring cell identifications of cells connected with the terminals corresponding to the at least 2 terminal identifications respectively;
and if the cell identifiers corresponding to the at least 2 terminal identifiers respectively comprise non-adjacent cell identifiers, determining abnormal terminals in the terminals indicated by the at least 2 terminal identifiers respectively.
Optionally, determining an abnormal terminal in the terminals respectively indicated by the at least 2 terminal identifiers includes:
acquiring a reference cell identifier of a cell connected with a preset reference terminal;
and determining the terminal indicated by the terminal identifier corresponding to the cell identifier which is not adjacent to the reference cell identifier as an abnormal terminal in the terminals indicated by the at least 2 terminal identifiers.
Optionally, after determining an abnormal terminal in the terminals respectively indicated by the at least 2 terminal identifiers, the method further includes:
acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all interactive event identifications;
if so, acquiring a position corresponding to a cell connected with the abnormal terminal, and generating abnormal use alarm information according to a terminal identifier of the abnormal terminal, the position corresponding to the cell connected with the abnormal terminal and an event identifier of an event occurring in the abnormal terminal;
if not, acquiring the position corresponding to the cell connected with the abnormal terminal, and generating terminal position abnormal information according to the terminal identifier of the abnormal terminal and the position corresponding to the cell connected with the abnormal terminal.
Optionally, before obtaining the reference cell identifier of the cell to which the preset reference terminal is connected, the method further includes:
obtaining event generation frequency corresponding to the terminal indicated by each terminal identifier according to the number of the event identifiers of the terminal events indicated by the terminal identifiers within a preset time period;
and determining the terminal indicated by the terminal identifier corresponding to the highest event generation frequency as a preset reference terminal.
Optionally, the event indicated by the interaction class event identifier includes: making or receiving a call;
correspondingly, the obtaining event identifiers of the events corresponding to the at least 2 terminal identifiers, and determining whether the event identifiers are all interactive event identifiers includes:
and acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all used for making or receiving calls.
According to a second aspect of the present invention, there is provided an abnormality monitoring apparatus for terminals of the same number, comprising:
the event acquisition module is used for acquiring event time when the terminal which is indicated by the terminal identification sends event information according to the terminal identification corresponding to the same telephone number;
a cell identifier obtaining module, configured to obtain cell identifiers, where at least 2 terminal identifiers correspond to cells to which terminals are connected, when it is determined that an interval between event times corresponding to at least 2 terminal identifiers is smaller than a preset time interval;
and an abnormal terminal determining module, configured to determine an abnormal terminal among the terminals respectively indicated by the at least 2 terminal identifiers, if the cell identifiers respectively corresponding to the at least 2 terminal identifiers include non-adjacent cell identifiers.
Optionally, the abnormal terminal determining module is configured to: if the cell identifiers respectively corresponding to the at least 2 terminal identifiers comprise non-adjacent cell identifiers, acquiring a reference cell identifier of a cell connected with a preset reference terminal; and determining the terminal indicated by the terminal identifier corresponding to the cell identifier which is not adjacent to the reference cell identifier as an abnormal terminal in the terminals indicated by the at least 2 terminal identifiers.
Optionally, the method further comprises: an event determination module to:
after determining abnormal terminals in the terminals respectively indicated by the at least 2 terminal identifications, acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all interactive event identifications; if so, acquiring a position corresponding to a cell connected with the abnormal terminal, and generating abnormal use alarm information according to a terminal identifier of the abnormal terminal, the position corresponding to the cell connected with the abnormal terminal and an event identifier of an event occurring in the abnormal terminal; if not, acquiring the position corresponding to the cell connected with the abnormal terminal, and generating terminal position abnormal information according to the terminal identifier of the abnormal terminal and the position corresponding to the cell connected with the abnormal terminal.
Optionally, the abnormal terminal determining module is further configured to: before acquiring a reference cell identifier of a cell connected with a preset reference terminal, obtaining event generation frequency corresponding to a terminal indicated by each terminal identifier according to the number of event identifiers of terminal events indicated by the terminal identifier within a preset time period; and determining the terminal indicated by the terminal identifier corresponding to the highest event generation frequency as a preset reference terminal.
Optionally, the event indicated by the interaction class event identifier includes: making or receiving a call;
correspondingly, the event judgment module is used for: and acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all used for making or receiving calls.
