CN107968730A - The method and system that monitoring Internet of Things network interface card is stolen - Google Patents
The method and system that monitoring Internet of Things network interface card is stolen Download PDFInfo
- Publication number
- CN107968730A CN107968730A CN201610910473.4A CN201610910473A CN107968730A CN 107968730 A CN107968730 A CN 107968730A CN 201610910473 A CN201610910473 A CN 201610910473A CN 107968730 A CN107968730 A CN 107968730A
- Authority
- CN
- China
- Prior art keywords
- internet
- data
- things terminal
- things
- online
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- Bioinformatics & Computational Biology (AREA)
- General Physics & Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Environmental & Geological Engineering (AREA)
- Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- General Health & Medical Sciences (AREA)
- Medical Informatics (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention discloses a kind of method and system for monitoring Internet of Things network interface card and being stolen, it is related to Internet of Things field.Method therein includes：Obtain the critical behavior data of internet-of-things terminal；Judge whether the critical behavior data of internet-of-things terminal exceed the abnormal behaviour threshold value of internet-of-things terminal；If critical behavior data exceed abnormal behaviour threshold value, it is determined that the network interface card of internet-of-things terminal is stolen.The present invention can have found the abnormal conditions of internet-of-things terminal in time, so as to prevent the situation that Internet of Things network interface card is stolen early.
Description
Technical field
The present invention relates to Internet of Things field, more particularly to a kind of method and system for monitoring Internet of Things network interface card and being stolen.
Background technology
Internet of Things network interface card in internet-of-things terminal, can realize that the wireless data communication network of internet-of-things terminal connects
Enter, and realization and the data communication between business platform or operation management platform.It is but this in unattended Internet of Things
The Internet of Things network interface card used in network termination is easy to be unlawfully removed, for surfing the Internet, ordering SP business etc. so that cause terminal without
Method normally uploads data and extra data expense is brought to Internet of Things network users.
The content of the invention
The invention solves a technical problem be to provide and a kind of monitor the method and system energy that is stolen of Internet of Things network interface card
Enough abnormal conditions for finding internet-of-things terminal in time, so as to prevent the situation that Internet of Things network interface card is stolen early.
According to an aspect of the present invention, a kind of method for monitoring Internet of Things network interface card and being stolen is proposed, including：Obtain internet-of-things terminal
Critical behavior data；Judge whether the critical behavior data of internet-of-things terminal exceed the abnormal behaviour threshold value of internet-of-things terminal；
If critical behavior data exceed abnormal behaviour threshold value, it is determined that the network interface card of internet-of-things terminal is stolen.
Further, this method further includes：The online criterion behavior storehouse of internet-of-things terminal is built, determines internet-of-things terminal
Abnormal behaviour threshold value.
Further, building the online criterion behavior storehouse of internet-of-things terminal includes：Obtain the depth in mobile data network
Data packet detects DPI data and/or call bill data；It is whole that DPI data and/or call bill data are carried out with cluster analysis structure Internet of Things
The online criterion behavior storehouse at end.
Further, DPI data and/or call bill data are carried out with the online standard row of cluster analysis structure internet-of-things terminal
Include for storehouse：Critical field data in DPI data and/or call bill data are extracted and changed, are obtained in the scheduled time
The surf time of internet-of-things terminal, the online frequency, the behavioral data of surf the Internet position, surfing flow size and/or direction of the traffic；It is right
Behavioral data carries out cluster analysis, builds the online criterion behavior storehouse of internet-of-things terminal.
Further, it is determined that the abnormal behaviour threshold value of internet-of-things terminal includes：The angle calculated according to historical data and cognition
Degree, determines the abnormal behaviour threshold value in internet-of-things terminal online criterion behavior storehouse.
Further, this method further includes：If the network interface card of internet-of-things terminal is stolen, to the owner of internet-of-things terminal
Alarm.
According to another aspect of the present invention, it is also proposed that a kind of system for monitoring Internet of Things network interface card and being stolen, including：Terminal behavior
Data capture unit, for obtaining the critical behavior data of internet-of-things terminal；Terminal behavior data determining unit, for judging thing
Whether the critical behavior data of networked terminals exceed the abnormal behaviour threshold value of internet-of-things terminal；Network interface card is stolen determination unit, uses
If exceed abnormal behaviour threshold value in critical behavior data, it is determined that the network interface card of internet-of-things terminal is stolen.
Further, criterion behavior storehouse construction unit and abnormal behaviour threshold value determination unit are further included；Criterion behavior storehouse structure
Build the online criterion behavior storehouse that unit is used to build internet-of-things terminal；Abnormal behaviour threshold value determination unit is used to determine Internet of Things end
The abnormal behaviour threshold value at end.
