CN110505196B - Internet of things network card abnormality detection method and device - Google Patents
Internet of things network card abnormality detection method and device Download PDFInfo
- Publication number
- CN110505196B CN110505196B CN201910591205.4A CN201910591205A CN110505196B CN 110505196 B CN110505196 B CN 110505196B CN 201910591205 A CN201910591205 A CN 201910591205A CN 110505196 B CN110505196 B CN 110505196B
- Authority
- CN
- China
- Prior art keywords
- result
- internet
- classification result
- behavior data
- things card
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 92
- 230000005856 abnormality Effects 0.000 title claims abstract description 46
- 230000002159 abnormal effect Effects 0.000 claims abstract description 69
- 238000012545 processing Methods 0.000 claims abstract description 47
- 238000000034 method Methods 0.000 claims abstract description 41
- 230000006399 behavior Effects 0.000 claims description 108
- 230000006870 function Effects 0.000 claims description 96
- 238000010801 machine learning Methods 0.000 claims description 11
- 238000004590 computer program Methods 0.000 claims description 9
- 238000012937 correction Methods 0.000 claims description 2
- 238000004891 communication Methods 0.000 abstract description 11
- 230000003542 behavioural effect Effects 0.000 description 8
- 238000005070 sampling Methods 0.000 description 7
- 239000000523 sample Substances 0.000 description 6
- 238000011156 evaluation Methods 0.000 description 4
- 238000012217 deletion Methods 0.000 description 3
- 230000037430 deletion Effects 0.000 description 3
- 238000013461 design Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 230000009286 beneficial effect Effects 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000011664 signaling Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 206010000117 Abnormal behaviour Diseases 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000036541 health Effects 0.000 description 1
- 238000003064 k means clustering Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 239000008399 tap water Substances 0.000 description 1
- 235000020679 tap water Nutrition 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0823—Errors, e.g. transmission errors
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/50—Testing arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Computer Security & Cryptography (AREA)
- General Health & Medical Sciences (AREA)
- Health & Medical Sciences (AREA)
- Medical Informatics (AREA)
- Environmental & Geological Engineering (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Telephonic Communication Services (AREA)
Abstract
The embodiment of the invention discloses a method and a device for detecting abnormality of an Internet of things card, relates to the technical field of communication, and aims to solve the technical problem that in the prior art, the accuracy of an abnormality detection result of the Internet of things card is low. The method comprises the following steps: acquiring service scene information of an Internet of things card to be detected; acquiring behavior data corresponding to the service scene information, acquiring a target rule algorithm for processing the behavior data under the service scene information, classifying the Internet of things card to be detected according to the target rule algorithm and the behavior data, and acquiring a classification result; wherein the classification result comprises: normal, or abnormal; and determining whether the Internet of things card to be detected is abnormal according to the classification result. The embodiment of the invention is used for carrying out abnormity detection on the Internet of things card.
Description
Technical Field
The embodiment of the invention relates to the technical field of communication, in particular to a method and a device for detecting abnormality of an Internet of things card.
Background
The internet of things relates to various fields of life, such as the fields of transportation and logistics, industrial manufacturing, health and medical care, intelligent environment (home, office, factory), and the like. The internet of things card is an internet of things Subscriber Identity Module (SIM) card provided by an operator only for enterprise users. The Internet of things card is based on an Internet of things private network, adopts an Internet of things exclusive number section, supports basic communication services such as short messages, wireless data communication, voice and the like through special network element equipment, provides intelligent channel services such as communication state management, communication authentication and the like, and simultaneously defaults to open a short message Access service number and an Internet of things universal Access Point (AP) special for the Internet of things. Because the transaction process of the internet of things card is difficult to monitor, a large number of internet of things cards are illegally used, a large number of network resources are illegally occupied and wasted, and a lot of losses are caused to operators.
At present, the anomaly detection of the internet of things card generally determines the internet of things card in an abnormal state according to the attribute information and the behavior information of the internet of things card, but in an actual situation, the classification result obtained by adopting the detection mode has the problem of low accuracy.
Disclosure of Invention
The embodiment of the invention provides a method and a device for detecting the abnormality of an Internet of things card, which are used for solving the technical problem that the accuracy of the classification result of the abnormality of the Internet of things card in the prior art is low.
In a first aspect, a method for detecting an abnormality of an internet of things card is provided, including:
acquiring service scene information of an Internet of things card to be detected; acquiring behavior data corresponding to the service scene information, acquiring a target rule algorithm for processing the behavior data under the service scene information, classifying the Internet of things card to be detected according to the target rule algorithm and the behavior data, and acquiring a classification result; wherein the classification result comprises: normal, or abnormal; and determining whether the Internet of things card to be detected is abnormal according to the classification result.
In the method for detecting the abnormality of the internet of things card, provided by the embodiment of the invention, the corresponding behavior data and the target rule algorithm can be obtained according to the service scene information of the internet of things card, then the to-be-detected internet of things card is normally or abnormally classified according to the target rule algorithm and the behavior data, a classification result is obtained, and finally whether the to-be-detected internet of things card is abnormal or not is determined according to the classification result. Therefore, the embodiment of the invention can combine the anomaly detection of the Internet of things card with the actual business form, select targeted identification rules for business data under different business scenes to carry out anomaly detection on the Internet of things card, and effectively improve the accuracy of the anomaly classification result of the Internet of things card.
In a second aspect, an apparatus for detecting an abnormality of an internet of things card is provided, including:
the acquisition module is used for acquiring the service scene information of the Internet of things card to be detected;
the processing module is used for acquiring behavior data corresponding to the service scene information acquired by the acquisition module, acquiring a target rule algorithm for processing the behavior data under the service scene information, and classifying the Internet of things card to be detected according to the target rule algorithm and the behavior data to acquire a classification result; wherein the classification result comprises: normal, or abnormal;
and the determining module is used for determining whether the Internet of things card to be detected is abnormal or not according to the classification result obtained by the processing module.
In a third aspect, an apparatus for detecting an abnormality of an internet of things card is provided, including: one or more processors; the processor is configured to execute a computer program code in the memory, where the computer program code includes an instruction to cause the apparatus for detecting abnormality of the internet of things card to execute the method for detecting abnormality of the internet of things card according to the first aspect.
In a fourth aspect, a storage medium is provided, where instruction codes are stored, and the instruction codes are used to execute the method for detecting the abnormality of the internet of things card according to the first aspect.
In a fifth aspect, a computer program product is provided, where the computer program product includes instruction codes for executing the method for detecting abnormality of the internet of things card according to the first aspect.
