Method, device, base station and storage medium for identifying abnormal terminals

Abstract

The embodiment of the present invention discloses a method, device, base station and storage medium for identifying abnormal terminals, wherein the method for identifying abnormal terminals includes: collecting communication data with the terminal within a set time period; and identifying abnormal terminals through self-learning based on the communication data with the terminal. In the embodiment of the present invention, by collecting communication data with the terminal within a set time period; and identifying abnormal terminals through self-learning based on the communication data with the terminal, the purpose of alleviating network congestion, saving air interface resources of NB‑IoT base stations, and improving network quality is achieved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device, base station and storage medium for identifying abnormal terminals. Background Art

[0002] In the Narrow Band Internet of Things (NB-IoT) communication system, after completing uplink synchronization, the terminal in the idle state sends a radio link connection request (RRCConnectionRequest-NB) message to the base station through the uplink logical channel. The message carries the initial identification of the terminal, the reason for the connection establishment, the multi-tone support capability of the terminal, and the multi-carrier support capability of the terminal. The radio link connection request message corresponds to Msg3 of the low-layer random access process.

[0003] Under normal circumstances, after receiving the radio link connection request message, the base station performs corresponding resource allocation, and then replies to the terminal through the downlink logical channel with a radio link connection establishment (RRCConnectionSetup-NB) message, which corresponds to MSG4 of the low-layer random access process, and carries the complete configuration information of SRB1, including the configuration parameters of various entities such as PHY / MAC / RLC. The terminal receives the radio link connection establishment message, configures SRB1bis and SRB1 according to the radio link connection establishment message, and replies to the base station with a radio link connection establishment completion (RRCConnectionSetupComplete-NB) message on SRB1bis through the uplink logical channel, and the radio link connection establishment is now complete.

[0004] When the network is congested and there are no idle resources, the radio link connection establishment request message or the radio link connection recovery request message will be rejected by the base station. At this time, the base station will reply with a radio link connection rejection (RRCConnectionReject-NB) message through the downlink logical channel. When the terminal receives the radio link connection rejection message, protocol 36331 stipulates that the terminal will execute the following methods:

[0005] 1. Stop timer T300;

[0006] 2. If timer T302 is running, stop T302;

[0007] 3. Reset MAC;

[0008] 4. Except for NB-IoT, start timer T302 and set the timer value to waitTime;

[0009] 5. If the terminal is an NB-IoT terminal, or if there is an extended wait time (extendedWaitTime) and the UE supports delay tolerant access (delay tolerant access), the extended wait time is forwarded to the upper layer;

[0010] 6. If a deprioritization request (deprioritisationReq) is included and the terminal supports radio link connection rejection with deprioritization, start or restart timer T325 and set the timer value to the deprioritisationTimer signal; store the deprioritization request until T325 expires, and after the timer expires, the terminal continues to send a radio link connection request message to the base station.

[0011] However, in the NB-IoT communication network, there may be a situation where one or some terminals keep requesting to join the network and keep failing to connect due to their own problems or network problems. In this case, the terminal keeps sending wireless link connection requests, but the wireless link connection establishment keeps failing. According to the protocol, in this case, the terminal can keep requesting to join the network. Once this happens, on the one hand, it will waste the air interface resources of the NB-IoT base station, increase the CPU load on the base station side, aggravate network congestion, and affect the number of users accepted by the network.

[0012] At the same time, if the malware on the terminal frequently connects to the network or initiates services, it can also cause signaling and traffic impact on the base station. This is also a factor that needs to be considered for the air interface of the NB-IoT base station. Summary of the invention

[0013] The embodiments of the present invention provide a method, device, base station and storage medium for identifying abnormal terminals, which alleviate network congestion, save air interface resources of NB-IoT base stations, and improve network quality.

[0014] An embodiment of the present invention provides a method for identifying an abnormal terminal, including:

[0015] Collect communication data with the terminal within a set time period;

[0016] Identify abnormal terminals through self-learning based on communication data with the terminals.

[0017] The embodiment of the present invention further provides a device for identifying an abnormal terminal, comprising:

[0018] A collection module, used to collect communication data with the terminal within a set time period;

[0019] The identification module is used to identify abnormal terminals through self-learning based on communication data with the terminals.

[0020] An embodiment of the present invention further provides a base station, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the method for identifying abnormal terminals is implemented when the processor executes the program.

[0021] An embodiment of the present invention further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method for identifying abnormal terminals.

[0022] The embodiment of the present invention collects communication data with the terminal within a set time period; identifies abnormal terminals through self-learning based on the communication data with the terminal; thereby alleviating network congestion, saving air interface resources of NB-IoT base stations, and improving network quality.

[0023] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram for establishing a wireless link connection in the prior art;

[0025] Figure 2 Schematic diagram of the prior art rejection of wireless link connection establishment;

[0026] Figure 3 A flowchart of a method for identifying abnormal terminals according to an embodiment of the present invention;

[0027] Figure 4 This is a flowchart of identifying abnormal terminals through self-learning according to communication data with the terminals according to an embodiment of the present invention;

[0028] Figure 5 A flowchart of clustering the sample vectors to form a service template according to an embodiment of the present invention;

[0029] Figure 6 This is a flow chart of forming a service template by dividing each type of application data according to its characteristics in an embodiment of the present invention;

[0030] Figure 7 is a relationship diagram between characteristics and reference values ​​of an embodiment of the present invention;

[0031] Figure 8 This is a flow chart of identifying abnormal terminals according to a service template according to an embodiment of the present invention;

[0032] Fig. 9This is a flowchart of the behavior restriction on abnormal terminals according to an embodiment of the present invention;

[0033] Fig.10 This is a flow chart of an embodiment of the present invention for determining whether to restrict the access behavior of the common abnormal terminal by judging according to the network status at that time;

[0034] Fig.11 The present invention is a structural diagram of a device for identifying abnormal terminals according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0036] The steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions. Also, although a logical sequence is shown in the flowchart, in some cases, the steps shown or described can be performed in a sequence different from that shown here.

[0037] like Figure 1 As shown, under normal circumstances, after receiving the radio link connection request message, the base station eNodeB performs corresponding resource allocation, and then replies to the terminal UE with a radio link connection establishment (RRCConnectionSetup-NB) message through the downlink logical channel. This message corresponds to MSG4 of the low-layer random access process, which carries the complete configuration information of SRB1, including the configuration parameters of each entity such as PHY / MAC / RLC. The terminal receives the radio link connection establishment message, configures SRB1bis and SRB1 according to the radio link connection establishment message, and replies to the base station with a radio link connection establishment completion (RRCConnectionSetupComplete-NB) message on SRB1bis through the uplink logical channel. At this point, the radio link connection establishment is completed.

[0038] like Figure 2 As shown, when the network is congested and there are no idle resources, the wireless link connection establishment request message or the wireless link connection recovery request message will be rejected by the base station. At this time, the base station will reply with a wireless link connection rejection (RRCConnectionReject-NB) message through the downlink logical channel.

[0039] However, in the NB-IoT communication network, there may be a situation where one or some terminals keep requesting to join the network and keep failing to connect due to their own problems or network problems. In this case, the terminal keeps sending wireless link connection requests, but the wireless link connection establishment keeps failing. According to the protocol, in this case, the terminal can keep requesting to join the network. Once this happens, on the one hand, it will waste the air interface resources of the NB-IoT base station, increase the CPU load on the base station side, aggravate network congestion, and affect the number of users accepted by the network.

[0040] At the same time, if the malware on the terminal frequently connects to the network or initiates services, it can also cause signaling and traffic impact on the base station. This is also a factor that needs to be considered for the air interface of the NB-IoT base station.

[0041] In view of the above situation, an embodiment of the present invention proposes a method for identifying abnormal terminals. By adding a self-learning function to the base station, abnormal terminals are correspondingly identified, stored and processed, and a good network environment is created for users by restricting the behavior of the terminals.

[0042] like Figure 3 As shown, the method for identifying abnormal terminals in an embodiment of the present invention includes:

[0043] Step 101: Collect communication data with a terminal within a set time period.

[0044] The terminal is usually an NB-IoT terminal, and the communication data with the terminal includes NB-IoT application data communicated with the terminal, and the NB-IoT application data can be various business data, such as data of street light control business, data of electric meter reading reporting business, data of water meter reading reporting business, data of university dormitory air conditioning remote control business, or data of parking information reporting business. The set time period can be one week, one month, or half a year.

[0045] Step 102, identifying abnormal terminals through self-learning based on communication data with the terminals.

[0046] Among them, by adding a self-learning function, abnormal terminals can be identified, stored and processed accordingly, and a good network environment can be created for users by restricting the behavior of terminals.

[0047] like Figure 4 As shown, in one embodiment, the identifying abnormal terminal through self-learning according to the communication data with the terminal includes:

[0048] Step 201: Generate a sample vector from the communication data with the terminal.

[0049] In one embodiment, the generated sample vector is generated by vectorizing the communication data with the terminal.

[0050] Among them, an example of the vectorization processing is: for example, three service characteristics are selected: the time interval between two network access applications, the uplink data volume, and the downlink data volume, and the three service characteristics are respectively used as the three components of the feature vector, and then the data values ​​corresponding to the three service characteristics are extracted in real time from the communication data with the terminal. For example, 5 data are extracted from the communication data with the terminal for each of the three service characteristics, and the 5 data of each service characteristic constitute a column component of the feature vector, and finally a matrix of 3 rows and 5 columns is obtained after the vectorization processing.

[0051] Step 202: cluster the sample vectors to form a service template.

[0052] Step 203: Identify abnormal terminals according to the service template.

[0053] In one embodiment, the clustering algorithm is an unsupervised learning clustering algorithm under machine learning.

[0054] like Figure 5 As shown, in one embodiment, clustering the sample vectors to form a service template includes:

[0055] Step 301: classify and group together application data with the same service attributes in the communication data with the terminal.

[0056] Among them, for example, the application data with the same service in the communication data with the terminal includes: data of street light control service, data of electricity meter reading reporting service, data of water meter reading reporting service, data of university dormitory air conditioning remote control service and data of parking information reporting service; according to the same business attributes they have, the data of street light control service are divided into data of first category of service and grouped together, the data of electricity meter reading reporting service are divided into data of second category of service and grouped together, the data of water meter reading reporting service are divided into data of third category of service and grouped together, the data of university dormitory air conditioning remote control service are divided into data of fourth category of service and grouped together, and the data of parking information reporting service are divided into data of fifth category of service and grouped together.

[0057] Step 302: Divide each type of application data according to its characteristics to form a business template.

[0058] like Figure 6 As shown, in one embodiment, the division of each type of application data according to its characteristics to form a service template includes:

[0059] Step 401, selecting characteristics of each type of application data.

[0060] Among them, the characteristics of the application data are selected, and the characteristics can be a certain service characteristic or certain service characteristics of the application data used by the terminal, such as the time interval between the time the terminal applies for network access and the last time it applied for network access, the amount of uplink data or downlink data of each terminal communication service, etc.

[0061] Step 402, a corresponding reference value is set for each selected characteristic, all characteristics and their corresponding reference values ​​constitute a business template, and all characteristics of each type of application data in the business template and their corresponding reference values ​​constitute a type of business model.

[0062] Each service characteristic corresponds to a reference value. For example, if the time interval between each application for network access by a terminal is 1 day, the service characteristic is the time interval between the application for network access by the terminal, and the reference value of the characteristic is 1 day. In the process of machine learning, one or more service characteristics can be selected for clustering and their corresponding reference values ​​can be selected as needed. Figure 7 As shown, [Characteristic 0, Characteristic 1, ..., Characteristic n] are selected business characteristics, and [M0, M1, ..., Mn] are reference values ​​corresponding to each characteristic.

[0063] In one embodiment, the reference value includes an initial value and an oscillation factor.

[0064] Among them, if the initial value and oscillation factor of the reference value are set, they can be set according to actual experience or the characteristics of the business model. For example, for a certain business type, when the initial value is set to 1 and the oscillation factor is 0.8, when the reference value of the characteristic is within the range of initial value * oscillation factor ~ 1 / oscillation factor * initial value, that is, terminals within the range of 0.8*1 to 1 / 0.8*1 are classified into one category under the characteristic standard. Of course, it is also possible not to set the initial value and oscillation factor at all, and to use the relevant clustering algorithm to set the reference value.

[0065] In one embodiment, the method for identifying abnormal terminals can be repeated multiple times by collecting communication data with the terminal within different set time periods.

[0066] In this way, through continuous machine learning, as the collected communication data is updated, the system can automatically adjust the reference value or oscillation factor of the characteristic.

[0067] When there are multiple features, the conclusions output by each feature may be different. For example, the output conclusion of one feature is that they are classified into one category, while the output conclusion of another feature is that they are not classified into one category. In this case, you can continue to track the communication data of the terminal, continue to learn, and further analyze the characteristics of the communication data of the terminal. After a period of machine learning, the system outputs the clustering results to form a business template. Under the same business template, the behaviors of the terminals are similar and identifiable.

[0068] In addition, when a large amount of communication data with the terminal within a set time period has been accumulated as samples, it can be considered that the characteristics to be classified are comprehensive, and supervised learning classification can be used at this time. Keep updating the clustered business template within a certain range, use the supervised classification algorithm to predict new data that has not appeared in the database, and update the template to make it applicable to new samples, that is, generalization ability.

[0069] Among them, supervised classification is to use the previously clustered business templates as training samples. When new data arrives, an optimal model is obtained by training with the existing training samples, and specific labels are added to the new data. For example, when a simple KNN nearest neighbor classification algorithm is selected, the communication data of a terminal within a set time period is used as a new sample, and the distance between the new sample and all training samples is calculated. The K known training samples closest to the new sample are selected from them. According to the voting rule of minority obeys majority, the new sample and the K nearest neighbor samples with a larger proportion of categories are classified into one category. The K is a positive integer greater than 1, and the value of K can be set according to the specific situation.

[0070] like Figure 8 As shown, the identifying of abnormal terminals according to the service template includes:

[0071] Step 501: Perform service identification on each accessed terminal. If the communication data of a certain terminal or some terminals does not belong to any service model in the service template, the terminal is marked as a heterogeneous abnormal terminal.

[0072] The communication data does not belong to the business model in the business template if the characteristics and corresponding reference values ​​of the communication data do not conform to the characteristics and corresponding reference values ​​in the business model respectively.

[0073] Step 502, when the communication data of the terminal belongs to a type of application business model in the business template, the terminal is a normal business model terminal; for the terminal of the normal business model, when its wireless link request still cannot be accessed after exceeding the set time limit, the terminal is marked as a common abnormal terminal.

[0074] Among them, the time limit for exceeding the set time is usually set to more than 90 seconds.

[0075] In one embodiment, the identified heterogeneous abnormal terminals and common abnormal terminals are saved in real time.

[0076] In one embodiment, the identifying abnormal terminals according to the service template further includes:

[0077] For a terminal in a TAU (Tracking Area Update) cycle or between two network attachments, each terminal should correspond to a TMSI (Temporary Mobile Subscriber Identity). The purpose of setting TMSI is to prevent illegal individuals or groups from stealing IMSI (International Mobile Subscriber Identity) or tracking user locations by monitoring signaling on the wireless path. It is a temporary user identification number assigned to users in the VLR to ensure the security of IMSI in mobile communications. It is used to temporarily replace IMSI for transmission in the air interface. TMSI is only valid for a certain period of time in a location area, so during this period, the same TMSI should correspond to the same business model. Therefore, when a TMSI corresponds to different business models, the terminal is abnormal and should be marked as a heterogeneous abnormal terminal.

[0078] Among them, each terminal should correspond to a TMSI during a TAU update cycle or between two network attachments. Therefore, during this period, the same TMSI should correspond to the same service model. Therefore, when a TMSI corresponds to different service models, the terminal is abnormal and is marked as a heterogeneous abnormal terminal. When there is malicious access to the TMSI, the statistics of the success rate of RRC connection establishment will drop significantly, causing serious damage to network indicators. At this time, the statistics of the success rate of RRC connection establishment are easy to mislead. Through learning, the system can effectively identify the situation of malicious access to the TMSI and mark the maliciously attacked terminals as heterogeneous abnormal terminals. Thereby reducing the probability of malicious access to the TMSI, the statistics of the success rate of RRC connection establishment will be more normal, and the statistical accuracy will be higher.

[0079] In one embodiment, before forming a service template, a random access tracking diagnosis is performed on the terminal with abnormal access. If the terminal still fails to access successfully within a given time period, the terminal is directly marked as a common abnormal terminal.

[0080] Among them, the terminal with abnormal access is usually: a mobile terminal that has not accessed the base station for more than a set time, which is regarded as a terminal with abnormal access. The time exceeding the set time can be set to more than 90 seconds, and the given time period can be set to more than 100 seconds.

[0081] In one embodiment, after identifying the abnormal terminal, the method further includes:

[0082] Behavior restrictions on abnormal terminals.

[0083] like Fig. 9 As shown, in one embodiment, the behavior restriction on abnormal terminals includes:

[0084] Step 601: For a heterogeneous abnormal terminal, any access behavior of the heterogeneous abnormal terminal is rejected by sending a wireless link rejection message.

[0085] Among them, the access is usually the behavior of a heterogeneous abnormal terminal accessing a base station. At this time, the wireless link rejection message sent can carry an infinite delay time delayTime, so that the terminal will not initiate any access behavior thereafter; the wireless link rejection message can also carry a specific rejection reason to notify the terminal not to initiate any access behavior thereafter.

[0086] Step 602: For a common abnormal terminal, it is determined whether to restrict the access behavior of the common abnormal terminal by judging according to the current network status.

[0087] The common abnormal terminal accesses the base station through the network.

[0088] like Fig.10 As shown, the determination of whether to restrict the access behavior of the common abnormal terminal by judging according to the network status at this time includes:

[0089] Step 701: Under the condition of network congestion, a wireless link rejection message is sent to the common abnormal terminal.

[0090] If a large number of terminals need to access the base station and the network load is high, the network congestion judgment condition will lead to the conclusion that the network is congested, and a wireless link rejection message needs to be sent to the common abnormal terminal. The specific network congestion judgment condition depends on the specific conditions.

[0091] In one embodiment, the sent radio link rejection message carries a set delay time.

[0092] The wireless link rejection message sent carries the set delay time delayTime, so that the terminal can initiate the access request again after the delay time, so as to alleviate the network congestion. When the wireless link rejection message received by the terminal carries the delay time delayTime, the terminal knows that the network is congested at this time, and its access is temporarily restricted due to multiple access failures. It needs to wait for the delay time delayTime before sending the wireless link connection request message again to initiate the wireless link connection request.

[0093] Step 702: If the network is still in a congested condition after the delay time, when the wireless link connection request message of the terminal is received again, the wireless link rejection message is continuously sent.

[0094] In one embodiment, after identifying the abnormal terminal, the method further includes:

[0095] Share information about identified abnormal terminals.

[0096] Among them, the usual way of information sharing is to send the identified abnormal terminals stored in this base station to the neighboring base stations in real time or regularly through an information interaction module such as a 3G module or a 4G module, to interact and share information between base stations, so that the neighboring base stations can consolidate the aforementioned restriction processing on the behavior of abnormal terminals. At the same time, the abnormal terminals stored in the neighboring base stations are also sent to this base station for processing. Through information interaction between neighboring base stations, the efficiency of identifying and storing abnormal terminals can be improved, and the waste of resources caused by repeated identification and storage of the same abnormal terminal by different base stations can be avoided.

[0097] In summary, the method for identifying abnormal terminals is low-cost, does not require additional hardware equipment, is easy to implement, easy to operate, and convenient to maintain. Functionally, the embodiment of the invention can effectively alleviate network congestion, reduce the CPU load of the base station, and the statistics of the success rate of wireless link establishment will be more accurate. In addition, when the network encounters an external abnormal terminal attack, the base station can also effectively identify and stop it.

[0098] like Fig.11 As shown, an embodiment of the present invention further provides a device for identifying an abnormal terminal, including:

[0099] The collection module 71 is used to collect communication data with the terminal within a set time period;

[0100] The identification module 72 is used to identify abnormal terminals through self-learning based on communication data with the terminals.

[0101] In one embodiment, the identification module is further used to generate sample vectors from the communication data with the terminal, cluster the sample vectors to form service templates, and identify abnormal terminals according to the service templates.

[0102] In one embodiment, the identification module is further used to classify and group together application data with the same service attributes in the communication data with the terminal and to divide each type of application data according to its characteristics to form a service template.

[0103] In one embodiment, the identification module is also used to select the characteristics of each type of application data and set a corresponding reference value for each selected characteristic. All the characteristics and their corresponding reference values ​​constitute a business template. All the characteristics of each type of application data in the business template and their corresponding reference values ​​constitute a type of business model.

[0104] In one embodiment, the identification module is also used to perform service identification on each accessed terminal. If the communication data of a certain terminal or certain terminals does not belong to any type of business model in the business template, the terminal is marked as a heterogeneous abnormal terminal; it is also used to identify the terminal as a normal business model terminal when the communication data of the terminal belongs to a type of application business model in the business template; for the terminal of the normal business model, when its wireless link request still cannot be accessed after exceeding the set time limit, the terminal is marked as a common abnormal terminal.

[0105] In one embodiment, the apparatus for identifying abnormal terminals further includes a storage module;

[0106] The storage module is used to store the identified heterogeneous abnormal terminals and common abnormal terminals in real time.

[0107] In one embodiment, the apparatus for identifying abnormal terminals further includes a restriction module;

[0108] The restriction module is used to restrict the behavior of abnormal terminals.

[0109] In one embodiment, the restriction module is also used to reject any access behavior of heterogeneous abnormal terminals by sending wireless link rejection messages; and is also used to decide whether to restrict the access behavior of ordinary abnormal terminals by judging according to the network conditions at that time.

[0110] In one embodiment, the restriction module is also used to send a wireless link rejection message to the ordinary abnormal terminal under the condition of network congestion at this time; and is also used to continue to send the wireless link rejection message when the wireless link connection request message of the terminal is received again if the network is still in the condition of network congestion after the delay time.

[0111] In one embodiment, the apparatus for identifying abnormal terminals further includes a sharing module;

[0112] The sharing module is used to share information of identified abnormal terminals.

[0113] In summary, the device for identifying abnormal terminals has low cost, does not require additional hardware equipment, is easy to implement, easy to operate, and convenient to maintain. Functionally, the embodiment of the invention can effectively alleviate network congestion, reduce the CPU load of the base station, and the statistics of the success rate of wireless link establishment will be more accurate. In addition, when the network encounters an external abnormal terminal attack, the base station can also effectively identify and stop it.

[0114] An embodiment of the present invention further provides a base station, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the method for identifying abnormal terminals is implemented when the processor executes the program.

[0115] The embodiment of the present invention adds a self-learning function to the base station, identifies, stores and processes abnormal terminals accordingly, and creates a good network environment for users by restricting the behavior of the terminals. This overcomes the problems and defects of the prior art that abnormal terminals continue to request network access, waste the air interface resources of the base station, and aggravate network congestion.

[0116] An embodiment of the present invention further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method for identifying abnormal terminals.

[0117] In this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0118] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically include computer-readable instructions, data structures, program modules, or modulated data signals such as carrier waves or other transport mechanisms.

Claims

1. A method for identifying an abnormal terminal, comprising: Collect communication data with the terminal within a set time period; Generate a sample vector from the communication data with the terminal, where the terminal is a narrowband Internet of Things NB-IoT terminal; Classifying and grouping together application data having the same service attributes in the communication data with the terminal; Each type of application data is divided according to its characteristics to form a business template; Identifying abnormal terminals according to a business template, wherein the business template includes multiple types of business models; The process of dividing each type of application data according to its characteristics to form a service template includes: Selecting characteristics of each type of application data; A corresponding reference value is set for each selected characteristic, and all the characteristics and their corresponding reference values ​​constitute a service template. All the characteristics of each type of application data in the service template and their corresponding reference values ​​constitute a type of service model; wherein the characteristics include at least one of the following: the time interval between the terminal's application for network access and the last application for network access, and the amount of uplink data or downlink data of each terminal communication service.

2. The method for identifying abnormal terminals according to claim 1, characterized in that: The reference value includes an initial value and an oscillation factor.

3. The method for identifying abnormal terminals according to claim 1, characterized in that: By collecting communication data with the terminal within different set time periods, the method for identifying abnormal terminals can be repeated multiple times.

4. The method for identifying abnormal terminals according to claim 1, characterized in that: The identifying of abnormal terminals according to the service template includes: Performing service identification on each terminal that is connected. If the communication data of a terminal or some terminals does not belong to any service model in the service template, the terminal is marked as a heterogeneous abnormal terminal. When the communication data of a terminal belongs to a type of application business model in the business template, the terminal is a normal business model terminal; for a terminal with a normal business model, when its wireless link request still cannot be accessed after exceeding the set time limit, the terminal is marked as a common abnormal terminal.

5. The method for identifying abnormal terminals according to claim 1, characterized in that: The identified abnormal terminals and common abnormal terminals are saved in real time.

6. The method for identifying abnormal terminals according to claim 1, characterized in that: The identifying of abnormal terminals according to the service template also includes: For a terminal in a TAU update cycle or between two network attachments, each terminal corresponds to a TMSI. When a TMSI corresponds to a different service model, the terminal is abnormal, and the terminal is marked as a heterogeneous abnormal terminal.

7. The method for identifying abnormal terminals according to claim 1, characterized in that: Before forming a service template, a random access tracking diagnosis is performed on the terminal with abnormal access. If the terminal still fails to access successfully within a given time period, the terminal is directly marked as a common abnormal terminal.

8. The method for identifying abnormal terminals according to claim 1, characterized in that: After the abnormal terminal is identified, the method further includes: Behavior restrictions on abnormal terminals.

9. The method for identifying abnormal terminals according to claim 8, characterized in that: The behavior restrictions on abnormal terminals include: For a heterogeneous abnormal terminal, reject any access behavior of the heterogeneous abnormal terminal by sending a wireless link rejection message; For common abnormal terminals, it is determined whether to restrict the access behavior of the common abnormal terminals by judging according to the network status at that time.

10. The method for identifying abnormal terminals according to claim 9, characterized in that: The determining whether to restrict the access behavior of the common abnormal terminal by judging according to the current network status includes: Under the condition of network congestion at this time, sending a wireless link rejection message to the common abnormal terminal; If the network is still in a congested condition after the delay time, the wireless link rejection message continues to be sent when the wireless link connection request message of the terminal is received again.

11. The method for identifying abnormal terminals according to claim 1, characterized in that: After the abnormal terminal is identified, the method further includes: Share information about identified abnormal terminals.

12. A base station, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method for identifying an abnormal terminal according to any one of claims 1 to 11 is implemented.

13. A computer-readable storage medium storing computer-executable instructions, characterized in that: The computer executable instructions are used to execute the method for identifying abnormal terminals according to any one of claims 1 to 11.

Images