Further, terminal behavior data capture unit is additionally operable to obtain the depth data bag detection in mobile data network
DPI data and/or call bill data；Criterion behavior storehouse construction unit is used to carry out cluster analysis to DPI data and/or call bill data
Build the online criterion behavior storehouse of internet-of-things terminal.
Further, terminal behavior data capture unit is additionally operable to the critical field in DPI data and/or call bill data
Data are extracted and changed, and obtain in the scheduled time surf time of internet-of-things terminal, the online frequency, online position, online
The behavioral data of uninterrupted and/or direction of the traffic；Criterion behavior storehouse construction unit is used to carry out cluster analysis to behavioral data,
Build the online criterion behavior storehouse of internet-of-things terminal.
Further, abnormal behaviour threshold value determination unit is used for the angle calculated according to historical data and cognition, determines thing
The abnormal behaviour threshold value in networked terminals online criterion behavior storehouse.
Further, which further includes Alarm Unit；If the network interface card that Alarm Unit is used for internet-of-things terminal is stolen,
Alerted to the owner of internet-of-things terminal.
Compared with prior art, the critical behavior data of the invention by monitoring internet-of-things terminal, if internet-of-things terminal
Critical behavior data exceed the abnormal behaviour threshold value of internet-of-things terminal, it is determined that the network interface card of internet-of-things terminal is stolen, the implementation
Example can find the abnormal conditions of internet-of-things terminal in time, so as to prevent the situation that Internet of Things network interface card is stolen early.
By referring to the drawings to the present invention exemplary embodiment detailed description, further feature of the invention and its
Advantage will be made apparent from.
Brief description of the drawings
The attached drawing of a part for constitution instruction the embodiment that the invention has been described, and be used to solve together with the description
Release the principle of the present invention.
Referring to the drawings, according to following detailed description, the present invention can be more clearly understood, wherein：
Fig. 1 is the flow diagram of the one embodiment for the method that present invention monitoring Internet of Things network interface card is stolen.
Fig. 2 is the flow diagram of another embodiment of the method that present invention monitoring Internet of Things network interface card is stolen.
Fig. 3 is the flow diagram of the further embodiment for the method that present invention monitoring Internet of Things network interface card is stolen.
Fig. 4 is the structure diagram of the one embodiment for the system that present invention monitoring Internet of Things network interface card is stolen.
Fig. 5 is the structure diagram of another embodiment of the system that present invention monitoring Internet of Things network interface card is stolen.
Fig. 6 is the structure diagram of the further embodiment for the system that present invention monitoring Internet of Things network interface card is stolen.
Embodiment
Carry out the various exemplary embodiments of detailed description of the present invention now with reference to attached drawing.It should be noted that：Unless in addition have
Body illustrates that the unlimited system of component and the positioned opposite of step, numerical expression and the numerical value otherwise illustrated in these embodiments is originally
The scope of invention.
At the same time, it should be appreciated that for the ease of description, the size of the various pieces shown in attached drawing is not according to reality
Proportionate relationship draw.
The description only actually at least one exemplary embodiment is illustrative to be never used as to the present invention below
And its application or any restrictions that use.
It may be not discussed in detail for technology, method and apparatus known to person of ordinary skill in the relevant, but suitable
In the case of, the technology, method and apparatus should be considered as authorizing part for specification.
In shown here and discussion all examples, any occurrence should be construed as merely exemplary, without
It is as limitation.Therefore, the other examples of exemplary embodiment can have different values.
It should be noted that：Similar label and letter represents similar terms in following attached drawing, therefore, once a certain Xiang Yi
It is defined, then it need not be further discussed in subsequent attached drawing in a attached drawing.
For the object, technical solutions and advantages of the present invention are more clearly understood, below in conjunction with specific embodiment, and reference
Attached drawing, the present invention is described in more detail.
Fig. 1 is the flow diagram of the one embodiment for the method that present invention monitoring Internet of Things network interface card is stolen.This method bag
Include following steps：
In step 110, the critical behavior data of internet-of-things terminal are obtained.For example, the DPI in collection mobile data network
((call detail record, calling are detailed by (Deep Packet Inspection, the detection of depth data bag) data and CDR
Record) call bill data, critical field data are extracted and changed, extraction the internet-of-things terminal surf time, online the frequency, on
Net the internet-of-things terminal behavioural characteristics such as position, surfing flow size and direction.