According to a third aspect of the invention, there is provided an apparatus comprising: memory, a processor and a computer program, wherein the computer program is stored in the memory and configured to be executed by the processor to implement the method of the first aspect of the invention and its various possible designs.
According to a fourth aspect of the present invention, there is provided a readable storage medium having stored therein a computer program for implementing the method of the first aspect of the present invention and its various possible designs when executed.
According to the abnormal monitoring method and device for the same number terminal, the event time of an event is acquired when the terminal sending event information indicated by the terminal identification is acquired according to the terminal identification corresponding to the same telephone number; when the event time interval corresponding to at least 2 terminal identifications is determined to be smaller than a preset time interval, acquiring cell identifications of cells connected with the terminals corresponding to the at least 2 terminal identifications respectively; if the cell identifications corresponding to the at least 2 terminal identifications respectively contain non-adjacent cell identifications, determining abnormal terminals in the terminals indicated by the at least 2 terminal identifications respectively, automatically monitoring the use conditions of the plurality of terminals with the same number without requiring a user to actively inquire the use conditions of the plurality of terminals, and determining the abnormal terminals when the at least two terminals operate in different cells at the same time, so that the initiative and the accuracy of monitoring the use conditions of the terminals are improved.
Drawings
Fig. 1 is a schematic diagram of an application scenario provided in an embodiment of the present invention;
fig. 2 is a schematic flowchart of an abnormality monitoring method for a terminal with the same number according to an embodiment of the present invention;
fig. 3 is a schematic flowchart of another method for monitoring an abnormality of a terminal with the same number according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of an abnormality monitoring apparatus for terminals with the same number according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of an abnormality monitoring apparatus of another terminal with the same number according to an embodiment of the present invention;
fig. 6 is a schematic diagram of a hardware structure of an apparatus according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein.
It should be understood that, in various embodiments of the present invention, the sequence numbers of the processes do not mean the execution sequence, and the execution sequence of the processes should be determined by the functions and the internal logic of the processes, and should not constitute any limitation on the implementation process of the embodiments of the present invention.
It should be understood that in the present application, "comprising" and "having" and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
It should be understood that in the present invention, "B corresponding to a", "a corresponds to B", or "B corresponds to a" means that B is associated with a, from which B can be determined. Determining B from a does not mean determining B from a alone, but may be determined from a and/or other information. And the matching of A and B means that the similarity of A and B is greater than or equal to a preset threshold value.
As used herein, "if" may be interpreted as "at … …" or "when … …" or "in response to a determination" or "in response to a detection", depending on the context.
It should be understood that the same number terminal in the present invention refers to a terminal using the same telephone number among a plurality of terminals. The same number terminal can be a mobile phone, an intelligent watch, an intelligent bracelet, a tablet computer and other terminal equipment.
It should be understood that a cell in the present invention refers to a cell constituting a cellular mobile telephone network. Specifically, the service area of the mobile phone is divided into a plurality of cells adjacent to each other, each base station corresponds to a network structure of 3 cells, each cell is in a regular hexagon shape and is adjacent to each other, and the shape of the network structure is similar to a honeycomb as a whole. The global system for mobile communication (GSM) system obtains location information through a cell to realize location service. GSM determines the location of a user by collecting the identity of the cell in which the mobile terminal is located. As long as the GSM can acquire the geographic location of the cell identifier (e.g. cell number) of the mobile terminal on the map and the coverage radius of the cell, the GSM knows the cell location of the mobile terminal when the mobile terminal accesses the cell. The positioning accuracy of the technology depends on the radius of a cell, for example, in the Beijing urban area, the density of base stations is higher, and the positioning accuracy can reach about 200 meters; in suburban areas, the density of base stations is low, and the positioning accuracy can only reach one or two kilometers.
It should be understood that the event in the present invention refers to a communication operation performed by the same number terminal in response to a user operation or automatically, such as making and receiving a call, sending a short message, logging in an application program, browsing a web page, sending an email, etc. The event time is the time when an event occurs, and is the time when the event occurs from the beginning of the event to the end of the event. For example, if the call is placed 9:00 from the successful establishment of the call link until the call link is completed 9:05, the event time for the call event is 9:00-9: 05.
The technical solution of the present invention will be described in detail below with specific examples. The following several specific embodiments may be combined with each other, and details of the same or similar concepts or processes may not be repeated in some embodiments.