It can be understood that, the above-mentioned device for detecting abnormality of an internet of things card, storage medium and computer product are used to execute the above-mentioned method corresponding to the first aspect, so that the beneficial effects that can be achieved by the device can refer to the beneficial effects of the above-mentioned method according to the first aspect and the corresponding solutions in the following detailed description, and are not described herein again.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and the drawings are only for the purpose of illustrating preferred embodiments and are not to be considered as limiting the present invention.
Fig. 1 shows a flowchart of a method for detecting an anomaly of an internet of things card according to an embodiment of the present invention;
fig. 2 shows a flowchart of a method for detecting an anomaly of an internet of things card according to an embodiment of the present invention;
fig. 3 shows a flowchart of a method for detecting an anomaly of an internet of things card according to an embodiment of the present invention;
fig. 4 shows a flowchart of a method for detecting an anomaly of an internet of things card according to an embodiment of the present invention;
fig. 5 is a functional block diagram illustrating a functional structure of an anomaly detection device for an internet of things card according to an embodiment of the present invention;
fig. 6 shows a functional structure block diagram of an anomaly detection device for an internet of things card according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all embodiments of the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application. The use of the terms first, second, etc. do not denote any order, and the terms first, second, etc. may be interpreted as names of the objects described. In the embodiments of the present invention, words such as "exemplary" or "for example" are used to mean serving as examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "e.g.," an embodiment of the present invention is not necessarily to be construed as preferred or advantageous over other embodiments or designs. Rather, use of the word "exemplary" or "such as" is intended to present concepts related in a concrete fashion.
Before the embodiment of the invention is introduced, firstly, a simple introduction is made to an anomaly detection mode of the internet of things in the prior art. At present, the existing internet of things anomaly detection mode is to obtain the attribute information and behavior information of the internet of things card, and then classify the internet of things card according to the attribute information and behavior information of the internet of things card in the same industry so as to determine the internet of things card in a normal state and the internet of things card in an abnormal state. In actual conditions, due to the wide application scenes of the internet of things, massive application scenes such as the internet of vehicles, smart electric meters, smart cities and intelligent transportation are emerging in various industries. The requirements for various parameters such as time delay, rate, flow, standby time, bandwidth and the like are different in each application scenario, and different access technologies may be selected in different application scenarios due to the difference of the parameters. For example, for smart meter services applied to utilities such as energy and tap water, a new generation narrowband internet of things (NB-IoT) transmission technology based on a cellular network may be preferentially selected because of its outstanding characteristics of wide coverage, low power consumption, low cost, strong signal, and the like. The method is particularly suitable for the application scene of data transmission with low frequency and fixed period, such as remote meter reading; as well as the scenario of the internet of vehicles unmanned application, the network has very high requirements for time delay, speed, etc., and therefore needs to be deployed in the network scenario of the fifth generation mobile communication technology (5-generation, 5G), and so on. Therefore, when the service scenes are different, the service forms can have significant differences. When the abnormality of the internet of things is detected at present, the difference of the business scenes is not considered, so that the accuracy of identifying the abnormal behavior of the internet of things is low.
Based on the existing problems, an embodiment of the present invention provides a method for detecting an abnormality of an internet of things card, which is shown in fig. 1 and includes the following steps:
step S110: and acquiring the service scene information of the Internet of things card to be detected.
Step S120: acquiring behavior data corresponding to the service scene information, acquiring a target rule algorithm for processing the behavior data under the service scene information, classifying the Internet of things card to be detected according to the target rule algorithm and the behavior data, and acquiring a classification result; wherein the classification result comprises: normal, or abnormal.
Step S130: and determining whether the Internet of things card to be detected is abnormal according to the classification result.
In the method for detecting the abnormality of the internet of things card, provided by the embodiment of the invention, the behavior data and the target rule algorithm can be obtained according to the service scene information of the internet of things card, then the classification result of the behavior data is obtained according to the target rule algorithm, and finally whether the internet of things card to be detected is abnormal or not is determined according to the classification result. Therefore, the embodiment of the invention can combine the anomaly detection of the Internet of things card with the actual business form, select targeted identification rules for business data under different business scenes to carry out anomaly detection on the Internet of things card, and effectively improve the accuracy of the anomaly classification result of the Internet of things card.
The method for detecting abnormality of the internet of things card provided by the invention is described in detail by the following three specific embodiments.
Fig. 2 shows a method for detecting an abnormality of an internet of things card according to an embodiment of the present invention, which is shown in fig. 2 and includes the following steps:
step S210: and acquiring the service scene information of the Internet of things card to be detected.
Specifically, the service scenario information may be information related to a service scenario applied by the internet of things card, such as an enterprise identifier, a service identifier, and the like. In specific implementation, the obtaining manner of the service scenario information may be set by a person skilled in the art according to an actual situation, which is not limited by the present invention. In a preferred embodiment, the service context information may include: and (5) identifying the enterprise.
Step S220: and acquiring behavior data corresponding to the service scene information, and acquiring a target rule algorithm for processing the behavior data corresponding to the service scene information.
Specifically, there may be multiple ways to obtain behavior data, for example, a corresponding probe may be deployed on a preset interface on the network side, and data information related to service scenario information on the network side is collected through the probe, for example, data related to signaling in the aspect of signaling connection of the internet of things is collected and recorded from an S1-MME interface; acquiring data for recording related information such as user subscription information, roaming information and the like from an S6a interface; collecting Data related to the Network performance of the Internet of things, such as Data related to the establishment, modification or deletion of bearer information, Data related to the establishment, modification or deletion of session information, Data related to the establishment, deletion or Public Data Network (PDN) connection and the like from an S5/S8-C interface and a Gn-C interface; data related to service performance indexes, such as safety information, flow information and the like, are collected from an S5/S8-U interface and a Gn-U interface, and data related to users, such as enterprise user data, such as billing data, industry attribute data and the like, are obtained from Internet of things equipment of the enterprise users; or network engineering parameters of the base station (such as Location Area Code (LAC), Cell Identity (CI), base station longitude, base station latitude, and the like) may also be obtained from the base station side; or Geographic position Information and the like related to the service scene can be acquired through a Geographic Information System (GIS).
Specifically, in the embodiment of the present invention, the behavior data is divided into historical behavior data and real-time behavior data. The real-time behavior data is data used by the Internet of things equipment on line, and becomes historical behavior data after the real-time behavior data is used on line on the Internet of things equipment.
In this embodiment, the acquiring of the behavior data corresponding to the service scenario information may include: and acquiring historical behavior data corresponding to the service scene information. The target rule algorithm for processing the behavior data corresponding to the acquired service scenario information may include: and acquiring a target rule function corresponding to the service scene information from the preset rule function as a target rule algorithm for processing historical behavior data.