In step 120, judge whether the critical behavior data of internet-of-things terminal exceed the abnormal behaviour threshold of internet-of-things terminal
Value, if performing step 130 more than if, otherwise performs step 140.Wherein it is possible to first build the online standard row of internet-of-things terminal
For storehouse, the abnormal behaviour threshold value of internet-of-things terminal is determined.For example, to internet-of-things terminal surf time, online frequency in a period of time
The internet-of-things terminal behavioural characteristics such as secondary, online position, surfing flow size and direction are counted, and according to these information, it is right
Internet-of-things terminal carries out cluster analysis, establishes internet-of-things terminal online criterion behavior storehouse；According to cluster analysis result, Internet of Things is built
The model of network termination internet behavior and there is the threshold value of abnormal behaviour.
In step 130, determine that the network interface card of internet-of-things terminal is stolen.If the critical behavior feature of internet-of-things terminal with not
When meeting model needs and threshold range, then assert that the Internet of Things network interface card in the internet-of-things terminal is stolen.
In step 140, determine that the network interface card of internet-of-things terminal is not stolen.
In this embodiment, by monitoring the critical behavior data of internet-of-things terminal, if the critical behavior of internet-of-things terminal
Data exceed internet-of-things terminal abnormal behaviour threshold value, it is determined that the network interface card of internet-of-things terminal is stolen, the embodiment can and
The abnormal conditions of Shi Faxian internet-of-things terminals, so as to prevent the situation that Internet of Things network interface card is stolen early.
Fig. 2 is the flow diagram of another embodiment of the method that present invention monitoring Internet of Things network interface card is stolen.This method
Comprise the following steps：
In step 210, the DPI data and CDR call bill datas in mobile data network are gathered.
In step 220, DPI data and CDR call bill datas are extracted and changed, it is whole to obtain Internet of Things in the scheduled time
The behavioural characteristic data at end.For example, ripe ETL (Extract-Transform-Load, data pick-up, conversion can be utilized
And state) extraction, conversion of the technology component realization to critical field, so as to complete the cleaning to DPI data and CDR call bill datas
And loading, the surf time of internet-of-things terminal, the online frequency, online position, surfing flow size and side were obtained in the scheduled time
To etc. behavioural characteristic data.
In step 230, cluster analysis is carried out to the behavioural characteristic data of internet-of-things terminal in the scheduled time, establishes Internet of Things
Terminal online criterion behavior storehouse.Such as obtain the scheduled time in internet-of-things terminal surf time, online the frequency, online position,
The field such as surfing flow size and direction carries out the subdivision cluster analysis of user's internet behavior feature, and different industry users has difference
Online feature, have different classification, therefore internet-of-things terminal online criterion behavior storehouse can be constructed.
In step 240, according to cluster analysis result, build the model of internet-of-things terminal internet behavior and abnormal behaviour occur
Threshold value.It is to carry out Internet of Things network interface card to be stolen the key of judgement to internet-of-things terminal abnormal behaviour given threshold, therefore can be with
The angle calculated according to historical data and cognition, determines the abnormal behaviour threshold value in internet-of-things terminal online criterion behavior storehouse.Wherein,
In internet-of-things terminal internet behavior Clustering Model, as soon as the key feature of each classification is typically a specific scope, threshold value
It is an interval range, such as：It is smaller that electric meter sensor monthly only once transmits data, data volume；And Video Monitoring Terminal is every
It is larger that it can all upload data, data volume.Different internet-of-things terminal online periods, the scope of data volume are determined according to industrial characteristic
Different, i.e. the threshold range of these data is different.In Data Analysis Model, the industry attribute according to terminal user is understood,
Different internet behavior threshold ranges is defined for these terminal users.
In this embodiment, for internet-of-things terminal behavioral characteristic, the analysis model of internet-of-things terminal internet behavior is built,
Carried out according to critical field information such as internet-of-things terminal surf time, the online frequency, online position, surfing flow size and directions
Cluster analysis, establishes internet-of-things terminal online criterion behavior analysis model storehouse and the threshold value of abnormal behaviour occurs, subsequently to sentence
Whether disconnected Internet of Things network interface card is stolen to provide foundation.
The flow diagram of the further embodiment for the method that Fig. 3 is stolen for present invention monitoring Internet of Things network interface card, this method
It is further comprising the steps of：
In step 250, the critical behavior feature of internet-of-things terminal is monitored in real time, i.e., obtains internet-of-things terminal in real time
Surf time, the online frequency, online position, the behavioural characteristic such as surfing flow size and direction.
In step 260, the critical behavior feature of internet-of-things terminal and internet-of-things terminal online criterion behavior storehouse are compared
Compared with according to model needs and threshold range, judging whether Internet of Things network interface card is stolen, step 270 performed if stolen, otherwise may be used
To terminate flow.
In step 270, will be audited in the stolen Internet of Things network interface card storehouse of the network interface card deposit of stolen internet-of-things terminal.