Fig. 1 is a schematic view of an application scenario provided in an embodiment of the present invention. The invention can be applied to a scene with one number and multiple terminals as shown in fig. 1, wherein a mobile phone 1, an intelligent watch 2 and a tablet personal computer 3 are three different terminals sharing the same telephone number. The communication system is implemented by a base station 4 forming a network coverage with several cells 5 adjacent to each other. These three terminals all communicate with other terminals by connecting to the communication network through the cell 5 and access different cells 5 depending on the location of the movement. The execution main body of the method embodiment of the present invention is an abnormality monitoring device of the terminal with the same number, and the device may be specifically computer software or hardware, and specifically may be built in a communication server or a terminal, or may be a dedicated device operating independently, but the present invention is not limited thereto.
Referring to fig. 2, a schematic flowchart of an abnormality monitoring method for a terminal with the same number according to an embodiment of the present invention includes steps S101 to S103, which are specifically as follows:
s101, according to a terminal identification corresponding to the same telephone number, when acquiring event information sent by a terminal indicated by the terminal identification, acquiring event time when an event occurs.
Specifically, the terminal identifiers corresponding to the same telephone number are identifiers of the terminals corresponding to the same telephone number in the one-number-multiple-terminal. When a Subscriber Identity Module (SIM) is used as an Identification Module, the terminal identifier may be understood as a SIM identifier, and SIM cards in different terminals all use the same phone number but have different SIM identifiers, and the SIM identifiers are unique. When the terminal sending event information indicated by the terminal identifier is acquired, the event time when the event occurs is acquired, which can be understood as that the information such as the event, the event time and the like of the corresponding terminal is retrieved from the database updated in real time according to the terminal identifier, for example, the database actively captures the event information sent by each terminal, or each terminal actively uploads the event information to the database after the event is generated; it can also be understood that the event information is directly obtained from the corresponding terminal in real time according to the terminal identifier, for example, the event information is obtained from the terminal when the event occurrence of the terminal is monitored. The event in the embodiment can be understood as terminal operations such as making and receiving a call, sending a short message, logging in an application program, browsing a webpage, sending an email and the like. The event information may be understood as information generated when the terminal performs the above-described terminal operation, for example, traffic data generated when sending a mail. The event information may carry event time, for example, traffic data generated during a call, where each data includes timestamp information, and the event time of the call event may be obtained through the timestamp information of the data.
S102, when the event time interval corresponding to at least 2 terminal identifications is determined to be smaller than a preset time interval, cell identifications of the cells connected with the terminals corresponding to the at least 2 terminal identifications are obtained.
Specifically, the event time corresponding to each terminal identifier is obtained, and the event times may be a time point, for example, the event time for sending the short message is 8: 45; it may also be a time period, for example, a time period for making a call is 9:00-9: 05. The interval of the event time corresponding to at least 2 terminal identifiers is smaller than a preset time interval, and it can be understood that the event times belonging to different terminal identifiers overlap or the interval is too short. For example, the call event time generated by the mobile phone SIM card is 9:00-9:05, the call event time generated by the smart watch SIM card is 9:03-9:15, and the call time of the mobile phone SIM card and the call time of the smart watch SIM card are overlapped, so that one terminal may be used by another after being lost, or the user may be using two terminals at the same time. Since it cannot be completely determined whether a terminal is abnormally used only according to the collision of the event times, after finding that the event time interval of at least 2 terminals is smaller than the preset time interval, it is necessary to further determine in combination with the situation of the cell to which the at least 2 terminals are connected.
S103, if the cell identifications corresponding to the at least 2 terminal identifications respectively contain non-adjacent cell identifications, determining abnormal terminals in the terminals indicated by the at least 2 terminal identifications respectively.
The base station, the core network or another mobile network server may store cell location information, for example, a neighboring cell list of a cell where the base station is located may be stored in the base station, or a location of each cell may be stored in the mobile network server, and cells adjacent to each other may be obtained from the location of the cell. In this embodiment, the information of the cell identifiers corresponding to the at least 2 terminal identifiers, such as an adjacent cell identifier list corresponding to the cell identifier, may be directly obtained from the base station, the core network, or another mobile network server. And acquiring the cell identifications corresponding to the at least 2 terminal identifications respectively, and then determining the relationship among the cell identifications. And if the cell identifier comprises the non-adjacent cell identifier, determining an abnormal terminal from the terminals respectively indicated by the at least 2 terminal identifiers. For example, a cell a is accessed by both a mobile phone and a tablet computer, a cell G is accessed by the smart watch, and the cell G and the cell a are non-adjacent cells, so that an abnormal terminal is determined in the mobile phone, the tablet computer and the smart watch. For another example, the mobile phone is accessed to a cell a, the smart watch is accessed to a cell G, and the cell G and the cell a are non-adjacent cells, so that an abnormal terminal is determined in the mobile phone and the smart watch. In the case of 3 terminals, a terminal which is a non-adjacent cell with respect to the other terminals may be determined as an abnormal terminal, and in the case of only 2 terminals, an identity authentication request may be sent to both terminals, and a terminal operated when the user passes the identity authentication may be determined as a safe terminal and the other terminal may be determined as an abnormal terminal.
