CN117979300A

CN117979300A - Abnormal network registration behavior analysis method and device

Info

Publication number: CN117979300A
Application number: CN202410392914.0A
Authority: CN
Inventors: 常雯; 张远晶; 李坤; 苏宇; 钟杰
Original assignee: China Academy of Information and Communications Technology CAICT
Current assignee: China Academy of Information and Communications Technology CAICT
Priority date: 2024-04-02
Filing date: 2024-04-02
Publication date: 2024-05-03

Abstract

The invention relates to the technical field of mobile communication, and provides a method and a device for analyzing abnormal network registration behaviors, wherein the method comprises the following steps: acquiring a user position update signaling received by a home location convergence network element in real time; updating a preset space-time position matrix based on the current position information and the current time information in the user position updating signaling, wherein a space-time point element A _ij in the space-time position matrix records the position information and the time information of an ith user at a jth position; calculating the moving speed of the user according to the position information and the time information of each adjacent position in the space-time position matrix, and determining that the position of the user is suddenly changed under the condition that the moving speed is larger than a preset speed threshold value; recording the position information after mutation, and sending out early warning of abnormal registration behaviors of the user. The invention determines the abnormal registration behavior according to the user with the position mutation, so that an operator can effectively and timely discover the abnormal network registration behavior of the user.

Description

Abnormal network registration behavior analysis method and device

Technical Field

The present invention relates to the field of mobile communications technologies, and in particular, to a method and an apparatus for analyzing abnormal network registration behavior.

Background

When a mobile communication terminal needs to use a telephone, a short message, or a mobile internet service, registration (Registration) to a mobile communication network is first required. In a mobile communication network, there are a large number of user registration events, among which there is an abnormal class of user registration behavior: the same mobile terminal user registers in two (or more) places far away from the mobile communication network in a short time, and in addition, there are many features such as night remote registration and short time networking in different places. Through research and analysis, the illegal behavior is hidden behind the abnormal user registration, the specific behavior flow is shown in figure 1, the mobile phone card information of a normal mobile phone user is obtained through a hacking technology or through the purchase of related illegal personnel in an operator, the mobile phone card of a victim is copied and counterfeited through the card information, then the copied mobile phone card is registered in a network in different places, a short message verification code or a voice phone is received through a mobile phone number, and a series of internet accounts are registered through the mobile phone number of the victim for abnormal use. This number is no longer used after registration is completed, and since this is typically done late at night, victims are often unaware, and operators are also unable to efficiently and timely analyze the abnormal foreign network registration behavior found.

Because the abnormal network registration behavior has higher privacy, the victim user cannot sense immediately, and only after a long time afterwards, the victim user can accidentally find that the own mobile phone number registers some unused internet accounts.

Disclosure of Invention

The invention provides an abnormal network registration behavior analysis method and device, which are used for solving the problem that in the prior art, abnormal network registration behaviors have higher secrecy, and operators cannot effectively and timely discover abnormal different network registration behaviors.

The invention provides an abnormal network registration behavior analysis method, which comprises the following steps:

Acquiring a user position update signaling received by a home location convergence network element in real time;

Updating a preset space-time position matrix based on the current position information and the current time information in the user position updating signaling, wherein a space-time point element A _ij in the space-time position matrix records the position information and the time information of an ith user at a jth position;

Calculating the moving speed of the user according to the position information and the time information of each adjacent position in the space-time position matrix, and determining that the position of the user is suddenly changed under the condition that the moving speed is larger than a preset speed threshold value;

recording the position information after mutation, and sending out early warning of abnormal registration behaviors of the user.

According to the method for analyzing abnormal network registration behavior provided by the invention, a preset space-time position matrix is updated based on the current position information and the current time information in the user position updating signaling, and the method comprises the following steps:

updating time information corresponding to the latest space-time point element into the current time information under the condition that the current position information is the same as the position information recorded by the latest space-time point element in the space-time position matrix;

And generating new space-time point element record current position information and current time information under the condition that the current position information is different from the position information of the latest space-time point element record in the space-time position matrix.