The preset rule function will be described in detail below. Specifically, the preset rule function may include: at least one operation characteristic value type and operation rules. The operation rule is used for operating the characteristic value of the at least one operation characteristic value type to obtain a corresponding operation result. In a specific implementation, the operation result may be used to indicate that the usage state of the internet access card is normal or the usage state of the internet access card is abnormal, so the operation result may specifically include two different result values: a first result value and a second result value. Wherein the first result value indicates that the classification result is normal, and the second result value indicates that the classification result is abnormal. In a specific implementation, the first result value and the second result value may be set by a person skilled in the art according to practical situations, and the present invention is not limited thereto. In a preferred embodiment, the first result value is 0, and the second result value is 1.
In a specific implementation, the preset rule function may be represented by the following formula:
y1＝f(x1，x2，...，xn)；
where y1 is the result of the operation, the function f is the rule, and xnThe characteristic value of the nth operation characteristic value type; wherein n is a natural number and n is more than or equal to 1.
In the embodiment of the present invention, the type of the preset rule function may include any one of the following: a terminal information rule function, a flow rule function, a service type and flow rule function, and a number matching rule function. It is understood that at least one operation feature value type included in the different types of preset rule functions and the operation rule thereof are different.
Each of the types of preset rule functions mentioned above will be described below. Specifically, the terminal information rule function may be a preset rule function formulated for the terminal information of the terminal of the internet of things, and in specific implementation, the terminal information rule function may include the following operation feature value types: information related to terminal equipment information, such as a terminal brand, a terminal type, a terminal model and the like; the operation rule of the terminal information rule function may be a logical relationship function between the above feature value types and the user equipment. For example, the following steps are carried out: if the user of the to-be-detected internet of things card is an enterprise a, the terminal brand of the internet of things terminal device of the enterprise a is brand a, and the terminal type is type b, the operational relationship of the terminal information rule function may include: if the terminal brand of the terminal of the internet of things is brand a and the terminal type is type b, the terminal is normal (namely, the using state of the internet of things is normal), and if not, the terminal is abnormal (namely, the using state of the internet of things is abnormal).
The traffic rule function may be a preset rule function formulated for traffic information of the internet of things terminal. In a specific implementation, the flow rule function may include the following operation feature value types: information related to the flow use of the Internet of things terminal, such as the upper limit value of the flow package, the total amount of actual flow use in the evaluation time, and the flow excess threshold value; the operation rule of the flow rule function may be a logical relationship function set for each of the above-described feature value types. For example, the following steps are carried out: if the operation characteristic value type in the flow rule function comprises: the flow package upper limit value, the total amount of actual flow usage within the evaluation time, and the flow excess threshold value, the operation rule of the flow rule function may be: if the total amount of the actual traffic in the evaluation time is greater than the upper limit value of the traffic package and the difference between the total amount of the actual traffic in the evaluation time and the upper limit value of the traffic package is greater than the traffic exceeding threshold value, the operation is abnormal (namely, the usage state of the internet of things network card is abnormal), and if not, the operation is normal (namely, the usage state of the internet of things network card is normal).
The service type and flow rule function may be a preset rule function formulated for the service type and flow of the internet of things terminal. In a specific implementation, the service type and flow rule function may include the following operation feature value types: user identification information, service type flow information and other information related to the service type and the flow; the user identification information may include an enterprise identification or an internet of things terminal identification; the service type flow information may include: a service type or a service flow; the operation rule of the service type and the flow rule function may be a logical relationship function set for each of the above feature value types. For example, if the enterprise identifier of the enterprise B is c, and the service type provided by the enterprise B only includes the smart meter reading service, the operation rule of the service type and the process rule function of the enterprise B may be: if the enterprise identifier is c and the service type only includes the meter reading service of the intelligent electric meter, the operation is normal (namely, the using state of the Internet of things card is normal), and if not, the operation is abnormal (namely, the using state of the Internet of things card is abnormal).
The number matching rule function may be a preset rule function established for a one-to-one binding relationship between the internet of things terminal and the internet of things card. In a specific implementation, the number matching rule function may include the following operation feature value types: an internet protocol card mobile station international subscriber identity (mobile subscriber identity) number (MSISDN), and a terminal International Mobile Equipment Identity (IMEI); the operation rule of the number matching rule function may be a logical relationship function set for each of the above-described feature value types. For example, if the IMEI of the terminal is d and the MSISDN of the internet of things card is e when the enterprise C registers the internet of things card, the operation rule of the number matching rule function may be: if the IMEI of the terminal bound by the e is d, the terminal is normal (namely, the using state of the Internet of things card is normal), otherwise, the terminal is abnormal (namely, the using state of the Internet of things card is abnormal). In specific implementation, after the internet of things card is sold to an enterprise, the binding relationship between the internet of things terminal and the internet of things card is stored in an enterprise database, and the operation rule of the number matching rule function can be generated according to the binding relationship between the internet of things terminal and the internet of things card in the enterprise database.
The outlier rule function is a preset rule function formulated for an operation characteristic value type with a plurality of characteristic values in the terminal of the internet of things, wherein the plurality of characteristic values of the operation characteristic value type comprise: m is1，m2...mnAnd the outlier rule function is used for determining whether the characteristic values contain abnormal values or not, and determining that the use state of the Internet of things card is normal or abnormal according to the determination result. In a specific implementation, the operation rule of the outlier rule function may specifically be: if it is
If the operation state of the Internet of things card is abnormal, otherwise the operation state of the Internet of things card is normal; wherein o is a natural number and n is more than or equal to o and more than or equal to 0,
is m1，m2…mnThe mean after the outliers are removed,
is m1，m2…mnMean deviation after removing outliers, which may be mmaxOr mmin；mmaxIs m1，m2...mnMedium maximum value, mminIs m1，m2…mnThe medium minimum value.
Of course, it is understood that the operation characteristic value types and the operation relationships included in the above listed types of preset rule functions are only exemplary, and in a specific implementation, the operation characteristic value types and the operation relationships included in the types of preset rule functions may be set by those skilled in the art according to actual situations, and the embodiment of the present invention does not limit this.
In a specific implementation, a first corresponding relationship between the preset service scenario information and the preset rule function may be preset, and in this step, when the target rule function corresponding to the service scenario information is obtained, the preset rule function corresponding to the service scenario information in the first corresponding relationship may be obtained according to the first corresponding relationship and used as the target rule function. Of course, it is understood that the above listed manners for obtaining the objective rule function corresponding to the service context information are only exemplary, and in specific implementations, the present invention does not limit the manners for obtaining the objective rule function corresponding to the service context information.