The embodiment provides an abnormality monitoring method for terminals with the same number, which includes the steps that according to terminal identifiers corresponding to the same telephone number, when event information sent by a terminal indicated by the terminal identifiers is acquired, event occurrence time is acquired; when the event time interval corresponding to at least 2 terminal identifications is determined to be smaller than a preset time interval, acquiring cell identifications of cells connected with the terminals corresponding to the at least 2 terminal identifications respectively; if the cell identifications corresponding to the at least 2 terminal identifications respectively contain non-adjacent cell identifications, determining abnormal terminals in the terminals indicated by the at least 2 terminal identifications respectively, automatically monitoring the use conditions of the plurality of terminals with the same number without requiring a user to actively inquire the use conditions of the plurality of terminals, and determining the abnormal terminals when the at least two terminals operate in different cells at the same time, so that the initiative and the accuracy of monitoring the use conditions of the terminals are improved.
In order to more clearly describe a specific implementation method for determining an abnormal terminal in the terminals respectively indicated by the at least 2 terminal identifiers in the embodiment shown in fig. 2, the following detailed description is made with reference to fig. 3 and the specific embodiment. Referring to fig. 3, a schematic flowchart of another method for monitoring an abnormality of a terminal with the same number according to an embodiment of the present invention includes steps S201 to S206, which are specifically as follows:
s201, obtaining the event generation frequency corresponding to the terminal indicated by each terminal identifier according to the number of the event identifiers of the terminal events indicated by the terminal identifiers in the preset time period.
Specifically, taking 10 days as an example of a preset time period, the number of event identifiers sent by each terminal identifier within 10 days is obtained, for example, 20 call events and 15 mail sending events are generated, then 35 event identifiers are obtained in total within 10 days, and the corresponding event generation frequency is 35/10-3.5.
And S202, determining the terminal indicated by the terminal identification corresponding to the highest event generation frequency as a preset reference terminal.
Specifically, the event generation frequencies of the terminals are arranged in a descending order, the size of the event generation frequency reflects the use frequency of the terminals, the higher the event generation frequency is, the more frequently the terminal is used by the user, and the most likely the terminal is carried by the user, and the lower the possibility of loss is. Therefore, the terminal identifier of the highest event generation frequency is obtained, and the terminal indicated by the terminal identifier is determined as the preset reference terminal.
In this embodiment, steps S201 to S202 only need to be limited to be executed before step S205, and the execution sequence between step S203 and step S204 is not limited by the described action sequence, for example, steps S201 to S202 may be executed before step S203 to step S204, or may be executed simultaneously with step S203 to step S204, or may be executed after step S203 to step S204.
And S203, according to the terminal identification corresponding to the same telephone number, when the terminal sending event information indicated by the terminal identification is acquired, acquiring the event time of the event.
S204, when the interval of the event time corresponding to at least 2 terminal identifications is determined to be smaller than the preset time interval, cell identifications of the cells connected with the terminals corresponding to the at least 2 terminal identifications are obtained.
The implementation of steps S203 to S204 is described in step S101 to step S102 in the embodiment shown in fig. 2, and is not described herein again.
S205, if the cell identifiers respectively corresponding to the at least 2 terminal identifiers include non-adjacent cell identifiers, acquiring a reference cell identifier of a cell to which a preset reference terminal is connected.
Taking the reference terminal as the mobile phone as an example, the reference terminal may be a cell where the mobile phone is currently connected and registered, and since the reference terminal is a terminal that is carried by the user and is most frequently used, the location of the cell where the reference terminal is connected may be considered to be the current location of the user, and therefore if other terminals are too far away from the cell, the other terminals are obviously not at the user's side.