If it find that during unusual change, it is assumed that the network interface card in the internet-of-things terminal may be stolen, then it is deposited into stolen
Data examination ＆ verification is carried out in Internet of Things network interface card storehouse.The purpose wherein audited is to confirm the net of these internet-of-things terminals being found
The abnormal internet behavior of card, if be the behavior that business allows；If it is not, determining that these Internet of Things network interface cards are stolen, belong to
In illegal terminal internet behavior.
In step 280, after the data examination ＆ verification in stolen Internet of Things network interface card storehouse, send short message to user or mail carries out
Alarm.
In this embodiment, for internet-of-things terminal behavioral characteristic, the analysis model of structure internet-of-things terminal internet behavior
And there is the threshold value of abnormal behaviour, by being monitored in real time to the critical behavior feature of internet-of-things terminal, if Internet of Things is whole
The critical behavior feature at end exceedes the abnormal behaviour threshold value of internet-of-things terminal, it is determined that and the network interface card of internet-of-things terminal is stolen, and
It can be alerted by short message or lettergram mode to user, therefore can find the abnormal conditions of internet-of-things terminal in time, from
And the behavior that Internet of Things network interface card is usurped early is prevented, ensure the normal internet business flow of internet-of-things terminal, avoid causing thing
Networked terminals can not upload data and produce extra-pay.
Fig. 4 is the structure diagram of the one embodiment for the system that present invention monitoring Internet of Things network interface card is stolen.The system bag
Include terminal behavior data capture unit 410, terminal behavior data determining unit 420 and network interface card and be stolen determination unit 430, its
In：
Terminal behavior data capture unit is used for the critical behavior data for obtaining internet-of-things terminal.For example, the mobile number of collection
According to the DPI data and CDR call bill datas in network, critical field data are extracted and changed, extracted on internet-of-things terminal
Net the internet-of-things terminal behavioural characteristics such as time, the online frequency, online position, surfing flow size and direction.
Terminal behavior data determining unit 420 is used to judge whether the critical behavior data of internet-of-things terminal exceed Internet of Things
The abnormal behaviour threshold value of terminal.Wherein it is possible to first build the online criterion behavior storehouse of internet-of-things terminal, internet-of-things terminal is determined
Abnormal behaviour threshold value.For example, big to internet-of-things terminal surf time, the online frequency, online position, surfing flow in a period of time
The internet-of-things terminal behavioural characteristic such as small and direction is counted, and according to these information, cluster analysis is carried out to internet-of-things terminal,
Establish internet-of-things terminal online criterion behavior storehouse；According to cluster analysis result, build internet-of-things terminal internet behavior model and
There is the threshold value of abnormal behaviour.
If network interface card is stolen determination unit 430 exceedes abnormal behaviour threshold value for critical behavior data, it is determined that Internet of Things
The network interface card of terminal is stolen.I.e. the critical behavior feature of internet-of-things terminal is with when not meeting model needs and threshold range, then recognizing
Internet of Things network interface card in the fixed internet-of-things terminal is stolen.
In this embodiment, by monitoring the critical behavior data of internet-of-things terminal, if the critical behavior of internet-of-things terminal
Data exceed internet-of-things terminal abnormal behaviour threshold value, it is determined that the network interface card of internet-of-things terminal is stolen, the embodiment can and
The abnormal conditions of Shi Faxian internet-of-things terminals, so as to prevent the situation that Internet of Things network interface card is stolen early.
Fig. 5 is the structure diagram of another embodiment of the system that present invention monitoring Internet of Things network interface card is stolen.The system
Including terminal behavior data capture unit 510, criterion behavior storehouse construction unit 520 and abnormal behaviour threshold value determination unit 530, its
In：
Terminal behavior data capture unit 510 is used to gather the DPI data and CDR call bill datas in mobile data network,
And DPI data and CDR call bill datas are extracted and changed, obtain the behavioural characteristic number of internet-of-things terminal in the scheduled time
According to.For example, ripe ETL technology components can be utilized to realize extraction, conversion to critical field, so as to complete to DPI data
With the cleaning and loading of CDR call bill datas, the surf time of internet-of-things terminal, the online frequency, online position were obtained in the scheduled time
Put, the behavioural characteristic data such as surfing flow size and direction.
Criterion behavior storehouse construction unit 520 is used to cluster the behavioural characteristic data of internet-of-things terminal in the scheduled time
Analysis, establishes internet-of-things terminal online criterion behavior storehouse.Such as the surf time of internet-of-things terminal, online were obtained in the scheduled time
The fields such as the frequency, online position, surfing flow size and direction carry out the subdivision cluster analysis of user's internet behavior feature, different
Industry user has different online features, has different classification, therefore can construct internet-of-things terminal online criterion behavior
Storehouse.
Abnormal behaviour threshold value determination unit 530 is used for according to cluster analysis result, structure internet-of-things terminal internet behavior
Model and there is the threshold value of abnormal behaviour.It is to carry out Internet of Things network interface card to be stolen and sentence to internet-of-things terminal abnormal behaviour given threshold
Disconnected key, therefore the angle that can be calculated according to historical data and cognition, determine internet-of-things terminal online criterion behavior storehouse
Abnormal behaviour threshold value.
In this embodiment, for internet-of-things terminal behavioral characteristic, the analysis model of internet-of-things terminal internet behavior is built,
Carried out according to critical field information such as internet-of-things terminal surf time, the online frequency, online position, surfing flow size and directions
Cluster analysis, establishes internet-of-things terminal online criterion behavior analysis model storehouse and the threshold value of abnormal behaviour occurs, subsequently to sentence
Whether disconnected Internet of Things network interface card is stolen to provide foundation.
Fig. 6 is the structure diagram of the further embodiment for the system that present invention monitoring Internet of Things network interface card is stolen.The system
Including terminal behavior data capture unit 610, criterion behavior storehouse construction unit 620, abnormal behaviour threshold value determination unit 630, end
End behavioral data judging unit 640 and network interface card are stolen determination unit 650, wherein：
Terminal behavior data capture unit 610 is used to gather the DPI data and CDR call bill datas in mobile data network,
And DPI data and CDR call bill datas are extracted and changed, obtain the behavioural characteristic number of internet-of-things terminal in the scheduled time
According to, and the critical behavior feature of internet-of-things terminal is monitored in real time.Criterion behavior storehouse construction unit 620 is used for predetermined
The behavioural characteristic data of internet-of-things terminal carry out cluster analysis in time, establish internet-of-things terminal online criterion behavior storehouse.It is abnormal
Behavior asset pricing determination unit 630 is used for the model that internet-of-things terminal internet behavior is built according to cluster analysis result and occurs different
The threshold value of Chang Hangwei.Terminal behavior data determining unit 640 is used for the critical behavior feature of internet-of-things terminal and Internet of Things is whole
End online criterion behavior storehouse is compared, and according to model needs and threshold range, judges whether Internet of Things network interface card is stolen.Network interface card quilt
If usurping determination unit 650 is used for the critical behavior feature of internet-of-things terminal and when not meeting model needs and threshold range,
Then assert that the Internet of Things network interface card in the internet-of-things terminal may be stolen, the network interface card of stolen internet-of-things terminal can also be deposited
Enter and audited in stolen Internet of Things network interface card storehouse, if the network interface card exception internet behavior of internet-of-things terminal is allowed by business
Behavior, then it is assumed that the Internet of Things network interface card is stolen, belongs to illegal terminal internet behavior.
It can also include Alarm Unit 660 in the embodiment, Alarm Unit 660 is used in stolen Internet of Things network interface card storehouse
Data examination ＆ verification after, send short message or mail to user and alerted.
In this embodiment, for internet-of-things terminal behavioral characteristic, the analysis model of structure internet-of-things terminal internet behavior
And there is the threshold value of abnormal behaviour, by being monitored in real time to the critical behavior feature of internet-of-things terminal, if Internet of Things is whole
The critical behavior feature at end exceedes the abnormal behaviour threshold value of internet-of-things terminal, it is determined that and the network interface card of internet-of-things terminal is stolen, and
It can be alerted by short message or lettergram mode to user, therefore can find the abnormal conditions of internet-of-things terminal in time, from
And the behavior that Internet of Things network interface card is usurped early is prevented, ensure the normal internet business flow of internet-of-things terminal, avoid causing thing
Networked terminals can not upload data and produce extra-pay.
The present invention realizes and internet-of-things terminal internet behavior is monitored in real time suitable for internet of things service via operation analytic system
Scene.
So far, the present invention is described in detail.In order to avoid the design of the masking present invention, it is public that this area institute is not described
Some details known.Those skilled in the art as described above, can be appreciated how to implement technology disclosed herein completely
Scheme.
The method and device of the present invention may be achieved in many ways.For example, can by software, hardware, firmware or
Person's software, hardware, firmware any combinations come realize the present invention method and device.The step of for the method it is above-mentioned
Order is merely to illustrate, and the step of method of the invention is not limited to order described in detail above, unless with other sides
Formula illustrates.In addition, in certain embodiments, the present invention can be also embodied as recording program in the recording medium, these
Program includes the machine readable instructions for being used for realization the method according to the invention.Thus, the present invention also covering storage is used to perform
The recording medium of the program of the method according to the invention.
Although some specific embodiments of the present invention are described in detail by example, the skill of this area
Art personnel it should be understood that above example merely to illustrating, the scope being not intended to be limiting of the invention.The skill of this area
Art personnel are it should be understood that without departing from the scope and spirit of the present invention can modify above example.This hair
Bright scope is defined by the following claims.
Claims (12)
- A kind of 1. method for monitoring Internet of Things network interface card and being stolen, it is characterised in that including：Obtain the critical behavior data of internet-of-things terminal；Judge whether the critical behavior data of the internet-of-things terminal exceed the abnormal behaviour threshold value of internet-of-things terminal；If the critical behavior data exceed the abnormal behaviour threshold value, it is determined that the network interface card of the internet-of-things terminal is stolen.
- 2. according to the method described in claim 1, it is characterized in that, further include：The online criterion behavior storehouse of the internet-of-things terminal is built, determines the abnormal behaviour threshold value of the internet-of-things terminal.
- 3. the according to the method described in claim 2, it is characterized in that, online criterion behavior of the structure internet-of-things terminal Storehouse includes：Obtain depth data bag detection DPI data and/or the call bill data in mobile data network；The DPI data and/or call bill data are carried out with the online criterion behavior storehouse that cluster analysis builds the internet-of-things terminal.
- 4. according to the method described in claim 3, it is characterized in that, the DPI data and/or call bill data are carried out with cluster point The destructed online criterion behavior storehouse for building the internet-of-things terminal includes：Critical field data in the DPI data and/or call bill data are extracted and changed, obtain institute in the scheduled time State the behavioral data of the surf time of internet-of-things terminal, the frequency of surfing the Internet, online position, surfing flow size and/or direction of the traffic；Cluster analysis is carried out to the behavioral data, builds the online criterion behavior storehouse of the internet-of-things terminal.
- 5. the according to the method described in claim 2, it is characterized in that, abnormal behaviour threshold value for determining the internet-of-things terminal Including：The angle calculated according to historical data and cognition, determines the abnormal behaviour threshold in the internet-of-things terminal online criterion behavior storehouse Value.
- 6. according to any methods of claim 1-5, it is characterised in that further include：If the network interface card of the internet-of-things terminal is stolen, alerted to the owner of the internet-of-things terminal.
- A kind of 7. system for monitoring Internet of Things network interface card and being stolen, it is characterised in that including：Terminal behavior data capture unit, for obtaining the critical behavior data of internet-of-things terminal；Terminal behavior data determining unit, it is whole whether the critical behavior data for judging the internet-of-things terminal exceed Internet of Things The abnormal behaviour threshold value at end；Network interface card is stolen determination unit, if exceeding the abnormal behaviour threshold value for the critical behavior data, it is determined that described The network interface card of internet-of-things terminal is stolen.
- 8. system according to claim 7, it is characterised in that further include criterion behavior storehouse construction unit and abnormal behaviour threshold It is worth determination unit；Criterion behavior storehouse construction unit is used for the online criterion behavior storehouse for building the internet-of-things terminal；The abnormal behaviour threshold value determination unit is used for the abnormal behaviour threshold value for determining the internet-of-things terminal.
- 9. system according to claim 8, it is characterised in thatThe terminal behavior data capture unit is additionally operable to obtain the depth data bag detection DPI data in mobile data network And/or call bill data；Criterion behavior storehouse construction unit is used to carry out described in cluster analysis structure the DPI data and/or call bill data The online criterion behavior storehouse of internet-of-things terminal.
- 10. system according to claim 9, it is characterised in thatThe terminal behavior data capture unit is additionally operable to the critical field data in the DPI data and/or call bill data Extracted and changed, obtain in the scheduled time surf time of the internet-of-things terminal, the online frequency, online position, online The behavioral data of uninterrupted and/or direction of the traffic；Criterion behavior storehouse construction unit is used to carry out cluster analysis to the behavioral data, builds the internet-of-things terminal Online criterion behavior storehouse.
- 11. system according to claim 8, it is characterised in thatThe abnormal behaviour threshold value determination unit is used for the angle calculated according to historical data and cognition, determines that the Internet of Things is whole The abnormal behaviour threshold value in end online criterion behavior storehouse.
- 12. according to any systems of claim 7-11, it is characterised in that further include Alarm Unit；If the network interface card that the Alarm Unit is used for the internet-of-things terminal is stolen, accused to the owner of the internet-of-things terminal It is alert.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610910473.4A CN107968730A (en) | 2016-10-19 | 2016-10-19 | The method and system that monitoring Internet of Things network interface card is stolen |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610910473.4A CN107968730A (en) | 2016-10-19 | 2016-10-19 | The method and system that monitoring Internet of Things network interface card is stolen |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN107968730A true CN107968730A (en) | 2018-04-27 |
Family
ID=61996246
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610910473.4A Pending CN107968730A (en) | 2016-10-19 | 2016-10-19 | The method and system that monitoring Internet of Things network interface card is stolen |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107968730A (en) |
Cited By (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108768765A (en) * | 2018-05-11 | 2018-11-06 | 中国联合网络通信集团有限公司 | Abnormality Internet of Things network interface card checking method, device and computer readable storage medium |
| CN109168168A (en) * | 2018-07-09 | 2019-01-08 | 上海欣方智能系统有限公司 | A method of detecting international free call on sb. else's expense through illegal means |
| CN109195154A (en) * | 2018-08-13 | 2019-01-11 | 中国联合网络通信集团有限公司 | Internet of Things alters card user recognition methods and device |
| CN109873812A (en) * | 2019-01-28 | 2019-06-11 | 腾讯科技（深圳）有限公司 | Method for detecting abnormality, device and computer equipment |
| CN110505196A (en) * | 2019-07-02 | 2019-11-26 | 中国联合网络通信集团有限公司 | Internet of Things network interface card method for detecting abnormality and device |
| CN110769449A (en) * | 2018-07-25 | 2020-02-07 | 中国电信股份有限公司 | Method and device for analyzing network connection state of terminal of Internet of things |
| CN110808988A (en) * | 2019-11-08 | 2020-02-18 | 国家计算机网络与信息安全管理中心山西分中心 | Internet of things card service anomaly detection method based on information characteristic entropy and long-short term memory network |
| CN110933698A (en) * | 2019-11-28 | 2020-03-27 | 广州助蜂网络科技有限公司 | Monitoring management method, device and equipment for Internet of things card |
| CN111371633A (en) * | 2018-12-26 | 2020-07-03 | 中国移动通信集团重庆有限公司 | Method, device, equipment and medium for detecting abnormal use of Internet of things card |
| CN111371581A (en) * | 2018-12-26 | 2020-07-03 | 中国移动通信集团重庆有限公司 | Method, device, equipment and medium for detecting business abnormity of Internet of things card |
| CN112019576A (en) * | 2019-05-29 | 2020-12-01 | 中国移动通信集团重庆有限公司 | Service control method, device, computing equipment and computer storage medium |
| CN112350974A (en) * | 2019-08-07 | 2021-02-09 | 中国移动通信集团广东有限公司 | Safety monitoring method and device of Internet of things and electronic equipment |
| CN112543200A (en) * | 2020-12-10 | 2021-03-23 | 国家计算机网络与信息安全管理中心江苏分中心 | Method and system for identifying violation of usage of Internet of things card |
| CN113422693A (en) * | 2021-05-28 | 2021-09-21 | 武汉云图智能科技有限公司 | Model construction method and recognition method of Internet of things equipment and computer equipment |
| CN113766462A (en) * | 2020-06-03 | 2021-12-07 | 中国移动通信集团重庆有限公司 | Internet of things card management method and device and computing equipment |
| CN114640606A (en) * | 2020-12-01 | 2022-06-17 | 中移物联网有限公司 | Abnormity processing method and controller for Internet of things card terminal |
| CN115834342A (en) * | 2022-11-09 | 2023-03-21 | 博瑞得科技有限公司 | CDR and DPI data association-based user perception fault positioning method |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103077356A (en) * | 2013-01-11 | 2013-05-01 | 中国地质大学（武汉） | Protecting and tracking method for primary information of mobile terminal based on user behavior pattern |
| CN103269479A (en) * | 2013-05-07 | 2013-08-28 | 华为技术有限公司 | Call ticket processing method, device and system |
-
2016
- 2016-10-19 CN CN201610910473.4A patent/CN107968730A/en active Pending
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103077356A (en) * | 2013-01-11 | 2013-05-01 | 中国地质大学（武汉） | Protecting and tracking method for primary information of mobile terminal based on user behavior pattern |
| CN103269479A (en) * | 2013-05-07 | 2013-08-28 | 华为技术有限公司 | Call ticket processing method, device and system |
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108768765A (en) * | 2018-05-11 | 2018-11-06 | 中国联合网络通信集团有限公司 | Abnormality Internet of Things network interface card checking method, device and computer readable storage medium |
| CN109168168A (en) * | 2018-07-09 | 2019-01-08 | 上海欣方智能系统有限公司 | A method of detecting international free call on sb. else's expense through illegal means |
| CN109168168B (en) * | 2018-07-09 | 2021-11-30 | 上海欣方智能系统有限公司 | Method for detecting international embezzlement |
| CN110769449A (en) * | 2018-07-25 | 2020-02-07 | 中国电信股份有限公司 | Method and device for analyzing network connection state of terminal of Internet of things |
| CN110769449B (en) * | 2018-07-25 | 2022-09-02 | 中国电信股份有限公司 | Method and device for analyzing network connection state of terminal of Internet of things |
| CN109195154A (en) * | 2018-08-13 | 2019-01-11 | 中国联合网络通信集团有限公司 | Internet of Things alters card user recognition methods and device |
| CN111371633A (en) * | 2018-12-26 | 2020-07-03 | 中国移动通信集团重庆有限公司 | Method, device, equipment and medium for detecting abnormal use of Internet of things card |
| CN111371581A (en) * | 2018-12-26 | 2020-07-03 | 中国移动通信集团重庆有限公司 | Method, device, equipment and medium for detecting business abnormity of Internet of things card |
| CN109873812A (en) * | 2019-01-28 | 2019-06-11 | 腾讯科技（深圳）有限公司 | Method for detecting abnormality, device and computer equipment |
| CN112019576A (en) * | 2019-05-29 | 2020-12-01 | 中国移动通信集团重庆有限公司 | Service control method, device, computing equipment and computer storage medium |
| CN110505196A (en) * | 2019-07-02 | 2019-11-26 | 中国联合网络通信集团有限公司 | Internet of Things network interface card method for detecting abnormality and device |
| CN112350974A (en) * | 2019-08-07 | 2021-02-09 | 中国移动通信集团广东有限公司 | Safety monitoring method and device of Internet of things and electronic equipment |
| CN110808988A (en) * | 2019-11-08 | 2020-02-18 | 国家计算机网络与信息安全管理中心山西分中心 | Internet of things card service anomaly detection method based on information characteristic entropy and long-short term memory network |
| CN110808988B (en) * | 2019-11-08 | 2021-09-10 | 国家计算机网络与信息安全管理中心山西分中心 | Internet of things card service anomaly detection method based on information characteristic entropy and long-short term memory network |
| CN110933698A (en) * | 2019-11-28 | 2020-03-27 | 广州助蜂网络科技有限公司 | Monitoring management method, device and equipment for Internet of things card |
| CN113766462A (en) * | 2020-06-03 | 2021-12-07 | 中国移动通信集团重庆有限公司 | Internet of things card management method and device and computing equipment |
| CN114640606A (en) * | 2020-12-01 | 2022-06-17 | 中移物联网有限公司 | Abnormity processing method and controller for Internet of things card terminal |
| CN112543200A (en) * | 2020-12-10 | 2021-03-23 | 国家计算机网络与信息安全管理中心江苏分中心 | Method and system for identifying violation of usage of Internet of things card |
| CN113422693A (en) * | 2021-05-28 | 2021-09-21 | 武汉云图智能科技有限公司 | Model construction method and recognition method of Internet of things equipment and computer equipment |
| CN115834342A (en) * | 2022-11-09 | 2023-03-21 | 博瑞得科技有限公司 | CDR and DPI data association-based user perception fault positioning method |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107968730A (en) | The method and system that monitoring Internet of Things network interface card is stolen | |
| CN109815818B (en) | Target person tracking method, system and related device | |
| CN105376255B (en) | A kind of Android platform intrusion detection method based on K-means cluster | |
| US20180130074A1 (en) | Method and device for calculating customer traffic volume | |
| CN107808502B (en) | A kind of image detection alarm method and device | |
| CN102802133B (en) | Junk information identification method, device and system | |
| CN108471429A (en) | A kind of network attack alarm method and system | |
| CN108491720B (en) | Application identification method, system and related equipment | |
| CN107992739A (en) | User authentication method, apparatus and system | |
| CN106791655B (en) | A kind of method for processing video frequency and device | |
| CN108683687A (en) | A kind of network attack identification method and system | |
| CN104205127A (en) | Recognition-based security | |
| CN104836781A (en) | Method distinguishing identities of access users, and device | |
| CN104036037A (en) | Method and device for processing junk user | |
| CN108881263A (en) | A kind of network attack result detection method and system | |
| CN102930243A (en) | Method and system for identifying facial information of special personnel | |
| CN206179048U (en) | Personal identification device | |
| CN103338362B (en) | A kind of event-handling method based on video monitoring system and system | |
| CN105243252A (en) | Account risk evaluation method and apparatus | |
| CN104253714A (en) | Monitoring method, system, browser and server | |
| WO2021212760A1 (en) | Method and apparatus for determining identity type of person, and electronic system | |
| CN109559336A (en) | Object tracking method, device and storage medium | |
| CN107131607A (en) | Monitoring method, device and system based on air conditioner and air conditioner | |
| CN109284594A (en) | A kind of smart machine screen locking control method and device based on Face datection | |
| CN110363180A (en) | A kind of method and apparatus and equipment that statistics stranger's face repeats |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20180427 |
|
| RJ01 | Rejection of invention patent application after publication |