According to the method for analyzing the abnormal network registration behavior, the space-time point element of each user in the space-time position matrix is stored by adopting the space-time point queue, each user corresponds to one space-time point queue, and after the new space-time point element is generated, when the total number of the space-time point elements exceeds the size of the space-time point queue, the space-time point elements which enter the space-time point queue at the earliest time are dequeued, and the new space-time point elements are generated and put into the queue.

According to the method for analyzing abnormal network registration behavior provided by the invention, under the condition that the moving speed is greater than the preset speed threshold, the user position is determined to have mutation, and the method comprises the following steps:

in a civil aviation operation time period, the moving speed is larger than a first preset speed threshold value, and abnormal registration behaviors of the user are determined; or in the non-civil aviation operation time period, the moving speed is larger than a second preset speed threshold value, the abnormal registration behavior of the user is determined, and the first preset speed threshold value is larger than the second preset speed threshold value.

According to the method for analyzing abnormal network registration behavior provided by the invention, before calculating the moving speed of the user according to the position information and the time information of each adjacent position in the space-time position matrix, the method further comprises the following steps:

And under the condition that the internal position is not in the range of the preset border line, determining that the user position is suddenly changed, wherein the position information of the time information in the adjacent position is the internal position, and the position information of the time information in the adjacent position is the external position.

According to the method for analyzing abnormal network registration behavior provided by the invention, after recording the position information after mutation and sending out the early warning of the abnormal registration behavior of the user, the method further comprises the following steps:

and carrying out spatial clustering on the position information corresponding to the abnormal registration behaviors to determine the concentrated occurrence place of the abnormal registration behaviors.

According to the method for analyzing abnormal network registration behavior provided by the invention, user position update signaling received by a home location fusion network element is obtained in real time, and the method comprises the following steps: and acquiring the user position updating signaling received by the home fusion network element in real time in a load balancing mode through at least two computing servers.

The invention also provides an abnormal network registration behavior analysis device, which comprises:

the signaling acquisition module is used for acquiring the user position update signaling received by the home location convergence network element in real time;

The space-time position matrix updating module is used for updating a preset space-time position matrix based on the current position information and the current time information in the user position updating signaling, and a space-time point element A _ij in the space-time position matrix records the position information and the time information of the ith user at the jth position;

The position mutation user determining module is used for calculating the moving speed of the user according to the respective position information and time information of the adjacent positions in the space-time position matrix, and determining that the position of the user is suddenly changed under the condition that the moving speed is greater than a preset speed threshold value;

The abnormal early warning module is used for recording the position information after mutation and sending out abnormal registration behavior early warning of the user.

The invention also provides an electronic device comprising a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the abnormal network registration behavior analysis method according to any one of the above when executing the computer program.

The present invention also provides a non-transitory computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the abnormal network registration behavior analysis method as described in any one of the above.

The method and the device for analyzing the abnormal network registration behavior acquire the user position update signaling received by the home fusion network element in real time; updating a preset space-time position matrix based on current position information and current time information in a user position updating signaling, wherein a space-time point element A _ij in the space-time position matrix records position information and time information of an ith user at a jth position; calculating the moving speed of the user according to the position information and the time information of each adjacent position in the space-time position matrix, and determining that the position of the user is suddenly changed under the condition that the moving speed is greater than a preset speed threshold value; recording the position information after mutation, and sending out early warning of abnormal registration behaviors of the user. Because the user position updating signaling is obtained in real time, a preset space-time position matrix is updated according to the current position information and the current time information in the user position updating signaling, the movement speed of the user is calculated according to the space distance and the time difference of two adjacent positions in the space-time position matrix, under the condition that the movement speed is larger than a preset speed threshold, the position of the user is determined to be suddenly changed, the position information after the sudden change is recorded, and abnormal user registration behavior early warning is sent out, so that an operator can effectively and timely find out abnormal network registration behavior of the user.

Drawings

In order to more clearly illustrate the invention or the technical solutions of the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described, and it is obvious that the drawings in the description below are some embodiments of the invention, and other drawings can be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flow chart of an abnormal user registration behavior in the prior art;

FIG. 2 is a schematic flow chart of an abnormal network registration behavior analysis method provided by the invention;

FIG. 3 is a schematic diagram of user location update signaling collection in the method for analyzing abnormal network registration behavior provided by the invention;

FIG. 4 is a flow diagram of location update upon user registration in a 4G network;

FIG. 5 is a flow diagram of location update upon user registration in a 5G network;

FIG. 6 is a flowchart for determining a mutation in a user location in the method for analyzing abnormal network registration behavior provided by the present invention;

fig. 7 is a schematic structural diagram of an abnormal network registration behavior analysis device provided by the present invention;

fig. 8 is a schematic structural diagram of an electronic device provided by the present invention.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the present invention more apparent, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings, and it is apparent that the described embodiments are some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

It should be noted that, the information (including but not limited to user equipment information, user personal information, etc.), data (including but not limited to data for analysis, stored data, presented data, etc.), and signals related to the present disclosure are all authorized by the user or are fully authorized by the parties, and the collection, use, and processing of relevant data is required to comply with relevant laws and regulations and standards of relevant countries and regions.

The method for analyzing abnormal network registration behavior according to the embodiment of the present invention, as shown in fig. 2, includes:

Step S210: and acquiring the user position updating signaling received by the home location convergence network element in real time. In the mobile communication network HLR (Home Location Register) is a home location register, which is a database responsible for mobile subscriber management, permanently stores and records subscription data of subscribers in the administered area, and dynamically updates the location information of the subscribers so as to provide network routing of the called subscriber in the call service. In a 4G network, the HLR evolves to the HSS (Home Subscriber Server ). To 5G networks, evolution has again evolved to UDM (Unified DATA MANAGEMENT ). In an actual network, since the 2G, 3G, 4G and 5G networks exist at the same time, HLR, HSS, UDM is actually an integrated converged network element, that is, a home converged network element, and the home converged network element provides services related to user data to the 2G, 3G, 4G and 5G networks at the same time. Specifically, as shown in fig. 3, in this embodiment, by pushing the signaling to the calculation server at the back end by means of port mirroring before the home location convergence network element, the user location update signaling during the registration of the full amount of users is collected, so as to obtain the user location update signaling received by the home location convergence network element in real time. In practical applications, as shown in fig. 4 and 5, the flows of registration and location update of mobile subscribers in 4G and 5G networks are shown.

For a 4G network, during the network registration process of a 4G user (this process is also called network Attach from the perspective of the user terminal UE), there are two key steps that the HSS has to participate in the process of user Attach: firstly, when the user authenticates, the HSS provides information related to user Authentication; and secondly, the HSS receives a position update request of a Mobility Management Entity (MME) where the user is located, and stores the latest position information of the user. In this process, specifically in step 8, a user location update signaling is collected, and current location information such as a Mobility Management Entity (MME) identifier, a Tracking Area ID (TAI), a base station cell number (CGI) and the like may be obtained from the user location update signaling, and current time information and a user identifier when a user requests location update may also be obtained from the user location update signaling.

For 5G networks, there are two key steps that must be taken into account by the UDM in the registration process of the 5G user: firstly, when the user authenticates the Authentication, the UDM provides information related to the user Authentication; secondly, the UDM receives and processes a user Registration request (UECM _registration) of an Authentication Management Function (AMF) where the user is located. In this process, specifically in steps 13 and 14a, a user location update signaling is collected, and current location information such as an Authentication Management Function (AMF) identifier, a Tracking Area ID (TAI), a base station cell number (CGI) and the like may be obtained from the user location update signaling, and current time information and a user identifier when a user requests a location update may also be obtained from the user location update signaling.

For the case that the user does not move across provinces, the user terminal (UE) also generates a user location update signaling to the home location convergence network element according to a preset period (for example, 2-3 hours).

In the step, only the user position update signaling is collected, irrelevant signaling is not contained, privacy information related to user communication records is not contained, the collected data volume is small, the data collection is centralized, too many communication links are not needed to be accessed, the user data is complete, and coarse position information (without accurate position information related to user privacy) of all the users belonging to the home fusion network element can be collected.

Preferably, the real-time user location update signaling is collected at the home location convergence network element HSS/HLS/UDM located in a large area (one large area includes a plurality of provinces), and compared with the user location update signaling collected at the home location convergence network element in each province, the centralized data collection in the large area is more convenient; the data types of the large area are more, the data coverage range is wide, a plurality of provinces can be covered, the data of each province can be intensively analyzed, and the fusion analysis of the data (for example, the position mutation of the area with high risk is related, and the risk level is higher) is more facilitated.

Step S220: and updating a preset space-time position matrix based on the current position information and the current time information in the user position updating signaling, wherein a space-time point element A _ij in the space-time position matrix records the position information and the time information of the ith user at the jth position. The preset space-time position matrix is created according to the acquired user position update signaling, and for the ith user, a space-time point element is generated for each position j and used for storing the position information and time information of the jth position, and in this embodiment, the corresponding relationship between the space-time position matrix and the user number identifier is specifically shown in the following table 1:

TABLE 1 correspondence between spatio-temporal position matrices and user number identifications

In the above table 1, each user reserves the latest X space-time point elements, preferably, 2.ltoreq.X.ltoreq.5, at least 2 space-time point elements not exceeding 5 are reserved, and the storage space of the space-time position matrix is saved.

Step S230: and calculating the moving speed of the user according to the position information and the time information of each adjacent position in the space-time position matrix, and determining that the position of the user is suddenly changed under the condition that the moving speed is larger than a preset speed threshold value. Specifically, a spatial distance is calculated according to position information of adjacent positions in the space-time position matrix, a time difference is calculated according to time information corresponding to the adjacent positions, and a moving speed of a user is calculated according to the spatial distance and the time difference.

The position information of the adjacent positions is position information corresponding to two adjacent space-time points in the space-time position matrix. The spatial distance calculation is based on the fuzzy position, the error is not more than 20 km, the speed threshold can be set to 500 km/h, and when the moving speed of the user is more than 500 km/h, the user can be judged to be abnormal or the user moves at the ultra-high speed, and other vehicles except the airplane can not reach the high speed. For example: when the user originally requests registration from the site a and requests location update from the site B, which is 1000km away from the site a after 1 hour, the registration behavior of the user at the site B can be regarded as an abnormal registration behavior.

Step S240: recording the mutated position information, and sending out the early warning of the abnormal registration behavior of the user, wherein the mutated position can be determined as the position of the abnormal registration behavior of the user.

In the abnormal network registration behavior analysis method of the embodiment, a user location update signaling is obtained in real time, a preset space-time location matrix is updated according to current location information and current time information in the user location update signaling, a user moving speed is calculated according to space distances and time differences of two adjacent locations in the space-time location matrix, under the condition that the moving speed is larger than a preset speed threshold, the user location is determined to be suddenly changed, location information after the sudden change is recorded, and abnormal registration behavior early warning of the user is sent out, so that an operator can effectively and timely find out abnormal network registration behaviors of the user.

In some embodiments, step S220 specifically includes:

And under the condition that the current position information is the same as the position information recorded by the latest space-time point element in the space-time position matrix, updating the time information corresponding to the latest space-time point element into the current time information.

In this embodiment, when the current location information of the user is the same as the location information recorded by the latest space-time point element in the space-time location matrix, it is explained that the location of the user is unchanged within the coverage range of the same base station, so that only the time information corresponding to the latest space-time point element is updated. When the current position information is different from the position information recorded by the latest space-time point element in the space-time position matrix, generating new space-time point element record current position information and current time information.

Preferably, in step S220, in the case of generating a new spatiotemporal element, step S230 is performed to calculate the movement speed of the user from the position information and time information recorded in each of the new spatiotemporal element and the previous spatiotemporal element generated in the spatiotemporal position matrix. Namely, when the position of the user is unchanged, the moving speed of the user is not calculated, and the calculated amount is saved.

Preferably, the location information may be characterized by the number of the mobility management entity (or authentication management function entity) where the user is located, and the number of the base station to which the user is attached, based on which, in table 1 above, each space-time point includes four aspects of information:

1) The latest active time at any location is in UTC seconds, i.e., the total number of seconds from coordinated universal time (UTC time) 1970, 1 month, 1 day, 0 minutes, 0 seconds to the current time.

2) The number of the mobility management entity or authentication management function entity (MME or AMF) at any location.

3) The number of the base station at any position.

4) Based on geohash encoded positions, geohash encoded production mode: the base station number is extracted from the signaling, 4-level geohash codes are calculated through the longitude and latitude of the base station, and the precision radius of the 4-level geohash codes is 20 km, so that the accurate position of a user is effectively hidden, but the subsequent abnormal registration behavior analysis is not influenced. If the user is located in the network of the overseas operator (outside the roaming user), the number of the mobility management entity or the authentication management function entity and the number of the base station cannot be obtained, the geographic center point calculation geohash of the corresponding country/region is adopted for coding. geohash encoding facilitates calculation of the spatial distance in step S230.

Specifically, the specific flow of step S220 is shown in fig. 6, and includes:

Step S610: user information (number), current location information and current time information in the user location update signaling are acquired. The current location information is the number of the mobility management entity or authentication management function entity where the user is currently located, and the number of the base station to which the user is attached.

Step S620: and inquiring a space-time position matrix based on the user information, and acquiring the position information and the time information recorded by the latest space-time point element A _ij of the user in the space-time position matrix. The acquiring the location information recorded in a _ij is acquiring the number of the mobility management entity or the authentication management function entity recorded in a _ij and the number of the base station.

Step S630: and judging whether the mobile management entity or the authentication management function entity where the user is located is changed, namely judging whether the number of the mobile management entity or the authentication management function entity in the user position updating signaling is different from the number of the mobile management entity or the authentication management function entity recorded by the latest space-time point element A _ij of the user in the space-time position matrix, if so, executing the step S650 in a jumping manner, otherwise, executing the step S640.

Step S640: and judging whether the base station attached to the user is changed or not, namely judging whether the number of the base station in the user position updating signaling is different from the number of the base station recorded by the latest space-time point element A _ij of the user in the space-time position matrix, if so, executing the step S650, otherwise, jumping to execute the step S670.

Step S650: and generating geohash codes according to the numbers of the base stations in the user position updating signaling.

Step S660: a new spatiotemporal dot element record current location information, time information, and geohash codes are generated.

Step S670: and updating the time information of the latest time-space point element of the user in the time-space position matrix to be the current time information.

In this embodiment, the number of the mobility management entity (or authentication management function entity) where the user is located and the number of the base station to which the user is attached are used to characterize the location information, and by comparing the numbers, whether the user location is changed or not can be more quickly compared, and then the geohash codes are calculated after the user location is changed.

Further, the space-time point queue is used for storing space-time point elements of each user in the space-time position matrix, each user corresponds to one space-time point queue, after new space-time point elements are generated, when the total number of the space-time point elements exceeds the size of the space-time point queue, the space-time point elements enter the space-time point queue at the earliest time and are discharged out of the space-time point queue, and new space-time point elements are generated and put into the queue. The size of the space-time point queue can store X (X is more than or equal to 2 and less than or equal to 5) space-time point elements, and for each user, one space-time point queue is maintained, and the space-time position matrix is updated through a first-in first-out strategy of the queue, so that the updating and the maintenance of the whole space-time position matrix are facilitated.

In step S230, it is not yet possible to accurately determine that the user position is suddenly changed by using a single preset speed threshold, for example, the user may take an airplane or other high-speed moving tool to cause abnormally high speed movement.

To more accurately analyze the abnormally high speed movement of the user, step S230 includes in some embodiments: in a civil aviation operation time period, the moving speed is larger than a first preset speed threshold value, and abnormal registration behaviors of the user are determined; or in the non-civil aviation operation time period, the moving speed is larger than a second preset speed threshold value, the abnormal registration behavior of the user is determined, and the first preset speed threshold value is larger than the second preset speed threshold value.

Specifically, the determination is made based on the movement speed of the user and the time period in which the abrupt position change occurs.

And in the civil aviation operation time period, when the moving speed of the user is greater than a first preset speed threshold (such as the moving speed is greater than 700 km/h), the user number is directly marked as an abnormal number, and early warning information is output.

And in the non-civil aviation operation time period (such as 0 a.m. to 5 a.m.), when the moving speed of the user is greater than a second preset speed threshold (such as the moving speed is greater than 500 km/h), the user number is identified as an abnormal number, and early warning information is output.

Since the user movement along the border line may cause abnormal cross-border movement, in order to more accurately analyze the abnormal cross-border movement, in some embodiments, before calculating the movement speed of the user according to the respective position information and time information of the adjacent positions in the spatio-temporal position matrix in step S230. Further comprises:

And determining that the user position is suddenly changed under the condition that the internal position is not in the range of the preset border line. Wherein the position information of the adjacent position with the previous time information is an in-environment position, and the position information of the adjacent position with the previous time information is an out-of-environment position. When the user moves across the border, the position information of the time information before the time information is recorded by the space-time point element in the border is analyzed, namely whether the position in the border is located in the preset border line range or not. If the internal position is not in the range of the preset border line, determining that the position of the user is suddenly changed, namely that the user has abnormal registration behaviors, and outputting early warning information.

If the internal position is within the preset border line range, the user is indicated to be active around the border line, the border line can be crossed out with high probability, the position of the user is determined to be not mutated, and abnormal registration behaviors of the user are not generated.

Specifically, when abnormal cross-border movement occurs, judging the linear distance between the inner position and the border line recorded by the space-time point element, and if the linear distance between the inner position and the border line is greater than a preset distance threshold (for example, 50 km), considering that the inner position is not in the preset border line range.

Preferably, in step S230, before calculating the movement speed of the user according to the position information and the time information of each of the adjacent positions in the space-time position matrix, the method further includes:

Judging whether the current position information is the position information corresponding to the preset high-risk land area, if so, directly determining that the position of the user is mutated, recording the mutated position information, and sending out early warning of abnormal registration behaviors of the user. Because the current position information is a preset high-risk area, the position of the user is directly determined to be suddenly changed without calculating the moving speed of the user and clustering the high-risk area in the follow-up process, the calculated amount is reduced, and the analysis efficiency of the abnormal registration behavior of the user is improved.

Further, in step S210, after obtaining the user location update signaling received by the home converged network element, the method further includes: judging whether the user number is in the number white list according to the preset number white list, if not, continuing to execute the step S220 and the subsequent steps, and if so, not acting on the user number, namely, not maintaining a space-time position matrix for the user in the number white list, not calculating the moving speed of the user, and not performing early warning. In particular, for some offices, their telephone numbers are added to a number white list in order to ensure that their communications are clear.

In some embodiments, after determining that the user has abnormal registration activity, further comprising: and carrying out spatial clustering on the position information corresponding to the abnormal registration behaviors to determine the concentrated occurrence place of the abnormal registration behaviors. Specifically, spatial clustering is performed on position information after position mutation, which can be understood as that the position after position mutation is counted according to a preset period (for example, 24 hours), and when the counted number of times of the position after position mutation is greater than or equal to a preset number of times (for example, 200 times) in any period, the position is determined to be a concentrated occurrence place of abnormal registration behaviors. In this embodiment, the location in the abnormal registration set can be found by spatially clustering the registration positions corresponding to the abnormal registration behaviors.

In some embodiments, step S210 specifically includes: and acquiring the user position updating signaling received by the home fusion network element in real time in a load balancing mode through at least two computing servers. Because the number of users managed by the home location convergence network element is huge, a plurality of calculation servers are adopted for load sharing, and the user location update signaling received by the home location convergence network element can be acquired in real time without delay. Moreover, the computing server can be used as an execution subject of the method of the embodiment, and a plurality of computing servers share a space-time position matrix, so that abnormal registration behaviors of users can be analyzed almost without delay.

In practice, an operator in a certain province has nearly 1 million mobile subscribers, wherein the 5G subscribers reach 47%, the 4G subscribers reach 49%, and in addition, a small number of 2G and 3G subscribers. HLR, HSS, UDM of a certain operator is a home converged network element, which manages approximately 1 million user data.

By collecting the position update signaling received by the home location convergence network element during user registration, after the position update request and Nudm _ UECM registration data are filtered, about 100000 effective signaling per second is obtained on average, and 3 computing servers are adopted for load sharing, so that the user position update signaling can be obtained in real time without delay.

Although the total user quantity is nearly 1 hundred million, only the user position update signaling is obtained, namely only the position information and the corresponding time information of the user are stored, each user space-time position matrix occupies 71 bytes of capacity, and one hundred million users need about 6.5GB of capacity and can be completely stored in a memory, so that quick reading, writing and updating are realized.

The abnormal network registration behavior analysis apparatus provided by the present invention will be described below, and the abnormal network registration behavior analysis apparatus described below and the abnormal network registration behavior analysis method described above may be referred to correspondingly to each other.

The abnormal network registration behavior analysis apparatus of the present invention, as shown in fig. 7, includes:

The signaling acquisition module 710 is configured to acquire, in real time, the user location update signaling received by the home location convergence network element.

The spatio-temporal position matrix updating module 720 is configured to update a preset spatio-temporal position matrix based on the current position information and the current time information in the user position updating signaling, where a spatio-temporal point element a _ij in the spatio-temporal position matrix records the position information and the time information of the ith user at the jth position.

And the position abrupt change user determining module 730 is configured to calculate a movement speed of the user according to the position information and the time information of each of the adjacent positions in the space-time position matrix, and determine that the user position abrupt change occurs when the movement speed is greater than a preset speed threshold.

The anomaly early warning module 740 is configured to record the mutated position information and send out an anomaly registration behavior early warning of the user.

In the abnormal network registration behavior analysis device, the user location update signaling is acquired in real time, the preset space-time location matrix is updated according to the current location information and the current time information in the user location update signaling, the movement speed of the user is calculated according to the space distance and the time difference of two adjacent locations in the space-time location matrix, under the condition that the movement speed is greater than the preset speed threshold, the mutation of the user location is determined, the position information after the mutation is recorded, and the abnormal registration behavior early warning of the user is sent out, so that an operator can effectively and timely find the abnormal network registration behavior of the user.

Optionally, the spatio-temporal position matrix updating module 720 is specifically configured to update, when the current position information is the same as the position information recorded by the latest spatio-temporal point element in the spatio-temporal position matrix, the time information corresponding to the latest spatio-temporal point element to the current time information; and generating new space-time point element record current position information and current time information under the condition that the current position information is different from the position information of the latest space-time point element record in the space-time position matrix.

Optionally, storing the space-time point elements of each user in the space-time position matrix by adopting a space-time point queue, wherein each user corresponds to one space-time point queue, and after generating new space-time point elements, when the total number of the space-time point elements exceeds the size of the space-time point queue, the space-time point elements entering the space-time point queue at the earliest time are dequeued, and the new space-time point elements are generated and put into the queue.

Optionally, the location mutation user determining module 730 is specifically configured to determine that, in a civil aviation operation period, the movement speed is greater than a first preset speed threshold, and an abnormal registration behavior exists for the user; or in the non-civil aviation operation time period, the moving speed is larger than a second preset speed threshold value, the abnormal registration behavior of the user is determined, and the first preset speed threshold value is larger than the second preset speed threshold value.

Optionally, the location mutation user determining module 730 is specifically configured to determine that, before calculating the movement speed of the user according to the location information and the time information of each of the adjacent locations in the spatiotemporal location matrix, the user location is mutated if the inner location is not within the range of the preset border line, where the location information of the adjacent location with the previous time information is the inner location, and the location information of the time information with the next time information is the outer location.

Optionally, the abnormal network registration behavior analysis device further includes: and the abnormal centralized determination module is used for performing spatial clustering on the position information corresponding to the abnormal registration behavior after recording the position information after mutation and giving out the early warning of the abnormal registration behavior of the user so as to determine the centralized occurrence place of the abnormal registration behavior.

Optionally, the signaling obtaining module 710 is specifically configured to obtain, in real time, the user location update signaling received by the home location convergence network element through at least two computing servers in a load balancing manner.

Fig. 8 illustrates a physical structure diagram of an electronic device, as shown in fig. 8, which may include: processor 810, communication interface (Communications Interface) 820, memory 830, and communication bus 840, wherein processor 810, communication interface 820, memory 830 accomplish communication with each other through communication bus 840. Processor 810 may invoke logic instructions in memory 830 to perform an abnormal network registration behavior analysis method comprising:

And acquiring the user position updating signaling received by the home location convergence network element in real time.

And updating a preset space-time position matrix based on the current position information and the current time information in the user position updating signaling, wherein a space-time point element A _ij in the space-time position matrix records the position information and the time information of the ith user at the jth position.

And calculating the moving speed of the user according to the position information and the time information of each adjacent position in the space-time position matrix, and determining that the position of the user is suddenly changed under the condition that the moving speed is larger than a preset speed threshold value.

Further, the logic instructions in the memory 830 described above may be implemented in the form of software functional units and may be stored in a computer-readable storage medium when sold or used as a stand-alone product. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a usb disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

In another aspect, the present invention also provides a computer program product, where the computer program product includes a computer program, where the computer program can be stored on a non-transitory computer readable storage medium, and when the computer program is executed by a processor, the computer can execute the abnormal network registration behavior analysis method provided by the above methods, and the method includes:

In yet another aspect, the present invention also provides a non-transitory computer readable storage medium having stored thereon a computer program which, when executed by a processor, is implemented to perform the abnormal network registration behavior analysis method provided by the above methods, the method comprising:

The apparatus embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.

From the above description of the embodiments, it will be apparent to those skilled in the art that the embodiments may be implemented by means of software plus necessary general hardware platforms, or of course may be implemented by means of hardware. Based on this understanding, the foregoing technical solution may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a computer readable storage medium, such as ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method described in the respective embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An abnormal network registration behavior analysis method, comprising:

2. The abnormal network registration behavior analysis method according to claim 1, wherein updating a preset spatiotemporal location matrix based on current location information and current time information in the user location update signaling comprises:

3. The method for analyzing abnormal network registration behavior according to claim 2, wherein the spatio-temporal element of each user in the spatio-temporal position matrix is stored by using a spatio-temporal queue, each user corresponds to one spatio-temporal queue, and after generating new spatio-temporal elements, when the total number of spatio-temporal elements exceeds the size of the spatio-temporal queue, the spatio-temporal elements which enter the spatio-temporal queue at the earliest time are dequeued, and new spatio-temporal elements are dequeued.

4. The abnormal network registration behavior analysis method according to claim 1, wherein determining that the user location is mutated in the case that the moving speed is greater than a preset speed threshold comprises:

5. The abnormal network registration behavior analysis method according to claim 1, further comprising, before calculating a movement speed of a user from position information and time information of each of adjacent positions in the spatio-temporal position matrix:

6. The method for analyzing abnormal network registration behavior according to claim 1, further comprising, after recording the location information after the mutation and issuing the user abnormal registration behavior early warning:

7. The method for analyzing abnormal network registration behavior according to any one of claims 1 to 6, wherein acquiring in real time the user location update signaling received by the home converged network element comprises: and acquiring the user position updating signaling received by the home fusion network element in real time in a load balancing mode through at least two computing servers.

8. An abnormal network registration behavior analysis apparatus, comprising:

the position abrupt change user determining module is used for calculating the moving speed of the user according to the position information and the time information of each adjacent position in the space-time position matrix, and determining that the position of the user is abrupt change under the condition that the moving speed is larger than a preset speed threshold value;

and the abnormality early warning module is used for recording the position information after mutation and sending out the user abnormal registration behavior early warning.

9. An electronic device, comprising: a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the abnormal network registration behavior analysis method according to any one of claims 1 to 7 when executing the computer program.

10. A non-transitory computer-readable storage medium having stored thereon a computer program, wherein the computer program when executed by a processor implements the abnormal network registration behavior analysis method according to any one of claims 1 to 7.