And S206, determining the terminal indicated by the terminal identifier corresponding to the cell identifier which is not adjacent to the reference cell identifier as an abnormal terminal in the terminals indicated by the at least 2 terminal identifiers.
The cell indicates the location of the terminal, but considering that the user may be located at the border between two cells, cell handover may occur, and the neighboring cells may be considered as a normal use state. However, the cell identifier corresponding to the terminal is in a non-adjacent relationship with the reference cell identifier at the same time, and obviously, the terminal is far away from the reference terminal, and the terminal is considered to have abnormal operation and is determined to be an abnormal terminal.
In the embodiment, the reference terminal is determined according to the use frequency of each terminal, and then the abnormal terminal is determined in the terminals with event time conflicts by the reference cell of the reference terminal, so that the accuracy of abnormal recognition is improved.
On the basis of the foregoing embodiment, after determining the abnormal terminal in the terminals respectively indicated by the at least 2 terminal identifiers, a process of generating abnormal information according to a determination result of whether the events are all interactive events may also be included, specifically:
and acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all interactive event identifications. If so, acquiring a position corresponding to a cell connected with the abnormal terminal, and generating abnormal use alarm information according to a terminal identifier of the abnormal terminal, the position corresponding to the cell connected with the abnormal terminal and an event identifier of an event occurring in the abnormal terminal; if not, acquiring the position corresponding to the cell connected with the abnormal terminal, and generating terminal position abnormal information according to the terminal identifier of the abnormal terminal and the position corresponding to the cell connected with the abnormal terminal.
Specifically, the interaction event indicated by the interaction event identifier may be understood as an event occurring due to user interaction operation, such as a call event, in which a voice message input by a user needs to be acquired all the time during the occurrence process, a mail sending event, in which the user needs to input a mail sending instruction, and a chat application login event, in which the user also needs to input information. When an interactive event occurs at a terminal far away from a user, the terminal indicates that other people illegally perform input operation on the terminal, the abnormal level is high, and the user or a specific structure needs to be reminded of the position and the occurred event of the abnormal terminal. The non-interactive events can be understood as system automatic update events, schedule reminding events, automatic mail receiving events without user input, automatic chat data receiving events and the like. Due to the fact that the non-interactive events do not have user input operation, namely illegal users do not operate the terminal, for example, the terminal is handed to others by the users for temporary storage, the abnormal level is low, and the users or specific structures only need to be reminded of the positions of the terminals.
Further, the generated abnormal use alarm information may be sent to a first preset address, or a reference terminal. The generated terminal position abnormality information may be transmitted to a second preset address or may be stored only as abnormality record information. The first preset address and the second preset address can be the same address, such as a preset mailbox address of the user, or different addresses, such as a first preset address being a mailbox address of an alarm mechanism, and a second preset address being a personal email address of the user.
The event indicated by the interaction class event identification comprises the following steps: to make or receive a call, for example. Correspondingly, the obtaining event identifiers of the events corresponding to the at least 2 terminal identifiers, and determining whether the event identifiers are all interactive event identifiers includes: and acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all used for making or receiving calls.
Fig. 4 is a schematic structural diagram of an abnormality monitoring device for terminals with the same number according to an embodiment of the present invention. The apparatus shown in fig. 4 comprises:
the event obtaining module 41 is configured to obtain event time when the terminal indicated by the terminal identifier sends event information according to the terminal identifier corresponding to the same phone number;
a cell identifier obtaining module 42, configured to obtain cell identifiers, where the event time intervals corresponding to at least 2 terminal identifiers are smaller than a preset time interval, of cells to which the terminals are connected, where the at least 2 terminal identifiers correspond to the cell identifiers, respectively;
an abnormal terminal determining module 43, configured to determine an abnormal terminal among the terminals respectively indicated by the at least 2 terminal identifiers, if the cell identifiers respectively corresponding to the at least 2 terminal identifiers include non-adjacent cell identifiers.
The anomaly monitoring device of the terminal with the same number in the embodiment shown in fig. 4 can be correspondingly used for executing the steps in the method embodiment shown in fig. 2, and the implementation principle and the technical effect are similar, which are not described herein again.
On the basis of the foregoing embodiment, the abnormal terminal determining module 43 is configured to: if the cell identifiers respectively corresponding to the at least 2 terminal identifiers comprise non-adjacent cell identifiers, acquiring a reference cell identifier of a cell connected with a preset reference terminal; and determining the terminal indicated by the terminal identifier corresponding to the cell identifier which is not adjacent to the reference cell identifier as an abnormal terminal in the terminals indicated by the at least 2 terminal identifiers.
Fig. 5 is a schematic structural diagram of another abnormality monitoring device for terminals of the same number according to an embodiment of the present invention. The apparatus shown in fig. 5 further comprises: an event determination module 44 configured to: after the event time interval corresponding to at least 2 terminal identifiers is determined to be smaller than a preset time interval, acquiring event identifiers corresponding to events of the at least 2 terminal identifiers, and judging whether the event identifiers are all interactive event identifiers; if yes, the abnormal terminal determining module is further configured to: after determining an abnormal terminal in the terminals respectively indicated by the at least 2 terminal identifications, acquiring a position corresponding to a cell connected with the abnormal terminal, and generating abnormal use alarm information according to the terminal identification of the abnormal terminal, the position corresponding to the cell connected with the abnormal terminal and an event identification of an event occurring in the abnormal terminal; if not, the abnormal terminal determining module is further configured to: after determining an abnormal terminal in the terminals respectively indicated by the at least 2 terminal identifications, acquiring a position corresponding to a cell connected with the abnormal terminal, and generating terminal position abnormal information according to the terminal identification of the abnormal terminal and the position corresponding to the cell connected with the abnormal terminal.
On the basis of the foregoing embodiment, the abnormal terminal determining module 43 is further configured to: before acquiring a reference cell identifier of a cell connected with a preset reference terminal, obtaining event generation frequency corresponding to a terminal indicated by each terminal identifier according to the number of event identifiers of terminal events indicated by the terminal identifier within a preset time period; and determining the terminal indicated by the terminal identifier corresponding to the highest event generation frequency as a preset reference terminal.
On the basis of the above embodiment, the event indicated by the interaction class event identifier includes: make and receive calls. Accordingly, the event determination module 44 is configured to: and acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all used for making or receiving calls.
Referring to fig. 6, which is a schematic diagram of a hardware structure of an apparatus provided in an embodiment of the present invention, the apparatus includes: a processor 91, memory 92 and computer programs; wherein
A memory 92 for storing the computer program, which may also be a flash memory (flash). The computer program is, for example, an application program, a functional module, or the like that implements the above method.
A processor 91 for executing the computer program stored in the memory to implement the steps performed by the apparatus in the above method. Reference may be made in particular to the description relating to the preceding method embodiment.
Alternatively, the memory 92 may be separate or integrated with the processor 91.
When the memory 92 is a device independent of the processor 91, the apparatus may further include:
a bus 93 for connecting the memory 92 and the processor 91. The apparatus of fig. 6 may further include a transmitter (not shown) for transmitting the information indicating the abnormal terminal generated by the processor 91 to a server or a terminal.
The present invention also provides a readable storage medium, in which a computer program is stored, which when executed is used to implement the methods provided by the various embodiments described above.
The readable storage medium may be a computer storage medium or a communication medium. Communication media includes any medium that facilitates transfer of a computer program from one place to another. Computer storage media may be any available media that can be accessed by a general purpose or special purpose computer. For example, a readable storage medium is coupled to the processor such that the processor can read information from, and write information to, the readable storage medium. Of course, the readable storage medium may also be an integral part of the processor. The processor and the readable storage medium may reside in an Application Specific Integrated Circuits (ASIC). Additionally, the ASIC may reside in user equipment. Of course, the processor and the readable storage medium may also reside as discrete components in a communication device.
The present invention also provides a program product comprising execution instructions stored in a readable storage medium. The at least one processor of the device may read the execution instructions from the readable storage medium, and the execution of the execution instructions by the at least one processor causes the device to implement the methods provided by the various embodiments described above.
In the above embodiments of the apparatus, it should be understood that the Processor may be a Central Processing Unit (CPU), other general purpose processors, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of a method disclosed in connection with the present invention may be embodied directly in a hardware processor, or in a combination of the hardware and software modules within the processor.
Finally, it should be noted that: the above embodiments are only used to illustrate the technical solution of the present invention, and not to limit the same; while the invention has been described in detail and with reference to the foregoing embodiments, it will be understood by those skilled in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some or all of the technical features may be equivalently replaced; and the modifications or the substitutions do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present invention.
Claims (10)
1. An abnormity monitoring method for terminals with the same number is characterized by comprising the following steps:
according to a terminal identification corresponding to the same telephone number, when acquiring event information sent by a terminal indicated by the terminal identification, acquiring event time of an event; the event refers to a communication operation which is performed by the same number terminal responding to the user operation or automatically;
when the event time interval corresponding to at least 2 terminal identifications is determined to be smaller than a preset time interval, acquiring cell identifications of cells connected with the terminals corresponding to the at least 2 terminal identifications respectively;
and if the cell identifiers corresponding to the at least 2 terminal identifiers respectively comprise non-adjacent cell identifiers, determining abnormal terminals in the terminals indicated by the at least 2 terminal identifiers respectively.
2. The method according to claim 1, wherein determining an abnormal terminal among the terminals respectively indicated by the at least 2 terminal identifications comprises:
acquiring a reference cell identifier of a cell connected with a preset reference terminal;
and determining the terminal indicated by the terminal identifier corresponding to the cell identifier which is not adjacent to the reference cell identifier as an abnormal terminal in the terminals indicated by the at least 2 terminal identifiers.
3. The method according to claim 1 or 2, wherein after determining an abnormal terminal among the terminals respectively indicated by the at least 2 terminal identifiers, the method further comprises:
acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all interactive event identifications;
if so, acquiring a position corresponding to a cell connected with the abnormal terminal, and generating abnormal use alarm information according to a terminal identifier of the abnormal terminal, the position corresponding to the cell connected with the abnormal terminal and an event identifier of an event occurring in the abnormal terminal;
if not, acquiring the position corresponding to the cell connected with the abnormal terminal, and generating terminal position abnormal information according to the terminal identifier of the abnormal terminal and the position corresponding to the cell connected with the abnormal terminal.
4. The method according to claim 2, wherein before the obtaining the reference cell identifier of the cell to which the preset reference terminal is connected, the method further comprises:
obtaining event generation frequency corresponding to the terminal indicated by each terminal identifier according to the number of the event identifiers of the terminal events indicated by the terminal identifiers within a preset time period;
and determining the terminal indicated by the terminal identifier corresponding to the highest event generation frequency as a preset reference terminal.
5. The method of claim 3, wherein the interaction class event identifying the indicated event comprises: making or receiving a call;
correspondingly, the obtaining event identifiers of the events corresponding to the at least 2 terminal identifiers, and determining whether the event identifiers are all interactive event identifiers includes:
and acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all used for making or receiving calls.
6. The abnormity monitoring device of the same number terminal is characterized by comprising:
the event acquisition module is used for acquiring event time when the terminal which is indicated by the terminal identification sends event information according to the terminal identification corresponding to the same telephone number; the event refers to a communication operation which is performed by the same number terminal responding to the user operation or automatically;
a cell identifier obtaining module, configured to obtain cell identifiers, where at least 2 terminal identifiers correspond to cells to which terminals are connected, when it is determined that an interval between event times corresponding to at least 2 terminal identifiers is smaller than a preset time interval;
and an abnormal terminal determining module, configured to determine an abnormal terminal among the terminals respectively indicated by the at least 2 terminal identifiers, if the cell identifiers respectively corresponding to the at least 2 terminal identifiers include non-adjacent cell identifiers.
7. The apparatus of claim 6, wherein the abnormal termination determination module is configured to: if the cell identifiers respectively corresponding to the at least 2 terminal identifiers comprise non-adjacent cell identifiers, acquiring a reference cell identifier of a cell connected with a preset reference terminal; and determining the terminal indicated by the terminal identifier corresponding to the cell identifier which is not adjacent to the reference cell identifier as an abnormal terminal in the terminals indicated by the at least 2 terminal identifiers.
8. The apparatus of claim 6 or 7, further comprising: an event determination module to:
after determining abnormal terminals in the terminals respectively indicated by the at least 2 terminal identifications, acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all interactive event identifications; if so, acquiring a position corresponding to a cell connected with the abnormal terminal, and generating abnormal use alarm information according to a terminal identifier of the abnormal terminal, the position corresponding to the cell connected with the abnormal terminal and an event identifier of an event occurring in the abnormal terminal; if not, acquiring the position corresponding to the cell connected with the abnormal terminal, and generating terminal position abnormal information according to the terminal identifier of the abnormal terminal and the position corresponding to the cell connected with the abnormal terminal.