Step S230: and acquiring a characteristic value corresponding to each operation characteristic value type in the target rule function in the historical behavior data.
Specifically, the manner of obtaining the characteristic value may be set by a person skilled in the art according to actual situations, and the present invention is not limited to this.
Step S240: and calculating the characteristic value according to the operation rule, and determining a first classification result according to the operation result.
Specifically, if the operation result is the first result value, the first classification result is determined to be normal, and if the operation result is the second result value, the first classification result is determined to be abnormal.
Step S250: and determining whether the Internet of things card to be detected is abnormal or not according to the first classification result.
Specifically, if the first classification result is abnormal, determining that the to-be-detected internet of things card is abnormal; and if the first classification result is normal, determining that the Internet of things card to be detected is normal.
Fig. 3 shows a method for detecting an abnormality of an internet of things card according to an embodiment of the present invention, which is shown in fig. 3 and includes the following steps:
step S310: and acquiring the service scene information of the Internet of things card to be detected.
The execution manner of this step is the same as that of step S210, and reference may be specifically made to the corresponding description in step S210, which is not described herein again.
Step S320: and acquiring behavior data corresponding to the service scene information, and acquiring a target rule algorithm for processing the behavior data corresponding to the service scene information.
Specifically, in this embodiment, the behavior data may include: real-time behavioral data. The method for acquiring the target rule algorithm corresponding to the service scene information and used for processing the behavior data comprises the following steps: and acquiring a target detection model corresponding to the service scene information from a preset detection model as a target rule algorithm for processing real-time behavior data. The real-time behavior data may refer to the corresponding description in step S220, and is not described herein again.
The preset detection model can be a model obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm, and an output result of the preset detection model comprises a third result value and a fourth result value, wherein the third result value represents that the classification result is normal, and the fourth result value represents that the classification result is abnormal. The machine learning algorithm may be set by a person skilled in the art according to actual situations, for example, a K-means clustering algorithm is adopted, and the embodiment of the present invention does not limit this. The third result value and the fourth result value can be set by those skilled in the art according to practical situations, and the present invention is not limited thereto. Wherein, in a preferred embodiment, the third result value is 0, and the fourth result value is 1. More preferably, the third resulting value may be the same as the first resulting value, and the fourth resulting value may be the same as the second resulting value.
In a specific implementation, a preset detection model corresponding to the preset service scene information may be obtained according to the historical behavior data of the preset service scene information and a preset machine learning algorithm, and a second correspondence relationship is established between the preset detection model and the preset service scene information, and in this step, a preset detection model corresponding to the service scene information in the second correspondence relationship may be obtained according to the second correspondence relationship and used as a target detection model. Of course, it is understood that the above-listed manners of obtaining the object detection model corresponding to the service context information are merely exemplary, and in specific implementations, the present invention does not limit the manners of obtaining the object detection model corresponding to the service context information.
Step S330: and inputting the real-time behavior data into the target detection model, and determining a second classification result according to an output result of the target detection model.
Specifically, if the output result is the third result value, determining that the second classification result is normal; and if the operation result is the fourth result value, determining that the second classification result is abnormal.
Step S340: and determining whether the Internet of things card to be detected is abnormal according to the second classification result.
Specifically, if the second classification result is abnormal, determining that the to-be-detected internet of things card is abnormal; and if the second classification result is normal, determining that the Internet of things card to be detected is normal.
In this embodiment, in order to ensure the accuracy of the target detection model, before the preset detection model corresponding to the preset service scene information is obtained according to the historical behavior data of the preset service scene information and the preset machine learning algorithm, it may be further determined whether the number of sampling points of the historical behavior data is greater than the threshold value of the number of preset sampling points, and if the number of sampling points of the historical behavior data is greater than the threshold value of the number of preset sampling points, the preset detection model corresponding to the service scene information is obtained according to the second correspondence as the target detection model, and step S330 and step S340 are executed; if the number of the sampling points of the historical behavior data is less than or equal to the preset sampling point number threshold, it is determined that the target detection model does not exist, so that the fact that the internet of things card is abnormal is indicated by the historical behavior data of the service scene information, the internet of things card to be detected can be directly determined to be normal, and the output result can be directly determined to be normal in step S330. The preset threshold of the number of sampling points may be set by a person skilled in the art according to an actual situation, which is not limited in the embodiment of the present invention.
Fig. 4 shows a method for detecting an abnormality of an internet of things card according to an embodiment of the present invention, which is shown in fig. 4 and includes the following steps:
step S410: and acquiring the service scene information of the Internet of things card to be detected.
The execution manner of this step is the same as that of step S210, and reference may be specifically made to the corresponding description in step S210, which is not described herein again.
Step S420: and acquiring behavior data corresponding to the service scene information, and acquiring a target rule algorithm for processing the behavior data corresponding to the service scene information.
Specifically, in this embodiment, the behavior data may include: historical behavioral data and real-time behavioral data. Acquiring a target rule algorithm for processing behavior data corresponding to the service scenario information, wherein the target rule algorithm comprises the following steps: and acquiring a target rule function corresponding to the service scene information from the preset rule function as a target rule algorithm for processing historical behavior data, and acquiring a target detection model corresponding to the service scene information from the preset detection model as a target rule algorithm for processing real-time behavior data.
The historical behavior data, the real-time behavior data, the preset rule function and the obtaining manner thereof may refer to the corresponding description in step S220, and are not described herein again.
The preset detection model is obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm; the output result of the preset detection model comprises a fifth result numerical value and a sixth result numerical value, wherein the fifth result numerical value represents that the classification result is normal, and the sixth result numerical value represents that the classification result is abnormal. In this embodiment, the real-time behavior data is input into the target detection model, and the output result of the target detection model is obtained as the third classification result. In a specific implementation, the fifth result value is equal to the third result value in S320, the sixth result value is equal to the fourth result value in S320, and the preset detection model and the obtaining method thereof may refer to the corresponding description in step S320, which is not described herein again.
Step S430: and classifying the Internet of things card to be detected according to the target rule algorithm and the behavior data to obtain a classification result.
Wherein, the classification result may include: normal, or abnormal. In this embodiment, when the behavior data is historical behavior data, the target rule algorithm is corresponding to a target rule function, and in this step, a feature value corresponding to each type of operation feature value in the target rule function in the historical behavior data is obtained, and then the feature value is operated according to the operation rule of the target rule function, and the operation result is used as a first classification result. The obtaining manner of the first classification result may refer to the corresponding description in step S230 and step S240, and is not described herein again. When the behavior data is real-time behavior data, the target rule algorithm corresponds to the target detection model, and then the real-time behavior data can be input into the target detection model, and an output result of the target detection model is obtained as a third classification result. The obtaining manner of the third classification result is the same as that of the second classification result, and reference may be specifically made to the corresponding description about the obtaining manner of the second classification result, which is not described herein again.
Step S440: and acquiring a first classification result operation value corresponding to the first classification result and a third classification result operation value corresponding to the third classification result.
Specifically, before executing this step, an operation value corresponding to the classification result may be preset, and when the classification result is normal, the operation value of the classification result is set as the first operation value; and when the classification result is abnormal, setting the operation value of the classification result as a second operation value. For example, the first operation value may be 0, and the second operation value may be 1; alternatively, the first operation value may be 1, and the second operation value may be 0. In a specific implementation, the corresponding operation value set for the classification result may be used to distinguish different classification results and operate on the classification result. In this step, a first classification result operation value corresponding to the first classification result is obtained according to the operation value corresponding to the classification result, and a third classification result operation value corresponding to the third classification result is obtained according to the operation value corresponding to the classification result.
Step S450: and performing weighting processing on the first classification result operation value and the third classification result operation value to obtain a first weighting result corresponding to the first classification result operation value and obtain a second weighting result corresponding to the third classification result operation value.
Specifically, a first weight corresponding to the first classification result and a second weight corresponding to the third classification result may be set according to the service scenario information, and then a product of the first classification result and the first weight is obtained as a first weighting result and a product of the third classification result and the second weight is obtained as a second weighting result. In a specific implementation, the manner of setting the first weight and the second weight may be set by those skilled in the art according to actual situations, and the embodiment of the present invention is not limited thereto.
Step S460: and summing the first weighting result and the second weighting result to obtain a summation result.
Step S470: and determining whether the Internet of things card to be detected is abnormal or not according to the summation result.
Specifically, it may be determined whether the first operation value is greater than the second operation value, if the first operation value is greater than the second operation value, it is determined whether the summation result is greater than a preset threshold value, if the summation result is yes, it is determined that the internet of things card to be detected is abnormal, and if the summation result is no, it is determined that the internet of things card to be detected is normal. If the first operation value is smaller than the second operation value, whether the summation result is smaller than or equal to a preset threshold value is judged, if yes, the to-be-detected Internet of things is determined to be abnormal, and if not, the to-be-detected Internet of things is determined to be normal.
The preset threshold may be set by a person skilled in the art according to actual situations, and the present invention is not limited thereto.
Further, in this embodiment, after the determination result of the to-be-detected internet of things card is obtained, the target rule algorithm may be modified according to the determination result, for example, the target rule function and the target detection model are retrained according to the determination result, so as to effectively improve the accuracy of the target rule function and the target detection model.
The embodiment of the present invention further provides an anomaly detection device for an internet of things card, and it can be understood that the anomaly detection device for an internet of things card provided by the embodiment of the present invention is used for implementing corresponding functions in the foregoing method embodiments, and includes hardware structures and/or software modules corresponding to the execution of the functions. Those of skill in the art will readily appreciate that the present invention can be implemented in hardware or a combination of hardware and computer software, in conjunction with the exemplary algorithm steps described in connection with the embodiments disclosed herein. Whether a function is performed as hardware or computer software drives hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The embodiments of the present invention may perform the division of the function modules for the device for detecting abnormality of the internet of things card according to the method embodiments, for example, each function module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. It should be noted that, the division of the modules in the embodiment of the present invention is schematic, and is only a logic function division, and there may be another division manner in actual implementation.
Fig. 5 is a schematic functional structure diagram of an anomaly detection device for an internet of things card according to an embodiment of the present invention, where each functional module is divided according to each function, and the anomaly detection device for an internet of things card is specifically used to implement the method embodiments corresponding to fig. 1 to 4, and the anomaly detection device for an internet of things card may be a separate device or integrated into an internet of things device. As shown in fig. 5, the device for detecting abnormality of the internet of things card includes:
the obtaining module 51 is configured to obtain service scene information of the internet of things card to be detected.
The processing module 52 is configured to obtain behavior data corresponding to the service scene information obtained by the obtaining module 51, obtain a target rule algorithm for processing the behavior data under the service scene information, classify the internet of things card to be detected according to the target rule algorithm and the behavior data, and obtain a classification result; wherein the classification result comprises: normal, or abnormal.
And the determining module 53 is configured to determine whether the internet of things card to be detected is abnormal according to the classification result obtained by the processing module 52.
Optionally, the behavioral data includes: historical behavioral data; the processing module 52 is specifically configured to:
acquiring a target rule function corresponding to the service scene information from a preset rule function as a target rule algorithm for processing historical behavior data; the preset rule function satisfies the following formula:
y1＝f(x1，x2，...，xn)；
where y1 is the result of the operation, f is the rule of the operation, and xnThe characteristic value of the nth operation characteristic value type; wherein n is a natural number and n is greater than or equal to 1;
acquiring a characteristic value corresponding to each operation characteristic value type in the target rule function in historical behavior data;
calculating the characteristic value according to the operation rule, and determining a first classification result according to the operation result; the operation result comprises a first result value and a second result value, the first result value represents that the classification result is normal, and the second result value represents that the classification result is abnormal.
Optionally, the determining module 53 is specifically configured to: and determining whether the Internet of things card to be detected is abnormal or not according to the first classification result.
Optionally, the behavioral data includes: real-time behavioral data; the processing module 52 is specifically configured to:
acquiring a target detection model corresponding to the service scene information from a preset detection model as a target rule algorithm for processing real-time behavior data; the preset detection model is obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm; the output result of the preset detection model comprises a third result value and a fourth result value, the third result value represents that the classification result is normal, and the fourth result value represents that the classification result is abnormal; inputting the real-time behavior data into a target detection model, and acquiring an output result of the target detection model as a second classification result;
the determining module 53 is specifically configured to: and determining whether the Internet of things card to be detected is abnormal according to the second classification result.
Optionally, the behavioral data includes: historical behavior data and real-time behavior data;
the processing module 52, on the basis of obtaining the first classification result, is further configured to:
acquiring a target detection model corresponding to the service scene information from a preset detection model as a target rule algorithm for processing real-time behavior data; the preset detection model is obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm; the output result of the preset detection model comprises a fifth result numerical value and a sixth result numerical value, the fifth result numerical value represents that the classification result is normal, and the sixth result numerical value represents that the classification result is abnormal; inputting the real-time behavior data into a target detection model, and acquiring an output result of the target detection model as a third classification result;
the determining module 53 is specifically configured to: acquiring a first classification result operation value corresponding to the first classification result and a third classification result operation value corresponding to the third classification result according to a preset classification result operation value; weighting the first classification result operation value and the third classification result operation value to obtain a first weighting result corresponding to the first classification result operation value and a second weighting result corresponding to the third classification result operation value; summing the first weighting result and the second weighting result to obtain a summation result; and determining whether the Internet of things card to be detected is abnormal or not according to the summation result.
Optionally, the preset rule function includes any one of: a terminal information rule function, a flow rule function, a service type and flow rule function, a number matching rule function and an outlier rule function.
Optionally, the device for detecting abnormality of the internet of things card further includes: a correction module 54 for:
and obtaining the determination result of the to-be-detected internet of things card obtained in the determination module 53, and correcting the target rule algorithm according to the determination result.
All relevant contents of the steps related to the above method embodiments may be referred to the functional description of the corresponding functional module, and the functions thereof are not described herein again.
Under the condition of adopting an integrated module, the device for detecting the abnormity of the Internet of things card comprises: the device comprises a storage unit, a processing unit and an interface unit. The processing unit is used for controlling and managing the processing action of the internet of things card abnormality detection device, for example, the processing unit is used for supporting the internet of things card abnormality detection device to execute each step in fig. 1-4. The interface unit is used for interaction between the Internet of things network card abnormality detection device and other devices; and the storage unit is used for storing the codes and data of the anomaly detection device of the Internet of things card.
For example, the processing unit is a processor, the storage unit is a memory, and the interface unit is a communication interface. The device for detecting abnormality of the internet of things card, shown in fig. 6, includes a communication interface 601, a processor 602, a memory 603, and a bus 604, where the communication interface 601 and the processor 602 are connected to the memory 603 through the bus 604.
The Memory 603 may be a Read-Only Memory (ROM) or other type of static storage device that can store static information and instructions, a Random Access Memory (RAM) or other type of dynamic storage device that can store information and instructions, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical Disc storage, optical Disc storage (including Compact Disc, laser Disc, optical Disc, digital versatile Disc, blu-ray Disc, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to these. The memory may be self-contained and coupled to the processor via a bus. The memory may also be integral to the processor.
The memory 603 is used for storing application program codes for executing the scheme of the application, and the processor 602 controls the execution. The communication interface 601 is used for supporting the interaction between the abnormality detection device of the internet card and other devices. The processor 602 is configured to execute the application program code stored in the memory 603, thereby implementing the method in the embodiment of the present invention.
The steps of a method or algorithm described in connection with the disclosure herein may be embodied in hardware or in software instructions executed by a processor. The embodiment of the invention also provides a storage medium, which can comprise a memory used for storing computer software instructions used by the device for detecting the abnormality of the internet of things card, and the storage medium comprises program codes designed for executing the method for detecting the abnormality of the internet of things card. Specifically, the software instructions may be composed of corresponding software modules, and the software modules may be stored in a Random Access Memory (RAM), a flash Memory, a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable Programmable Read Only Memory (EEPROM), a register, a hard disk, a removable hard disk, a compact disc Read Only Memory (CD-ROM), or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. Of course, the storage medium may also be integral to the processor.
The embodiment of the invention also provides a computer program, which can be directly loaded into the memory and contains software codes, and the computer program can realize the method for detecting the abnormality of the internet of things card after being loaded and executed by the computer.
Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer.
The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (11)
1. An Internet of things card abnormality detection method is characterized by comprising the following steps:
acquiring service scene information of an Internet of things card to be detected;
acquiring behavior data corresponding to the service scene information, acquiring a target rule algorithm corresponding to the service scene information and used for processing the behavior data, classifying the Internet of things card to be detected according to the target rule algorithm and the behavior data, and acquiring a classification result; wherein the classification result comprises: normal, or abnormal;
determining whether the Internet of things card to be detected is abnormal or not according to the classification result;
the acquiring of the behavior data corresponding to the service scenario information includes:
acquiring historical behavior data and real-time behavior data corresponding to the service scene information;
the obtaining of the target rule algorithm corresponding to the service scene information and used for processing the behavior data classifies the internet of things card to be detected according to the target rule algorithm and the behavior data, and obtaining a classification result includes:
acquiring a target rule function corresponding to the service scene information from a preset rule function as a target rule algorithm for processing the historical behavior data; wherein the preset rule function satisfies the following formula:
y1＝f(x1,x2,..,xn)；
where y1 is the result of the operation, f is the rule of the operation, and xnThe characteristic value of the nth operation characteristic value type; wherein n is a natural number and n is greater than or equal to 1;
acquiring a characteristic value corresponding to each operation characteristic value type in the target rule function in the historical behavior data;
calculating the characteristic value according to the operation rule, and determining a first classification result according to an operation result; the operation result comprises a first result value and a second result value, wherein the first result value represents that the classification result is normal, and the second result value represents that the classification result is abnormal;
acquiring a target detection model corresponding to the service scene information from a preset detection model as a target rule algorithm for processing the real-time behavior data; the preset detection model is obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm; the output result of the preset detection model comprises a fifth result numerical value and a sixth result numerical value, wherein the fifth result numerical value indicates that the classification result is normal; the sixth result value indicates that the classification result is abnormal;
inputting the real-time behavior data into the target detection model, and acquiring an output result of the target detection model as a third classification result;
determining whether the Internet of things card to be detected is abnormal according to the classification result comprises the following steps:
acquiring a first classification result operation value corresponding to the first classification result and a third classification result operation value corresponding to the third classification result according to a preset classification result operation value;
weighting the first classification result operation value and the third classification result operation value to obtain a first weighting result corresponding to the first classification result operation value and a second weighting result corresponding to the third classification result operation value;
summing the first weighting result and the second weighting result to obtain a summation result;
and determining whether the Internet of things card to be detected is abnormal or not according to the summation result.
2. The method for detecting the abnormality of the internet of things card according to claim 1, wherein the determining whether the internet of things card to be detected is abnormal according to the classification result comprises: and determining whether the Internet of things card to be detected is abnormal or not according to the first classification result.
3. The method for detecting the abnormality of the internet of things card according to claim 1, wherein the acquiring of the behavior data corresponding to the service scenario information includes:
acquiring real-time behavior data corresponding to the service scene information;
the obtaining of the target rule algorithm corresponding to the service scene information and used for processing the behavior data classifies the internet of things card to be detected according to the target rule algorithm and the behavior data, and obtaining a classification result includes:
acquiring a target detection model corresponding to the service scene information from a preset detection model as a target rule algorithm for processing the real-time behavior data; the preset detection model is obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm; the output result of the preset detection model comprises a third result value and a fourth result value; wherein the third result value indicates that the classification result is normal and the fourth result value indicates that the classification result is abnormal;
inputting the real-time behavior data into the target detection model, and acquiring an output result of the target detection model as a second classification result;
determining whether the Internet of things card to be detected is abnormal according to the classification result comprises the following steps: and determining whether the Internet of things card to be detected is abnormal or not according to the second classification result.
4. The method for detecting the abnormality of the internet of things card according to claim 1 or 2, wherein the preset rule function includes any one of the following items: a terminal information rule function, a flow rule function, a service type and flow rule function, a number matching rule function and an outlier rule function.
5. The method for detecting the abnormality of the internet of things card according to claim 1, wherein after determining whether the internet of things card to be detected is abnormal according to the classification result, the method further comprises:
and obtaining a determination result of the Internet of things card to be detected, and correcting the target rule algorithm according to the determination result.
6. An abnormality detection device for an internet of things card is characterized by comprising:
the acquisition module is used for acquiring the service scene information of the Internet of things card to be detected;
the processing module is used for acquiring the behavior data corresponding to the service scene information acquired by the acquisition module, acquiring a target rule algorithm for processing the behavior data under the service scene information, and classifying the Internet of things card to be detected according to the target rule algorithm and the behavior data to acquire a classification result; wherein the classification result comprises: normal, or abnormal;
the determining module is used for determining whether the Internet of things card to be detected is abnormal or not according to the classification result obtained by the processing module;
the processing module is specifically configured to:
acquiring historical behavior data and real-time behavior data corresponding to the service scene information;
acquiring a target rule function corresponding to the service scene information from a preset rule function as a target rule algorithm for processing the historical behavior data; wherein the preset rule function satisfies the following formula:
y1＝f(x1，x2，...，xn)；
where y1 is the result of the operation, f is the rule of the operation, and xnThe characteristic value of the nth operation characteristic value type; wherein n is a natural number and n is more than or equal to 1;
acquiring a characteristic value corresponding to each operation characteristic value type in the target rule function in the historical behavior data;
calculating the characteristic value according to the operation rule, and determining a first classification result according to an operation result; the operation result comprises a first result value and a second result value, wherein the first result value represents that the classification result is normal, and the second result value represents that the classification result is abnormal;
acquiring a target detection model corresponding to the service scene information from a preset detection model as a target rule algorithm for processing the real-time behavior data; the preset detection model is obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm; the output result of the preset detection model comprises a fifth result numerical value and a sixth result numerical value, the fifth result numerical value represents that the classification result is normal, and the sixth result numerical value represents that the classification result is abnormal;
inputting the real-time behavior data into the target detection model, and acquiring an output result of the target detection model as a third classification result;
the determining module is specifically configured to: acquiring a first classification result operation value corresponding to the first classification result and a third classification result operation value corresponding to the third classification result according to a preset classification result operation value;
weighting the first classification result operation value and the third classification result operation value to obtain a first weighting result corresponding to the first classification result operation value and a second weighting result corresponding to the third classification result operation value;
summing the first weighting result and the second weighting result to obtain a summation result;
and determining whether the Internet of things card to be detected is abnormal or not according to the summation result.
7. The device for detecting the abnormality of the internet of things card according to claim 6, wherein the determining module is specifically configured to: and determining whether the Internet of things card to be detected is abnormal or not according to the first classification result.
8. The device for detecting the abnormality of the internet of things card according to claim 6, wherein the processing module is specifically configured to:
acquiring real-time behavior data corresponding to the service scene information;
acquiring a target detection model corresponding to the service scene information from a preset detection model as a target rule algorithm for processing the real-time behavior data; the preset detection model is obtained by taking historical behavior data of preset service scene information as a sample according to a preset machine learning algorithm; the output result of the preset detection model comprises a third result value and a fourth result value; the third result value represents that the classification result is normal, and the fourth result value represents that the classification result is abnormal; inputting the real-time behavior data into the target detection model, and acquiring an output result of the target detection model as a second classification result;
the determining module is specifically configured to: and determining whether the Internet of things card to be detected is abnormal or not according to the second classification result.
9. The device for detecting abnormality of the internet of things card according to claim 6, further comprising: a correction module to:
and obtaining a determination result of the to-be-detected Internet of things card obtained by the determination module, and correcting the target rule algorithm according to the determination result.
10. An abnormality detection device for an internet of things card is characterized by comprising: one or more processors; the processor is configured to execute a computer program code in the memory, where the computer program code includes instructions for causing the terminal device to perform the method for detecting the abnormality of the internet of things card according to any one of claims 1 to 5.
11. A storage medium, characterized in that the storage medium stores instruction codes for executing the method for detecting abnormality of the internet of things card according to any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910591205.4A CN110505196B (en) | 2019-07-02 | 2019-07-02 | Internet of things network card abnormality detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910591205.4A CN110505196B (en) | 2019-07-02 | 2019-07-02 | Internet of things network card abnormality detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110505196A CN110505196A (en) | 2019-11-26 |
| CN110505196B true CN110505196B (en) | 2021-08-31 |
Family
ID=68585930
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910591205.4A Active CN110505196B (en) | 2019-07-02 | 2019-07-02 | Internet of things network card abnormality detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110505196B (en) |
Families Citing this family (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110933698A (en) * | 2019-11-28 | 2020-03-27 | 广州助蜂网络科技有限公司 | Monitoring management method, device and equipment for Internet of things card |
| CN111263349B (en) * | 2019-12-12 | 2022-06-28 | 深圳市麦谷科技有限公司 | Automatic diagnosis and recovery method and system for abnormal session of wireless networking equipment |
| CN110995745B (en) * | 2019-12-17 | 2021-09-21 | 武汉绿色网络信息服务有限责任公司 | Method and device for separating and identifying illegal machine card of Internet of things |
| CN111476375B (en) * | 2020-03-30 | 2023-09-19 | 中移动信息技术有限公司 | Method and device for determining identification model, electronic equipment and storage medium |
| CN113766462A (en) * | 2020-06-03 | 2021-12-07 | 中国移动通信集团重庆有限公司 | Internet of things card management method and device and computing equipment |
| CN111752936B (en) * | 2020-06-30 | 2024-04-26 | 中国科学院西北生态环境资源研究院 | Data detection management method, device, server and readable storage medium |
| CN114268567A (en) * | 2020-09-16 | 2022-04-01 | 中兴通讯股份有限公司 | Abnormal terminal identification method, abnormal terminal analysis device, abnormal terminal analysis equipment and abnormal terminal storage medium |
| CN114422619B (en) * | 2020-10-12 | 2023-11-10 | 中国移动通信集团广东有限公司 | Service identification method, device, equipment and storage medium |
| CN114444830A (en) * | 2020-11-02 | 2022-05-06 | 中移物联网有限公司 | Method and device for judging abnormality of Internet of things card |
| CN114640606A (en) * | 2020-12-01 | 2022-06-17 | 中移物联网有限公司 | Abnormity processing method and controller for Internet of things card terminal |
| CN113139817B (en) * | 2021-04-28 | 2024-09-24 | 北京沃东天骏信息技术有限公司 | Data classification method, data classification device, medium and electronic equipment |
| CN113536066A (en) * | 2021-07-16 | 2021-10-22 | 全球能源互联网研究院有限公司 | Data anomaly detection algorithm determination method and device and computer equipment |
| CN113537387A (en) * | 2021-08-04 | 2021-10-22 | 北京思特奇信息技术股份有限公司 | Model design method and device for Internet online operation activities and computer equipment |
| CN113869753A (en) * | 2021-09-30 | 2021-12-31 | 南京航空航天大学 | Internet of things smart home scene security analysis method and device |
| CN113923037B (en) * | 2021-10-18 | 2024-03-26 | 北京八分量信息科技有限公司 | Anomaly detection optimization device, method and system based on trusted computing |
| CN114143734B (en) * | 2021-10-22 | 2024-10-11 | 广东省电信规划设计院有限公司 | Data processing method and device for 5G internet of things card flow acquisition |
| CN114143227B (en) * | 2021-10-25 | 2024-09-17 | 国网山西省电力公司阳泉供电公司 | Abnormal state monitoring and early warning method for Internet of things card |
| CN114168632A (en) * | 2021-12-07 | 2022-03-11 | 泰康保险集团股份有限公司 | Abnormal data identification method and device, electronic equipment and storage medium |
| CN115038112A (en) * | 2022-06-29 | 2022-09-09 | 国网北京市电力公司 | Method and device for determining equipment state and nonvolatile storage medium |
| CN116016230B (en) * | 2022-12-26 | 2024-04-05 | 山东有人物联网股份有限公司 | Multi-type service processing method and device for Internet of things network card, electronic equipment and medium |
| CN117056594B (en) * | 2023-07-31 | 2024-07-26 | 中移互联网有限公司 | User identification method and device based on interaction relationship and electronic equipment |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109842628A (en) * | 2018-12-13 | 2019-06-04 | 成都亚信网络安全产业技术研究院有限公司 | A kind of anomaly detection method and device |
Family Cites Families (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104753733B (en) * | 2013-12-31 | 2019-08-13 | 南京中兴软件有限责任公司 | The detection method and device of exception of network traffic data |
| CN107968730A (en) * | 2016-10-19 | 2018-04-27 | 中国电信股份有限公司 | The method and system that monitoring Internet of Things network interface card is stolen |
| CN108270727A (en) * | 2016-12-30 | 2018-07-10 | 北京国双科技有限公司 | Abnormal data analysis method and device |
| US10627882B2 (en) * | 2017-02-15 | 2020-04-21 | Dell Products, L.P. | Safeguard and recovery of internet of things (IoT) devices from power anomalies |
| CN110519069B (en) * | 2017-08-03 | 2020-07-14 | 华为技术有限公司 | Charging method and device |
| CN108777866A (en) * | 2018-03-29 | 2018-11-09 | 中国联合网络通信集团有限公司 | A kind of network analysis method, server and network system |
| CN108768765A (en) * | 2018-05-11 | 2018-11-06 | 中国联合网络通信集团有限公司 | Abnormality Internet of Things network interface card checking method, device and computer readable storage medium |
| CN108632097B (en) * | 2018-05-14 | 2019-12-13 | 平安科技（深圳）有限公司 | Abnormal behavior object identification method, terminal device and medium |
| CN109951491A (en) * | 2019-03-28 | 2019-06-28 | 腾讯科技（深圳）有限公司 | Network attack detecting method, device, equipment and storage medium |
-
2019
- 2019-07-02 CN CN201910591205.4A patent/CN110505196B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109842628A (en) * | 2018-12-13 | 2019-06-04 | 成都亚信网络安全产业技术研究院有限公司 | A kind of anomaly detection method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110505196A (en) | 2019-11-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110505196B (en) | Internet of things network card abnormality detection method and device | |
| US8843157B2 (en) | Dynamic travel behavior estimation in mobile network | |
| WO2016070673A1 (en) | Method and device for analyzing user attribute | |
| JP6752885B2 (en) | Router address type identification method and device | |
| CN109982257B (en) | Method, device and system for determining mobile user home region | |
| CN111372242A (en) | Fraud identification method, device, server and storage medium | |
| US20180196900A1 (en) | System and Method for Forecasting Values of a Time Series | |
| CN110022529B (en) | Method and device for counting number of people in target area based on two sensing modes | |
| CN109300296A (en) | A kind of monitoring method of intellectual water meter, monitoring device and the base station NB-Iot | |
| CN111031550B (en) | Method and device for judging weak coverage area of wireless network | |
| CN109064211B (en) | Marketing business data analysis method and device and server | |
| CN110807014A (en) | Cross validation based station data anomaly discrimination method and device | |
| CN111488338B (en) | Model monitoring method and device applied to wind control decision flow | |
| CN109005504A (en) | Localization method, device, terminal device and the storage medium of wireless messages | |
| CN112637888A (en) | Coverage hole area identification method, device, equipment and readable storage medium | |
| CN112749717A (en) | Internet of things service quality end-to-end evaluation method, device, equipment and storage medium | |
| CN116489666A (en) | Wireless sensor network construction method and system for safety monitoring | |
| CN104301170A (en) | Mobile terminal application friendliness evaluation method based on feature classification | |
| CN113727351A (en) | Communication fraud identification method and device and electronic equipment | |
| CN107580329B (en) | Network analysis optimization method and device | |
| JP6223302B2 (en) | Apparatus, program, and method capable of determining stay of user having portable terminal | |
| CN110059234A (en) | Water utilities anomalous event method for detecting and device, computer installation and storage medium | |
| CN113657635B (en) | Method for predicting loss of communication user and electronic equipment | |
| CN112509164A (en) | Attendance card-punching method, attendance card-punching device, attendance card-punching equipment and storage medium | |
| CN116828509B (en) | Network blind area detection method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |