Abnormal terminal identification method, analysis device and equipment, storage medium

Abstract

According to the abnormal terminal identification method, analysis device and equipment, and storage medium provided by the embodiments of the present invention, signaling information of the terminal within a period is collected; distribution statistics are performed on the signaling information to obtain a first distribution characteristic value; when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, the terminal is determined to be an abnormal terminal; the abnormal terminal identification method proposed in this embodiment performs anomaly detection based on terminal historical data, and realizes automatic self-anomaly detection by expanding the signaling message, thereby avoiding the problem of inaccurate anomaly detection using the indicator mean for anomaly detection in the related technology, and improving the accuracy of abnormal terminal detection.

Description

Technical Field

[0001] The embodiments of the present invention relate to, but are not limited to, the field of communication technology, and specifically, to, but are not limited to, an abnormal terminal identification method, an analysis device and equipment, and a storage medium. Background Art

[0002] With the emergence and development of the Internet of Things, various IoT smart terminals are increasingly appearing in people's daily lives, such as smart watches / bracelets, smart electricity meters, smart door locks, sweeping robots, etc.

[0003] However, as IoT terminals are becoming more and more popular, the number of IoT terminal accesses is growing exponentially. Abnormal terminals in the IoT will reduce the effective load of the operator's network and cause network resource waste. Therefore, abnormal terminal inspection can improve network optimization efficiency and reduce network operating costs.

[0004] At present, the abnormal terminal identification technology of IoT is almost limited to the internal system of IoT industry. Through the upgrade of IoT terminal function modules, adjustment of management system architecture and optimization of signaling messages, the abnormal signaling link between terminal and server is identified and the abnormal terminal is located. This abnormal terminal identification requires adjustment of system architecture and change of signaling process, and the overall resource overhead is high; if there is no unified planning in the early stage of IoT construction, the cost of later implementation is high; there are differences in industry business processes in this kind of upgrade and transformation within the industry, so this method is not universal; mobile operators, as the providers of IoT pipelines, cannot conduct unified monitoring and analysis of network terminals. Due to the "simultaneous synchronization" characteristics of specific IoT services, when a terminal failure occurs, the operator cannot quickly demarcate and locate the fault. The abnormal terminal detection method is single, the abnormal detection effect is poor, and the detection is inaccurate. Summary of the invention

[0005] The abnormal terminal identification method, analysis device and equipment, and storage medium provided in the embodiments of the present invention mainly solve the technical problem that when abnormal terminals exist in the Internet of Things, the abnormal terminals cannot be accurately detected and the detection effect is poor.

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a method for identifying an abnormal terminal, comprising:

[0007] Collect signaling information of the terminal within the period;

[0008] Performing distribution statistics on the signaling information to obtain a first distribution characteristic value;

[0009] When the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, the terminal is determined to be an abnormal terminal.

[0010] The embodiment of the present invention also provides an analysis device, the analysis device comprising:

[0011] A collection module, which is used to collect signaling information of the terminal within a period;

[0012] A feature construction module, the feature construction module is used to perform distribution statistics on the signaling information to obtain a first distribution feature value;

[0013] The abnormality detection module is used to determine that the terminal is an abnormal terminal when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold.

[0014] An embodiment of the present invention further provides an analysis device, the analysis device comprising a processor, a memory and a communication bus;

[0015] The communication bus is used to realize the connection and communication between the processor and the memory;

[0016] The processor is used to execute one or more computer programs stored in the memory to implement the steps of the abnormal terminal identification method as described above.

[0017] An embodiment of the present invention further provides a computer storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the above abnormal terminal identification method.

[0018] According to the abnormal terminal identification method, analysis device and equipment, and storage medium provided by the embodiments of the present invention, signaling information of the terminal within a period is collected; distribution statistics are performed on the signaling information to obtain a first distribution characteristic value; when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, the terminal is determined to be an abnormal terminal; the abnormal terminal identification method proposed in this embodiment performs anomaly detection based on terminal historical data, and realizes automatic self-anomaly detection by expanding the signaling message, thereby avoiding the problem of inaccurate anomaly detection using the indicator mean for anomaly detection in the related technology, and improving the accuracy of abnormal terminal detection.

[0019] Other features and corresponding beneficial effects of the present invention are described in the latter part of the specification, and it should be understood that at least part of the beneficial effects become obvious from the description in the specification of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a basic flow chart of a method for identifying an abnormal terminal according to a first embodiment of the present invention;

[0021] Figure 2 This is a basic schematic diagram of Internet of Things networking signaling collection according to Embodiment 1 of the present invention;

[0022] FIG3 is a basic schematic diagram of fluctuations in the time series distribution of effective information in accordance with the first embodiment of the present invention;

[0023] Figure 4 This is a basic schematic diagram of fluctuations within a mean presentation interval of effective information in accordance with the first embodiment of the present invention;

[0024] Figure 5 This is a basic schematic diagram of distribution statistical data according to the first embodiment of the present invention;

[0025] Figure 6 This is a timing diagram of valid information of a silent terminal according to the second embodiment of the present invention;

[0026] Figure 7 This is a basic flow chart of a method for identifying an abnormal terminal according to Embodiment 2 of the present invention;

[0027] Figure 8 A schematic diagram of the basic structure of an analysis device provided in Embodiment 4 of the present invention;

[0028] Fig. 9 This is a schematic diagram of the basic structure of the analysis equipment provided in Example 4 of the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the following is a further detailed description of the embodiments of the present invention through specific implementation methods combined with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0030] Embodiment 1:

[0031] In order to solve the problem in the prior art that when abnormal terminals exist in the Internet of Things network, the abnormal terminals cannot be accurately detected and the detection effect is poor.

[0032] See also Figure 1 , Figure 1 The following is a basic flow chart of a method for identifying abnormal terminals, which includes but is not limited to:

[0033] S101, collecting signaling messages of the terminal within a period;

[0034] In some embodiments, the signaling messages of the terminal within the period are collected by an external probe, such as Figure 2As shown, in the networking of the physical network, there are control plane signaling information collection point 1 and user plane signaling information collection point 2. For example, by deploying an external probe on the MME side of the S1MME interface between the eNodeB (Evolved Node B, base station) and the MME (Mobility Management Entity, key control node), the control plane signaling message is collected; by collecting the user plane signaling message on the SGW side of the S1-U interface between the eNodeB and the SGW (Serving GateWay, serving gateway); and then completely obtain the signaling message of the terminal within the cycle duration. It should be understood that the cycle duration can be freely set, for example, the cycle duration is seven days, the cycle duration is five days, etc.

[0035] S102, performing distribution statistics on the signaling message to obtain a first distribution characteristic value;

[0036] In some embodiments, before performing distribution statistics on signaling messages, the following is also included: performing data cleaning on the signaling messages to obtain multiple valid information; performing small-granular aggregation statistics on each valid information to obtain data of N granularities; it should be understood that the collected signaling messages contain a large amount of information, and therefore, it is necessary to clean, strip, and regularize the information in the signaling information to obtain complete valid information as key indicators; for example, cleaning and regularizing fields such as time information, user information, terminal information, user behavior information (for example, APN (Access Point Name)), user location information, and key KPI indicators (for example, coverage indicators, call establishment indicators, call holding indicators, and mobility management indicators) in the information information to obtain valid information as key indicators; then performing small-granular aggregation statistics on the valid information (that is, key indicators), for example, performing hourly granular aggregation statistics on the control plane signaling type and signaling number of the terminal; for example, performing hourly granular aggregation statistics on valid information such as the uplink traffic, downlink traffic, and transmission duration of the terminal to obtain N granular data corresponding to N valid information.

[0037] In some embodiments, performing distribution statistics on the signaling information to obtain the first distribution characteristic value includes: performing distribution statistics on data of each granularity to obtain the first distribution characteristic value corresponding to the data of each granularity; it should be understood that the IoT terminal is affected by external factors such as the network, environment, and human behavior. When each IoT terminal has no faults, the time series distribution of each valid information presents a characteristic of fluctuation within an interval, such as Figure 3-1 As shown in , if the mean of each valid information is used as the only measure of valid information, many detailed features of the valid information will be lost, such as Figure 3-2As shown, the abnormal terminal cannot be accurately detected, and the detection effect is poor. Therefore, in order to more accurately identify the abnormal terminal through the effective information in the signaling information, a single indicator (single effective information) high-dimensional expansion analysis method is adopted to identify the abnormal terminal.

[0038] In some embodiments, performing distribution statistics on the data of each granularity to obtain a first distribution characteristic value corresponding to the data of each granularity includes: calculating the exponential sliding change rate of the data of the i-th granularity among the data of N granularities by using an exponential sliding change rate formula, and using the exponential sliding change rate as the first distribution characteristic value of the data of the i-th granularity;

[0039] The formula for the exponential sliding rate of change is as follows:

[0040]

[0041] Among them, α∈(0,1) is the coefficient of variation. For example, the exponential sliding rate of change is used to identify the scene of small glitches in the effective information, such as Figure 4 As shown, the first distribution characteristic value of the effective information is obtained.

[0042] In some embodiments, distribution statistics are performed on the data of each granularity to obtain the first distribution characteristic value corresponding to the data of each granularity, including: by fitting the data of the i-3, i-2, i-1 and i-th granularities with least squares, the least squares coefficient of variation of the data of the i-th granularity among the N granularities is calculated, and the least squares coefficient of variation is used as the first distribution characteristic value of the data of the i-th granularity. It should be understood that since the actual data is often mixed with noise data, the algorithm also adds the coefficient of variation to shield the noise. The coefficient of variation eliminates the dimension, making the algorithm universal. It improves the accuracy when performing abnormal analysis on the effective information of the Internet of Things terminal.

[0043] The coefficient of variation of the window window is defined as

[0044]

[0045] In some embodiments, performing distribution statistics on the data of each granularity to obtain the first distribution characteristic value corresponding to the data of each granularity includes: calculating the total variation coefficient of the data of the i-th granularity among the data of N granularities by using the total variation formula, and using the total variation coefficient of the data of the i-th granularity as the first distribution characteristic value of the data of the i-th granularity;

[0046] The total variation formula is as follows:

[0047]

[0048] Wherein, total_variations = ∑|α[i+1]-α[i]|. For example, the total variation coefficient is used to monitor and identify the instantaneous abnormal fluctuation of the effective information of the terminal in the Internet of Things.

[0049] S103: when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, determining that the terminal is an abnormal terminal;

[0050] In some embodiments, the first distribution characteristic values ​​of each valid information collected in the current period are compared with the distribution characteristic values ​​of each valid information collected in the previous period. When the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, the terminal is determined to be an abnormal terminal. It should be understood that the preset threshold can be determined based on the first distribution characteristic value of each valid parameter.

[0051] It should be understood that the above-mentioned methods of performing distribution statistics on data of each granularity to obtain the first distribution characteristic value corresponding to the data of each granularity can be used in combination to improve the recognition rate of abnormal terminals in the Internet of Things.

[0052] In some embodiments, the method further includes: statistically analyzing the first distribution characteristic value and the distribution characteristic values ​​of similar terminals to obtain distribution statistical data; judging whether the terminal is an abnormal terminal based on the distribution statistical data; it should be understood that before statistically analyzing the first distribution characteristic value and the distribution characteristic values ​​of similar terminals to obtain the distribution statistical data, it also includes: identifying the terminal category through signaling information to determine the terminal category.

[0053] In some embodiments, the terminal category is identified through characteristic services in the signaling information to determine the terminal category. For example, the IoT industry and IoT enterprise of the terminal are identified through key service features such as the terminal number segment and the APN visited, so as to classify the IoT terminal and determine the terminal category.

[0054] It should be understood that the behavior of terminals in the same IoT industry has consistent characteristics, that is, the distribution of their effective information has consistent characteristics, including control plane behavior and user plane behavior; when an individual terminal is abnormal, the effective information (key indicators) of the terminal will show significant differences from other terminals in the industry; in some embodiments, by statistically analyzing the first distribution feature value and the distribution feature values ​​of similar terminals, distribution statistical data is obtained, such as Figure 5 As shown; then determine whether the terminal is an abnormal terminal based on the distribution statistical data; for example, when identifying abnormal high-frequency terminals, feature extraction is performed based on the distribution statistical data. In the feature extraction process, the main frequency is extracted using discrete Fourier transform as the key feature indicator, which is set as a discrete sequence. The discrete Fourier transform formula is:

[0055]

[0056] The main frequency of signaling reporting is solved for the transformed sequence as the frequency feature. In addition, the control plane signaling number and the business reporting traffic are added as auxiliary features for discrete point solution, so as to identify the abnormally high-frequency terminals in the same industry, and the abnormally high-frequency terminals of control plane signaling and the abnormally high-frequency users of user plane signaling are identified; that is, for the abnormal terminals of key indicators, the two-dimensional expansion results of the second expansion module are used to solve the distribution characteristics of the matrix after two-dimensional expansion, and the terminals with abnormal key indicators are marked by identifying the discrete points of the overall distribution.

[0057] The abnormal terminal identification method provided by the embodiment of the present invention collects signaling information of the terminal within the period; distributes and counts the signaling information to obtain a first distribution characteristic value; when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, the terminal is determined to be an abnormal terminal; the abnormal terminal identification method proposed in this embodiment performs abnormal detection based on terminal historical data, and realizes automatic self-abnormal detection by expanding the signaling message, thereby avoiding the problem of inaccurate abnormal detection using the average value of the indicator for abnormal detection in the related technology, and improving the accuracy of abnormal terminal detection; in some optional embodiments, the first distribution characteristic value is statistically obtained by comparing the distribution characteristic value of the same type of terminal with the distribution characteristic value; whether the terminal is an abnormal terminal is determined according to the distribution statistical data; the first distribution characteristic value is statistically performed here, that is, the signaling information is expanded in high dimension, so as to identify the abnormal terminal, thereby improving the detection speed of the abnormal terminal, and at the same time improving the accuracy of the abnormal terminal detection; at the same time, the abnormal terminal identification method proposed in this embodiment has no functional upgrade requirements for the terminal, does not need to change the original Internet of Things architecture, supports the identification of abnormal terminals in different Internet of Things industries, and thus reduces the abnormal terminal identification cost.

[0058] Embodiment 2:

[0059] In order to better understand the present invention, this embodiment provides a more specific example to illustrate the above-mentioned abnormal terminal identification method. When there is a silent terminal (abnormal terminal) in the Internet of Things, the control plane signaling information interaction of the silent terminal is normal, and the user plane signaling information only has the traffic to maintain the basic heartbeat message, and does not trigger the business report of the industry, such as Figure 6 As shown, Figure 6 This is the timing diagram of the effective information of the silent terminal. It can be understood that the effective information indicators of the terminals in the Internet of Things have a baseline value, that is, the effective information indicator is not zero in the "non-glitch" place. It should be understood that the baseline value is different for different terminals, so it is impossible to simply judge the silent terminal by the indicator threshold of the effective information. Figure 7As shown, the method for identifying the abnormal terminal includes but is not limited to:

[0060] S701, terminal signaling collection;

[0061] In some embodiments, the user plane signaling message is collected on the SGW side of the S1-U interface between the eNodeB and the SGW (Serving GateWay) to obtain the signaling information of the user plane terminal within the period duration.

[0062] S702, indicator cleaning;

[0063] In some embodiments, the collected signaling information is cleaned of user information to obtain valid information as key indicators, for example, including: key indicator information such as traffic and duration; for example, terminal information, including key information such as terminal signal and brand; APN accessed by the terminal; information such as the location of the terminal;

[0064] S703, IoT industry identification;

[0065] In some embodiments, the user's IoT industry and IoT enterprise are identified through key business features such as the user's number segment and the APN visited, thereby determining the industry of the terminal. It should be understood that the execution order of this step is not limited, and it can be after step S702 and before step S707.

[0066] S704, indicator statistics;

[0067] In some embodiments, the key indicators obtained after cleaning the signaling information are statistically analyzed at an hourly granularity; for example, key indicators such as uplink traffic, downlink traffic, transmission duration, etc. in the terminal dimension are aggregated at an hourly granularity.

[0068] S705, one-dimensional expansion of indicators and one-dimensional feature extraction;

[0069] In some embodiments, the indicator is expanded in one dimension, and the one-dimensional feature is extracted to obtain the first distribution characteristic value; for example: the key indicator of the terminal is expanded in the time dimension with an hourly granularity and a window period of 7 days to obtain the first distribution characteristic value corresponding to the data of each granularity; it should be understood that obtaining the first distribution characteristic value corresponding to the data of each granularity is consistent with the method in the above-mentioned embodiment, which will not be repeated here.

[0070] S706, abnormal terminal identification;

[0071] In some embodiments, when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, the terminal is determined to be an abnormal terminal. It should be understood that the preset threshold can be determined based on the first distribution characteristic value of each valid parameter.

[0072] It should be understood that, in some embodiments, the method further comprises:

[0073] S707, two-dimensional expansion of indicators, two-dimensional feature extraction;

[0074] In some embodiments, the terminal's indicators are expanded with two-dimensional indicators of similar terminals to obtain distribution statistics, and then the indicators are discrete fast Fourier transformed to convert the terminal's time series characteristics into frequency domain characteristics, and the mean square error of the sequence after discrete fast Fourier transform is calculated.

[0075] S708, abnormal terminal identification;

[0076] In some embodiments, the mean square error std after Fourier transformation of the index of a single terminal is obtained. FFT Perform clustering, sort the terminal grouping categories after clustering according to the mean, and obtain the threshold std of the group with the minimum mean FFT =50. For std FFT <50 terminals are filtered and marked as silent users. If the current terminal belongs to std FFT <50 terminals, the current terminal is marked as a silent terminal (abnormal terminal).

[0077] Embodiment three:

[0078] In order to better understand the present invention, this embodiment provides a more specific example to illustrate the above-mentioned method for identifying abnormal terminals. Since the Internet of Things has the characteristic of consistent terminal behavior within the industry, the signaling behavior of the control plane also has consistent distribution characteristics. In the Internet of Things, due to the problem of multi-cell coverage, the signaling process will have a switching process compared to the NB (NodeB, base station), but in the same Internet of Things network or the same industry, its behavior is still consistent within the signaling fluctuation range. Due to the behavioral consistency of the Internet of Things terminals, and the fact that the number of terminals is much higher than that of the human network, abnormally high frequency of signaling can easily cause network signaling storms and network congestion. Therefore, the identification of terminals with abnormally high frequency of control plane signaling is of great value. Figure 8 As shown, the method for identifying the abnormal terminal includes but is not limited to:

[0079] Step 1: Terminal signaling collection;

[0080] In some embodiments, control plane signaling messages are collected by deploying an external probe on the MME side of the S1MME interface between the eNodeB (Evolved Node B, base station) and the MME (Mobility Management Entity, key control node);

[0081] Step 2: Indicator cleaning;

[0082] In some embodiments, valid information is obtained by cleaning user information from the collected signaling information as key indicators, for example, including: key indicator information such as traffic and duration; for example, terminal information, including key information such as terminal signal and brand; key indicators include the number of attachment requests, the number of attachment failures, the number of detachment requests, the number of detachment failures, the number of tracking area update requests, the number of tracking area update failures, the number of service requests, the number of service request failures, the number of S1 handover requests, the number of S1 handover request failures, the number of X2 handover requests, the number of X2 request failures, the number of paging requests, the number of paging failures, the number of dedicated bearer activation requests, the number of dedicated bearer activation failures, the number of bearer modification requests, the number of bearer modification failures, the number of bearer deactivation requests, the number of bearer deactivation failures and other key signaling indicators;

[0083] Step 3: Identify the IoT industry;

[0084] In some embodiments, the user's IoT industry and IoT enterprise are identified through key business features such as the user's number segment and the APN visited, thereby determining the industry of the terminal. It should be understood that the execution order of this step is not limited, and it can be after step 2 and before step 7.

[0085] Step 4: Indicator statistics;

[0086] In some embodiments, the key indicators obtained after cleaning the signaling information are statistically analyzed at an hourly granularity; for example, the number of requests and the number of failures of each signaling in the terminal dimension are aggregated at an hourly granularity.

[0087] Step 5: One-dimensional expansion of indicators and one-dimensional feature extraction;

[0088] In some embodiments, the indicator is expanded in one dimension, and the one-dimensional feature is extracted to obtain the first distribution characteristic value; for example, the key indicator of the terminal is expanded in the time dimension with an hourly granularity and a window period of 7 days to obtain the first distribution characteristic value corresponding to the data of each granularity; it should be understood that obtaining the first distribution characteristic value corresponding to the data of each granularity is consistent with the method in the above-mentioned embodiment, which will not be repeated here.

[0089] Step 6: Identify abnormal terminals;

[0090] In some embodiments, when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, the terminal is determined to be an abnormal terminal. It should be understood that the preset threshold can be determined based on the first distribution characteristic value of each valid parameter.

[0091] It should be understood that, in some embodiments, the method further comprises:

[0092] Step 7: Expand the indicators in two dimensions.

[0093] In some embodiments, the terminal's indicator is expanded with two-dimensional indicators of similar terminals to obtain distribution statistics;

[0094] Step 8: 2D feature extraction and abnormal terminal identification;

[0095] The distribution features of the matrix after the secondary expansion are extracted, and finally the two indicators of the quartile and median of the secondary distribution are selected for clustering. After clustering, the distribution threshold is obtained according to the mean value within the group. For terminals whose median and mean are both higher than the threshold, they are finally identified as abnormally high-frequency terminals for control plane signaling. If the median and mean of the current terminal are both higher than the threshold, the current terminal is identified as an abnormally high-frequency terminal for control plane signaling.

[0096] Embodiment three:

[0097] This embodiment also provides an analysis device, such as Figure 8 As shown, the analysis device comprises:

[0098] A collection module, which is used to collect signaling information of the terminal within a period;

[0099] A feature construction module, the feature construction module is used to perform distribution statistics on the signaling information to obtain a first distribution feature value;

[0100] The anomaly detection module is used to determine that the terminal is an abnormal terminal when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold.

[0101] It should be understood that the present invention identifies abnormal terminals in the Internet of Things by adding an analysis device outside the Internet of Things network. There is no need to modify the terminals and the overall architecture in the Internet of Things network, and there is no need to change the Internet of Things network. The generalized functions can cover all industries in the Internet of Things at the same time, thereby greatly reducing the monitoring cost and shortening the function launch cycle. While realizing abnormal terminal monitoring in all industries in the Internet of Things, the efficiency of Internet of Things network operation and maintenance is greatly improved.

[0102] This embodiment also provides an analysis device, see Fig. 9 As shown, it includes a processor 901, a memory 902 and a communication bus 903, wherein:

[0103] The communication bus 903 is used to realize the connection and communication between the processor 901 and the memory 902;

[0104] The processor 901 is configured to execute one or more computer programs stored in the memory 902 to implement at least one step of the abnormal terminal identification method in the above-mentioned embodiments 1, 2 and 3.

[0105] The present embodiment also provides a computer-readable storage medium, which includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer.

[0106] The computer-readable storage medium in this embodiment can be used to store one or more computer programs, and the one or more computer programs stored therein can be executed by a processor to implement at least one step in the abnormal terminal identification method in the above-mentioned embodiments 1, 2 and 3.

[0107] It can be seen that those skilled in the art should understand that all or some of the steps, systems, and functional modules / units in the above disclosed methods can be implemented as software (which can be implemented with computer program code executable by a computing device), firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component can have multiple functions, or a function or step can be performed by several physical components in cooperation. Some or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit.

[0108] In addition, it is well known to those skilled in the art that communication media generally contain computer readable instructions, data structures, computer program modules or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery media. Therefore, the present invention is not limited to any specific hardware and software combination.

[0109] The above contents are further detailed descriptions of the embodiments of the present invention in combination with specific implementation methods, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for identifying an abnormal terminal, comprising: Collect signaling information of the terminal within the period, and obtain valid information in the signaling information; Perform small-granularity aggregation statistics on each valid information to obtain data of N granularities; Performing distribution statistics on the data of each particle size to obtain a first distribution characteristic value corresponding to the data of each particle size, wherein the first distribution characteristic value includes: an exponential sliding change rate and / or a least squares coefficient of variation; When the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold, determining that the terminal is an abnormal terminal; The formula for the exponential sliding change rate of the data of the i-th granularity among the N granularity data is as follows: α∈(0,1) is the coefficient of variation; The least squares coefficient of variation of the data of the i-th particle size among the data of the N particle sizes is calculated by fitting the data of the i-3, i-2, i-1 and i-th particle sizes using least squares.

2. The method for identifying an abnormal terminal according to claim 1, characterized in that: Acquiring valid information in the signaling information includes: The signaling information is cleaned to obtain multiple valid information.

3. The method for identifying an abnormal terminal according to claim 1 or 2, characterized in that: The method further comprises: Counting the first distribution characteristic value and distribution characteristic values ​​of similar terminals to obtain distribution statistical data; Whether the terminal is an abnormal terminal is determined according to the distribution statistical data.

4. The method for identifying an abnormal terminal according to claim 3, characterized in that: Before the first distribution characteristic value and distribution characteristic values ​​of the same type of terminals are counted to obtain distribution statistical data, the method further includes: The terminal category is identified and determined through the signaling information.

5. An analysis device, comprising: A collection module, the collection module is used to collect signaling information of the terminal within a period of time, and obtain valid information in the signaling information; A feature construction module, wherein the feature construction module is used to aggregate and count each valid information in a small granularity to obtain data of N granularities; Performing distribution statistics on the data of each particle size to obtain a first distribution characteristic value corresponding to the data of each particle size, wherein the first distribution characteristic value includes: an exponential sliding change rate and / or a least squares coefficient of variation; an abnormality detection module, wherein the abnormality detection module is used to determine that the terminal is an abnormal terminal when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold; The formula for the exponential sliding change rate of the data of the i-th granularity among the N granularity data is as follows: α∈(0,1) is the coefficient of variation; The least squares coefficient of variation of the data of the i-th particle size among the data of the N particle sizes is calculated by fitting the data of the i-3, i-2, i-1 and i-th particle sizes using least squares.

6. An analysis device, comprising a processor, a memory and a communication bus; The communication bus is used to realize the connection and communication between the processor and the memory; The processor is used to execute one or more computer programs stored in the memory to implement the steps of the abnormal terminal identification method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more computer programs, and the one or more computer programs can be executed by one or more processors to implement the steps of the abnormal terminal identification method according to any one of claims 1 to 4.

Images