9. The apparatus of claim 7, wherein the abnormal termination determining module is further configured to: before acquiring a reference cell identifier of a cell connected with a preset reference terminal, obtaining event generation frequency corresponding to a terminal indicated by each terminal identifier according to the number of event identifiers of terminal events indicated by the terminal identifier within a preset time period; and determining the terminal indicated by the terminal identifier corresponding to the highest event generation frequency as a preset reference terminal.
10. The apparatus of claim 8, wherein the event indicated by the interaction class event identifier comprises: making or receiving a call;
correspondingly, the event judgment module is used for: and acquiring event identifications of events corresponding to the at least 2 terminal identifications, and judging whether the event identifications are all used for making or receiving calls.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810562003.2A CN108513303B (en) | 2018-06-04 | 2018-06-04 | Abnormity monitoring method and device for same number terminal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810562003.2A CN108513303B (en) | 2018-06-04 | 2018-06-04 | Abnormity monitoring method and device for same number terminal |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108513303A CN108513303A (en) | 2018-09-07 |
| CN108513303B true CN108513303B (en) | 2021-02-09 |
Family
ID=63402383
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810562003.2A Active CN108513303B (en) | 2018-06-04 | 2018-06-04 | Abnormity monitoring method and device for same number terminal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108513303B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112654047A (en) * | 2019-09-25 | 2021-04-13 | 中兴通讯股份有限公司 | Method, device, base station and storage medium for identifying abnormal terminal |
| EP4058895A4 (en) * | 2019-11-12 | 2022-11-09 | Kingstar Technologies, Inc. | Alerting a device that shares an identity with another device based on user configuration |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101102364A (en) * | 2007-08-01 | 2008-01-09 | 中兴通讯股份有限公司 | Method and system for realizing one-number-for-two phone in supplementary service |
| CN101909126A (en) * | 2010-07-13 | 2010-12-08 | 宇龙计算机通信科技(深圳)有限公司 | Method for monitoring state of mobile terminal and mobile terminal |
| US8988218B2 (en) * | 2013-04-04 | 2015-03-24 | International Business Machines Corporation | Self-detection of lost device status using device-to-device communications with one or more expected neighboring devices |
| CN108848278B (en) * | 2018-06-01 | 2020-04-14 | 中国联合网络通信集团有限公司 | Method, device and equipment for monitoring one-number multi-terminal service safety |
-
2018
- 2018-06-04 CN CN201810562003.2A patent/CN108513303B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN108513303A (en) | 2018-09-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106211167B (en) | A kind of terminal, pseudo-base station recognition methods and system | |
| US9179259B2 (en) | Recognizing unknown actors based on wireless behavior | |
| CN108540755B (en) | Identity recognition method and device | |
| RU2011125590A (en) | METHOD FOR PREVENTING AND IDENTIFYING MOBILE DEVICES AND FORECASTING AND NOTIFICATION SYSTEM FOR IDENTIFICATION OF MOBILE DEVICES | |
| CN103891332A (en) | Detection of suspect wireless access points | |
| CN104980997A (en) | Network access method and mobile communication terminal | |
| CN106454968B (en) | A kind of caller method and device based on CSFB | |
| US10638270B2 (en) | Location-based wireless tracking | |
| WO2016029781A1 (en) | Method and device for switching sim cards of communication terminal and computer storage medium | |
| CN105376711A (en) | Position prompting method and apparatus of wearable device, and wearable device | |
| CN108513303B (en) | Abnormity monitoring method and device for same number terminal | |
| CN110765842B (en) | Identity recognition preprocessing and identity recognition method and equipment | |
| CN106331060B (en) | WIFI-based deployment and control method and system | |
| CN108848278B (en) | Method, device and equipment for monitoring one-number multi-terminal service safety | |
| CN110557722B (en) | Target group partner identification method and related device | |
| CN110536302A (en) | Telecommunication fraud based reminding method and device | |
| CN101834951A (en) | Method for prompting missed call and terminal | |
| CN102264058B (en) | Subscriber identity card control method, device and system | |
| CN107071778A (en) | Pseudo-base station recognition methods and data analysing method | |
| CN109862523A (en) | Far from tracking rescue alarm system | |
| CN105163335B (en) | A kind of network access management method, server, mobile terminal and system | |
| US11395129B2 (en) | Virtual sim card acquisition method, subscriber terminal and server | |
| CN110719586B (en) | Service establishing method, device and server | |
| CN109362079B (en) | Data processing method and device | |
| CN110365831B (en) | Incoming call response method, device, system, storage medium and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |