Method, device and equipment for identifying cloud SIM card pool in Internet of Things based on graph model

Abstract

The present invention relates to Internet of Things technology and provides an Internet of Things cloud SIM card pool identification method, apparatus, device, and medium based on a graph model. The method comprises first constructing a SIM card number point set and a terminal IMEI number point set based on a deep data packet inspection data set to determine an undirected graph set, then screening a dense connected graph therefrom, and then determining the roaming distance of each dense connected graph SIM card number point set based on a preset map adjacency matrix. If the connected graph roaming distance meets a preset first distance screening condition, the corresponding dense connected graph is obtained to form a target dense connected graph set. This method achieves comprehensive, accurate, and rapid identification of cloud SIM card pool users based on a graph model, and can accurately trace the usage behavior of card pool users.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a method, device, computer equipment and storage medium for identifying an Internet of Things cloud SIM card pool based on a graph model. Background Art

[0002] IoT cards are mobile communication access services provided by carriers to IoT companies for connecting their smart terminal devices. One specific application scenario for IoT cards is the cloud SIM card. Cloud SIM technology centrally stores and manages a large number of SIM cards through a card pool. A cloud-based system automatically allocates and distributes data to third-party devices, allowing them to access data from any SIM card at any time and anywhere. While this new technology offers numerous conveniences, it also introduces risks associated with real-name authentication. This is because, in order to obtain cheaper IoT cards, many customers open multiple locations and even rebrand their cards, placing pressure on carriers to manage and monitor IoT card usage.

[0003] In the cloud SIM usage scenario, multiple SIM cards can be switched between multiple terminals, and the card pool can be composed of SIM cards from different operators or even foreign operators. In this scenario, the operator cannot trace the end user based on the SIM card. Once the traffic is used for telecommunications fraud or other illegal activities, the consequences will be unimaginable. Summary of the Invention

[0004] The embodiments of the present invention provide a method, apparatus, computer device, and storage medium for identifying an IoT cloud SIM card pool based on a graph model. These methods aim to address the existing problem that, as one of the specific application scenarios of IoT cards, cloud SIM cards cannot be traced back to the end user and the end user's usage behavior based on the cloud SIM card, resulting in reduced security in the use of SIM card traffic.

[0005] In a first aspect, an embodiment of the present invention provides an IoT cloud SIM card pool identification method based on a graph model, which includes:

[0006] In response to the identification instruction, obtaining a deep data packet inspection data set corresponding to the identification instruction; wherein the deep data packet inspection data set includes a plurality of deep data packet inspection data, each deep data packet inspection data includes at least a customer name, a SIM card number, and a terminal IMEI number;

[0007] Constructing a SIM card number point set and a terminal IMEI number point set according to the deep data packet inspection data set, and determining an undirected graph based on the SIM card number point set and the terminal IMEI number point set;

[0008] Acquire connected graphs included in the undirected graph to form a connected graph set, and acquire connected graphs that meet a preset dense connected graph screening condition from the connected graph set to form a dense connected graph set;

[0009] Obtaining a preset map adjacency matrix, and determining a connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set according to the map adjacency matrix; and

[0010] If the connected graph roaming distance corresponding to a dense connected graph satisfies a preset first distance screening condition, the corresponding dense connected graph is obtained to form a target dense connected graph set.

[0011] In a second aspect, an embodiment of the present invention provides an IoT cloud SIM card pool identification device based on a graph model, comprising:

[0012] a data set acquisition unit, configured to, in response to an identification instruction, acquire a deep data packet inspection data set corresponding to the identification instruction; wherein the deep data packet inspection data set includes a plurality of deep data packet inspection data, each deep data packet inspection data including at least a customer name, a SIM card number, and a terminal IMEI number;

[0013] An undirected graph acquisition unit, configured to construct a SIM card number point set and a terminal IMEI number point set according to the deep data packet inspection data set, and determine an undirected graph based on the SIM card number point set and the terminal IMEI number point set;

[0014] a dense connected graph acquisition unit, configured to acquire connected graphs included in the undirected graph to form a connected graph set, and acquire connected graphs that meet a preset dense connected graph screening condition from the connected graph set to form a dense connected graph set;

[0015] a roaming distance acquisition unit, configured to acquire a preset map adjacency matrix, and determine a connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set according to the map adjacency matrix; and

[0016] The target dense connected graph set acquisition unit is configured to acquire the corresponding dense connected graph to form a target dense connected graph set if the connected graph roaming distance corresponding to the dense connected graph satisfies a preset first distance screening condition.

[0017] In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory, a processor, and a computer program stored on the memory and runnable on the processor. When the processor executes the computer program, the method for identifying the IoT cloud SIM card pool based on the graphical model described in the first aspect is implemented.

[0018] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor causes the processor to execute the method for identifying an IoT cloud SIM card pool based on a graphical model as described in the first aspect above.

[0019] The embodiment of the present invention provides an IoT cloud SIM card pool identification method, device, computer equipment and storage medium based on a graph model. First, a SIM card number point set and a terminal IMEI number point set are constructed based on a deep data packet inspection data set to determine an undirected graph. Then, a dense connected graph set is determined for the connected graph set included in the undirected graph based on a preset dense connected graph screening condition. Then, the connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set is determined based on a preset map adjacency matrix. Finally, if it is determined that the connected graph roaming distance corresponding to a dense connected graph meets the preset first distance screening condition, the corresponding dense connected graph is obtained to form a target dense connected graph set. This achieves comprehensive, accurate and rapid identification of cloud SIM card pool users based on a graph model, and can accurately trace the usage behavior of card pool users. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 A schematic diagram of an application scenario of the method for identifying an IoT cloud SIM card pool based on a graph model provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of a flow chart of a method for identifying an IoT cloud SIM card pool based on a graph model provided by an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of an undirected graph in the method for identifying an IoT cloud SIM card pool based on a graph model provided by an embodiment of the present invention;

[0024] Figure 4 A schematic block diagram of an IoT cloud SIM card pool identification device based on a graph model provided by an embodiment of the present invention;

[0025] Figure 5 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0027] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0028] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0029] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0030] See also Figure 1 and Figure 2 , Figure 1 A schematic diagram of an application scenario of the method for identifying an IoT cloud SIM card pool based on a graph model provided by an embodiment of the present invention; Figure 2 This is a flow chart of a method for identifying an IoT cloud SIM card pool based on a graph model provided by an embodiment of the present invention. The method for identifying an IoT cloud SIM card pool based on a graph model is applied to a server and is executed by application software installed in the server.

[0031] like Figure 2 As shown, the method includes steps S101 to S105.

[0032] S101. In response to an identification instruction, obtain a deep data packet inspection data set corresponding to the identification instruction; wherein the deep data packet inspection data set includes a plurality of deep data packet inspection data, and each deep data packet inspection data includes at least a customer name, a SIM card number, and a terminal IMEI number.

[0033] In this embodiment, the technical solution is described with the server as the execution entity. In this application, the server can obtain and store a large amount of deep packet inspection data uploaded by IoT devices to form a deep packet inspection data set; wherein, deep packet inspection data is DPI data. The full name of DPI is Deep Packet Inspection, which means Deep Packet Inspection. It is a deep inspection technology based on data packets. It performs deep inspection on different network application layer payloads (such as HTTP, DNS, etc.) and determines the legitimacy of the message by inspecting the payload of the message.

[0034] Among them, when the user sets the data filtering time period on the interactive interface between the user terminal and the server, the recognition instruction is triggered. Since the recognition instruction corresponds to the data filtering time period (such as the short 1 minute from XX1:10 on XX1 / XX1 / 2XXX to XX1:11 on XX1 / XX1 / 2XXX), when the recognition instruction is sent from the user terminal to the server, the data whose data generation time or data storage time is within the above-mentioned data filtering time period can be filtered out from the massive deep data packet inspection data stored in the server to form a deep data packet inspection data set.

[0035] A single DPI data entry can be parsed to reveal features such as the customer name, unique customer identification code, SIM card number (where SIM stands for Subscriber Identity Module), terminal IMEI number (where IMEI stands for International Mobile Equipment Identity, also known as the terminal serial number), base station TAC (where TAC stands for Tracking Area Code), and access IP address. Once a large amount of DPI data is collected, user behavior analysis can be performed based on this massive amount of data.

[0036] In order to improve the effectiveness of subsequent data analysis, the deep packet detection dataset can also be cleaned of invalid data, and invalid deep packet detection data with features having many null values can be deleted to update the deep packet detection dataset.

[0037] S102: Construct a SIM card number point set and a terminal IMEI number point set according to the deep data packet inspection data set, and determine an undirected graph based on the SIM card number point set and the terminal IMEI number point set.

[0038] In this embodiment, since the SIM card number data corresponding to each user can be extracted from the deep data packet inspection data set to form a SIM card number data set, and the terminal IMEI number data corresponding to each user can also be extracted to form a terminal IMEI number data set. Since a SIM card number can be regarded as a SIM card number point, and a terminal IMEI number can also be regarded as a terminal IMEI number point, a SIM card number point set and a terminal IMEI number point set can be constructed based on the SIM card number data set and the terminal IMEI number data. After further determining the usage relationship between the SIM card number and the terminal IMEI number, an undirected graph can be obtained (the undirected graph here can essentially also be understood as an undirected graph set).

[0039] In one embodiment, step S102 includes:

[0040] If it is determined that there is a connection relationship between SIM card numbers in the SIM card number point set, or there is a connection relationship between the SIM card number in the SIM card number point set and the terminal IMEI number in the terminal IMEI number point set, the obtained connection relationship will be used to connect the corresponding points in the SIM card number point set and the terminal IMEI number point set until all connection relationships are determined to obtain an undirected graph.

[0041] In this embodiment, when a SIM card number point set is constructed through a SIM card number data set, and a terminal IMEI number point set is constructed through a terminal IMEI number data set, when further obtaining an undirected graph, the following example can be referred to. For example, a SIM card number point set P{u1, u2, u3, u4, ...} is constructed through a SIM card number data set, and a terminal IMEI number point set Q{A, B, C, D, ...} is constructed through a terminal IMEI number data set. The edges of the point sets P and Q are constructed according to the usage relationship between the SIM card and the terminal. Specifically, if it is determined that there is a connection relationship between the SIM card numbers in the SIM card number point set, or that there is a connection relationship between the SIM card numbers in the SIM card number point set and the terminal IMEI numbers in the terminal IMEI number point set, then connecting edges are added between the corresponding points, thereby obtaining the following: Figure 3 The final undirected graph is shown in FIG. It can be seen that an undirected graph can be constructed quickly and accurately based on the SIM card number point set and the terminal IMEI number point set.

[0042] S103: Obtain connected graphs included in the undirected graph to form a connected graph set, and obtain connected graphs that meet a preset dense connected graph screening condition from the connected graph set to form a dense connected graph set.

[0043] In this embodiment, when an undirected graph is known, the points and edges of the undirected graph can be traversed to obtain a connected graph set consisting of connected graphs included in the undirected graph. Figure 3The undirected graph shown in the figure can be filtered to obtain two connected graphs {u1, u2, A, B} and {u3, u4, C, D, E} to form a connected graph set. Then, a dense connected graph that meets the preset screening conditions is obtained from the connected graph set to ensure that a dense connected graph of a certain size is screened out to form a dense connected graph set. The reason for screening the dense connected graph is that the user corresponding to the SIM card number corresponding to the corresponding point in the dense connected graph may be suspected of abnormal traffic usage. For example, if Figure 3 The connected graph {u3, u4, Bing, Ding, E} is considered to meet the preset dense connected graph screening criteria, that is, it is a dense connected graph. The SIM card numbers corresponding to u3 and u4 are suspected cards. The SIM card number used by the suspected user is the suspected card, and the set of SIM cards in the dense connected graph corresponding to this SIM card number is the suspected card pool.

[0044] In one embodiment, step S103 includes:

[0045] The connected graphs included in the undirected graph are obtained by depth-first traversal or breadth-first traversal to form a connected graph set.

[0046] In this embodiment, Depth First Search (DFS) and Breadth First Search are two very important algorithms in graph theory, which can be widely used in topological sorting, path finding (maze walking), search engines, etc.

[0047] The depth-first traversal starts at an unvisited vertex V in the graph, walks along a path to the end, then backtracks from the node at the end of the path to the previous node, and then starts from another path to the end... This process is repeated recursively until all vertices are traversed. Through depth-first traversal, the connected graphs included in the undirected graph are obtained to form a connected graph set.

[0048] The breadth-first traversal process is as follows: 1. Start from a vertex V0 in the graph and visit it; 2. Start from V0 and visit each of V0's unvisited adjacent vertices W1, W2, ..., Wk; then, start from W1, W2, ..., Wk and visit their respective unvisited adjacent vertices; 3. Repeat step 2 until all vertices have been visited. Breadth-first traversal can also be used to obtain connected graphs within the undirected graph, forming a connected graph set.

[0049] In one embodiment, step S103 includes:

[0050] Obtaining an i-th connected graph in the connected graph set; wherein an initial value of i is 1 and a value range of i is [1, N], where N represents the total number of connected graphs in the connected graph set;

[0051] Get the first total number of points and the second total number of edges in the i-th connected graph;

[0052] If it is determined that the first total number of points and the second total number of edges in the i-th connected graph meet the preset dense connected graph screening condition, storing the i-th connected graph into a dense connected graph set; wherein the initial value of the dense connected graph set is a null value;

[0053] Increment i by 1 to update the value of i;

[0054] If it is determined that i does not exceed N, returning to the step of obtaining the i-th connected graph in the connected graph set;

[0055] If it is determined that i exceeds N, the dense connected atlas is obtained.

[0056] In this embodiment, by determining whether each connected graph from the 1st to the Nth connected graph is a dense connected graph, the connected graphs that meet the dense connected graph screening conditions can be quickly and accurately screened to form a dense connected graph set. The preset dense connected graph screening condition corresponds to the following judgment formula: e>nlogn, where e represents the total number of edges in the connected graph, n represents the total number of points in the connected graph, and the base of the logarithm operation can be 2, e, or 10. If the total number of edges and the total number of points in the connected graph meet the above judgment formula, it can be determined that the connected graph meets the preset dense connected graph screening condition and can be regarded as a dense connected graph.

[0057] S104: Obtain a preset map adjacency matrix, and determine a connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set according to the map adjacency matrix.

[0058] In this embodiment, in order to obtain the connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set, it is necessary to first obtain the map adjacency matrix stored in the server. For example, the map adjacency matrix in the server is as shown in Table 1 below:

[0059] Region 1 Region 2 Region 3 Region 4 …… Region K Region 1 0 0 0 1 0 Region 2 0 0 0 0 0 Region 3 0 0 0 0 0 Region 4 1 0 0 0 0 …… Region K 0 0 0 0 0

[0060] Table 1

[0061] The map adjacency matrix is a K*K matrix, where K is a positive integer and represents the total number of preset regions. After obtaining the densely connected atlas, each densely connected graph it includes is known, and each point included in the densely connected graph (which is a SIM card number point or a terminal IMEI number point) has the feature of base station TAC, so the points included in the densely connected graph can determine the region to which the point belongs based on the base station TAC of the point. The map adjacency matrix defines the adjacent relationship between regions. If the distance between adjacent regions is defined as 1, each densely connected graph can be converted into a corresponding distance matrix based on its graph model and the map adjacency matrix. For example, a densely connected graph is converted into a corresponding distance matrix based on its graph model and the map adjacency matrix as shown in Table 2 below:

[0062] Region 1 Region 2 Region 3 Region 4 …… Region K Region 1 0 5 4 1 4 Region 2 5 0 3 5 4 Region 3 4 3 0 4 6 Region 4 1 5 4 0 4 …… Region K 4 4 6 0 0

[0063] Table 2

[0064] Based on the suspect cards included in the densely connected graph and the usage area change information determined by the deep packet inspection data corresponding to each suspect card, the daily roaming distance of each suspect card in the densely connected graph can be determined, thereby comprehensively calculating the connected graph roaming distance. Determining the connected graph roaming distance corresponding to each densely connected graph in the densely connected graph set based on the map adjacency matrix is equivalent to determining the roaming distance of the SIM card number point set of each densely connected graph based on a preset map adjacency matrix.

[0065] In one embodiment, step S104 includes:

[0066] Obtaining a j-th dense connected graph in the dense connected graph set; wherein an initial value of j is 1 and a value range of j is [1, M], where M represents the total number of dense connected graphs in the dense connected graph set;

[0067] Obtaining a roaming distance of each point in the j-th dense connected graph according to the map adjacency matrix, and summing the roaming distances of each point in the j-th dense connected graph to obtain a j-th connected graph roaming distance of the j-th dense connected graph;

[0068] Increment j by 1 to update the value of j;

[0069] If it is determined that j does not exceed M, returning to the step of obtaining the j-th dense connected graph in the dense connected graph set;

[0070] If it is determined that j exceeds M, the roaming distance from the first connected graph to the Mth connected graph is obtained.

[0071] In this embodiment, for example, Figure 3For example, consider the connected graph {u3, u4, C, D, E} as a dense connected graph. The SIM card numbers u3 and u4 are suspect cards. In this case, DPI data for u3 and u4 are available in the DPI dataset. If several pieces of DPI data for u3 indicate that the SIM card's usage region has always been in region 4 (primarily based on the base station TAC data in the DPI data), the daily roaming distance for u3 is 0. If several pieces of DPI data for u4 indicate that the SIM card's usage region has changed from region 3 to region 4, the daily roaming distance for u4 is 4. By summing the daily roaming distances of all SIM card numbers in the dense connected graph {u3, u4, C, D, E}, we can obtain the roaming distance for the connected graph. That is, in step S104, the roaming distance of each SIM card number point in each dense connected graph SIM card number point set is determined according to the preset map adjacency matrix, and the roaming distance of the terminal IMEI number point set is regarded as 0, so that the roaming distance of the connected graph of the dense connected graph can be calculated.

[0072] S105: If the connected graph roaming distance corresponding to a dense connected graph satisfies a preset first distance screening condition, the corresponding dense connected graph is obtained to form a target dense connected graph set.

[0073] In this embodiment, after obtaining the connectivity graph roaming distance corresponding to the dense connectivity graph, it is determined whether the connectivity graph roaming distance corresponding to the dense connectivity graph satisfies a preset first distance screening condition. If the connectivity graph roaming distance corresponding to a dense connectivity graph satisfies the first distance screening condition, it indicates that the SIM card number in this dense connectivity graph is determined to be an illegal card (a higher level of identification than a suspected card). In this case, the corresponding dense connectivity graph is obtained to form a target dense connectivity graph set. In this way, the dense connectivity graphs to which illegal cards belong are quickly screened to form the target dense connectivity graph set.

[0074] In one embodiment, step S105 includes:

[0075] A distance threshold corresponding to the distance screening condition is obtained. If it is determined that a connected graph roaming distance corresponding to a dense connected graph is greater than the distance threshold, the corresponding dense connected graph is obtained to form a target dense connected graph set.

[0076] In this embodiment, the distance screening condition can be specifically set to a distance threshold (in specific implementation, the distance threshold can be set to a positive integer according to actual needs, such as 100). If it is determined that the roaming distance of the connected graph corresponding to a dense connected graph is greater than the distance threshold, then these dense connected graphs can all be selected as target dense connected graphs to form a target dense connected graph set.

[0077] In one embodiment, after step S105, the method further includes:

[0078] Obtaining a target deep data packet detection data subset corresponding to each target dense connected graph in the target dense connected graph set;

[0079] According to the target deep data packet detection data subset corresponding to each target dense connected graph and the preset risk level determination strategy, the risk level information corresponding to each target dense connected graph is obtained.

[0080] In this embodiment, since each SIM card number in the target densely connected graph corresponds to an illegal card, a target deep data packet inspection data subset of each illegal card can be obtained at this time, and then the specific usage behavior of the SIM card number is determined based on the access IP information of the target deep data packet inspection data subset. If the access IP information corresponds to a preset first type of URL (such as the URLs of various video websites), its risk level information is set to high; if the access IP information corresponds to a preset second type of URL (such as the URLs of various cloud server websites), its risk level information is set to low.

[0081] This method realizes comprehensive, accurate and rapid identification of cloud SIM card pool users based on the graph model, and can accurately trace the usage behavior of card pool users.

[0082] The embodiment of the present invention further provides an IoT cloud SIM card pool identification device based on a graph model, which is used to execute any embodiment of the aforementioned IoT cloud SIM card pool identification method based on a graph model. Figure 4 , Figure 4 It is a schematic block diagram of an IoT cloud SIM card pool identification device 100 based on a graph model provided in an embodiment of the present invention.

[0083] Among them, such as Figure 4 As shown, the IoT cloud SIM card pool identification device 100 based on the graph model includes a data set acquisition unit 101, an undirected graph acquisition unit 102, a dense connected graph acquisition unit 103, a roaming distance acquisition unit 104 and a target dense connected graph set acquisition unit 105.

[0084] The data set acquisition unit 101 is configured to, in response to an identification instruction, acquire a deep data packet inspection data set corresponding to the identification instruction; wherein the deep data packet inspection data set includes a plurality of deep data packet inspection data, each deep data packet inspection data includes at least a customer name, a SIM card number, and a terminal IMEI number.

[0085] In this embodiment, the technical solution is described with the server as the execution entity. In this application, the server can obtain and store a large amount of deep packet inspection data uploaded by IoT devices to form a deep packet inspection data set; wherein, deep packet inspection data is DPI data. The full name of DPI is Deep Packet Inspection, which means Deep Packet Inspection. It is a deep inspection technology based on data packets. It performs deep inspection on different network application layer payloads (such as HTTP, DNS, etc.) and determines the legitimacy of the message by inspecting the payload of the message.

[0086] Among them, when the user sets the data filtering time period on the interactive interface between the user terminal and the server, the recognition instruction is triggered. Since the recognition instruction corresponds to the data filtering time period (such as the short 1 minute from XX1:10 on XX1 / XX1 / 2XXX to XX1:11 on XX1 / XX1 / 2XXX), when the recognition instruction is sent from the user terminal to the server, the data whose data generation time or data storage time is within the above-mentioned data filtering time period can be filtered out from the massive deep data packet inspection data stored in the server to form a deep data packet inspection data set.

[0087] A single DPI data entry can be parsed to reveal features such as the customer name, unique customer identification code, SIM card number (where SIM stands for Subscriber Identity Module), terminal IMEI number (where IMEI stands for International Mobile Equipment Identity, also known as the terminal serial number), base station TAC (where TAC stands for Tracking Area Code), and access IP address. Once a large amount of DPI data is collected, user behavior analysis can be performed based on this massive amount of data.

[0088] In order to improve the effectiveness of subsequent data analysis, the deep packet detection dataset can also be cleaned of invalid data, and invalid deep packet detection data with features having many null values can be deleted to update the deep packet detection dataset.

[0089] The undirected graph acquisition unit 102 is configured to construct a SIM card number point set and a terminal IMEI number point set according to the deep data packet inspection data set, and determine an undirected graph based on the SIM card number point set and the terminal IMEI number point set.

[0090] In this embodiment, the DPI dataset can extract the SIM card number data corresponding to each user to form a SIM card number dataset, and can also extract the terminal IMEI number data corresponding to each user to form a terminal IMEI number dataset. Since a SIM card number can be considered a SIM card number point, and a terminal IMEI number can also be considered a terminal IMEI number point, a SIM card number point set and a terminal IMEI number point set can be constructed based on the SIM card number dataset and the terminal IMEI number data. After further determining the usage relationship between the SIM card number and the terminal IMEI number, an undirected graph can be obtained.

[0091] In one embodiment, the undirected graph acquisition unit 102 is specifically configured to:

[0092] If it is determined that there is a connection relationship between SIM card numbers in the SIM card number point set, or there is a connection relationship between the SIM card number in the SIM card number point set and the terminal IMEI number in the terminal IMEI number point set, the obtained connection relationship will be used to connect the corresponding points in the SIM card number point set and the terminal IMEI number point set until all connection relationships are determined to obtain an undirected graph.

[0093] In this embodiment, when a SIM card number point set is constructed through a SIM card number data set, and a terminal IMEI number point set is constructed through a terminal IMEI number data set, when further obtaining an undirected graph, the following example can be referred to. For example, a SIM card number point set P{u1, u2, u3, u4, ...} is constructed through a SIM card number data set, and a terminal IMEI number point set Q{A, B, C, D, ...} is constructed through a terminal IMEI number data set. The edges of the point sets P and Q are constructed according to the usage relationship between the SIM card and the terminal. Specifically, if it is determined that there is a connection relationship between the SIM card numbers in the SIM card number point set, or that there is a connection relationship between the SIM card numbers in the SIM card number point set and the terminal IMEI numbers in the terminal IMEI number point set, then connecting edges are added between the corresponding points, thereby obtaining the following: Figure 3 The final undirected graph is shown in FIG. It can be seen that an undirected graph can be constructed quickly and accurately based on the SIM card number point set and the terminal IMEI number point set.

[0094] The dense connected graph acquisition unit 103 is configured to acquire connected graphs included in the undirected graph to form a connected graph set, and acquire connected graphs that meet a preset dense connected graph screening condition from the connected graph set to form a dense connected graph set.

[0095] In this embodiment, when an undirected graph is known, the points and edges of the undirected graph can be traversed to obtain a connected graph set consisting of connected graphs included in the undirected graph. Figure 3 The undirected graph shown in the figure can be filtered to obtain two connected graphs {u1, u2, A, B} and {u3, u4, C, D, E} to form a connected graph set. Then, a dense connected graph that meets the preset screening conditions is obtained from the connected graph set to ensure that a dense connected graph of a certain size is screened out to form a dense connected graph set. The reason for screening the dense connected graph is that the user corresponding to the SIM card number corresponding to the corresponding point in the dense connected graph may be suspected of abnormal traffic usage. For example, if Figure 3 The connected graph {u3, u4, Bing, Ding, E} is considered to meet the preset dense connected graph screening criteria, that is, it is a dense connected graph. The SIM card numbers corresponding to u3 and u4 are suspected cards. The SIM card number used by the suspected user is the suspected card, and the set of SIM cards in the dense connected graph corresponding to this SIM card number is the suspected card pool.

[0096] In one embodiment, the dense connected graph acquisition unit 103 is specifically configured to:

[0097] The connected graphs included in the undirected graph are obtained by depth-first traversal or breadth-first traversal to form a connected graph set.

[0098] In this embodiment, Depth First Search (DFS) and Breadth First Search are two very important algorithms in graph theory, which can be widely used in topological sorting, path finding (maze walking), search engines, etc.

[0099] The depth-first traversal starts at an unvisited vertex V in the graph, walks along a path to the end, then backtracks from the node at the end of the path to the previous node, and then starts from another path to the end... This process is repeated recursively until all vertices are traversed. Through depth-first traversal, the connected graphs included in the undirected graph are obtained to form a connected graph set.

[0100] The breadth-first traversal process is as follows: 1. Start from a vertex V0 in the graph and visit it; 2. Start from V0 and visit each of V0's unvisited adjacent vertices W1, W2, ..., Wk; then, start from W1, W2, ..., Wk and visit their respective unvisited adjacent vertices; 3. Repeat step 2 until all vertices have been visited. Breadth-first traversal can also be used to obtain connected graphs within the undirected graph, forming a connected graph set.

[0101] In one embodiment, the dense connected graph acquisition unit 103 is further specifically configured to:

[0102] Obtaining an i-th connected graph in the connected graph set; wherein an initial value of i is 1 and a value range of i is [1, N], where N represents the total number of connected graphs in the connected graph set;

[0103] Get the first total number of points and the second total number of edges in the i-th connected graph;

[0104] If it is determined that the first total number of points and the second total number of edges in the i-th connected graph meet the preset dense connected graph screening condition, storing the i-th connected graph into a dense connected graph set; wherein the initial value of the dense connected graph set is a null value;

[0105] Increment i by 1 to update the value of i;

[0106] If it is determined that i does not exceed N, returning to the step of obtaining the i-th connected graph in the connected graph set;

[0107] If it is determined that i exceeds N, the dense connected atlas is obtained.

[0108] In this embodiment, by determining whether each connected graph from the 1st to the Nth connected graph is a dense connected graph, the connected graphs that meet the dense connected graph screening conditions can be quickly and accurately screened to form a dense connected graph set. The preset dense connected graph screening condition corresponds to the following judgment formula: e>nlogn, where e represents the total number of edges in the connected graph, n represents the total number of points in the connected graph, and the base of the logarithm operation can be 2, e, or 10. If the total number of edges and the total number of points in the connected graph meet the above judgment formula, it can be determined that the connected graph meets the preset dense connected graph screening condition and can be regarded as a dense connected graph.

[0109] The roaming distance acquisition unit 104 is configured to acquire a preset map adjacency matrix and determine the connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set according to the map adjacency matrix.

[0110] In this embodiment, in order to obtain the connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set, it is necessary to first obtain the map adjacency matrix stored in the server, for example, the map adjacency matrix in the server is as shown in Table 1 above.

[0111] The map adjacency matrix is a K*K matrix, where K is a positive integer and represents the total number of preset regions. After obtaining the densely connected atlas, each densely connected graph it includes is known, and each point included in the densely connected graph (which is a SIM card number point or a terminal IMEI number point) has the feature of base station TAC, so the points included in the densely connected graph can all determine the region to which the point belongs based on the base station TAC of the point. The map adjacency matrix defines the adjacent relationship between regions. If the distance between adjacent regions is defined as 1, each densely connected graph can be converted into a corresponding distance matrix based on its graph model and the map adjacency matrix. For example, a densely connected graph is converted into a corresponding distance matrix based on its graph model and the map adjacency matrix as shown in Table 2 above.

[0112] Based on the suspect cards included in the densely connected graph and the usage area change information determined by the deep packet inspection data corresponding to each suspect card, the daily roaming distance of each suspect card in the densely connected graph can be determined, thereby comprehensively calculating the connected graph roaming distance. Determining the connected graph roaming distance corresponding to each densely connected graph in the densely connected graph set based on the map adjacency matrix is equivalent to determining the roaming distance of the SIM card number point set of each densely connected graph based on a preset map adjacency matrix.

[0113] In one embodiment, the roaming distance acquiring unit 104 is specifically configured to:

[0114] Obtaining a j-th dense connected graph in the dense connected graph set; wherein an initial value of j is 1 and a value range of j is [1, M], where M represents the total number of dense connected graphs in the dense connected graph set;

[0115] Obtaining a roaming distance of each point in the j-th dense connected graph according to the map adjacency matrix, and summing the roaming distances of each point in the j-th dense connected graph to obtain a j-th connected graph roaming distance of the j-th dense connected graph;

[0116] Increment j by 1 to update the value of j;

[0117] If it is determined that j does not exceed M, returning to the step of obtaining the j-th dense connected graph in the dense connected graph set;

[0118] If it is determined that j exceeds M, the roaming distance from the first connected graph to the Mth connected graph is obtained.

[0119] In this embodiment, for example, Figure 3For example, consider the connected graph {u3, u4, C, D, E} as a dense connected graph. The SIM card numbers u3 and u4 are suspect cards. In this case, DPI data for u3 and u4 are available in the DPI dataset. If several pieces of DPI data for u3 indicate that the SIM card's usage region has always been in region 4 (primarily based on the base station TAC data in the DPI data), the daily roaming distance for u3 is 0. If several pieces of DPI data for u4 indicate that the SIM card's usage region has changed from region 3 to region 4, the daily roaming distance for u4 is 4. By summing the daily roaming distances of all SIM card numbers in the dense connected graph {u3, u4, C, D, E}, we can obtain the roaming distance for the connected graph. That is, in the roaming distance acquisition unit 104, the roaming distance of each SIM card number point of each dense connected graph SIM card number point set is determined according to the preset map adjacency matrix, and the roaming distance of the terminal IMEI number point set is regarded as 0, so that the connected graph roaming distance of the dense connected graph can be calculated.

[0120] The target dense connected graph set acquisition unit 105 is configured to acquire the corresponding dense connected graph to form a target dense connected graph set if the connected graph roaming distance corresponding to the dense connected graph satisfies a preset first distance screening condition.

[0121] In this embodiment, after obtaining the connectivity graph roaming distance corresponding to the dense connectivity graph, it is determined whether the connectivity graph roaming distance corresponding to the dense connectivity graph satisfies a preset first distance screening condition. If the connectivity graph roaming distance corresponding to a dense connectivity graph satisfies the first distance screening condition, it indicates that the SIM card number in this dense connectivity graph is determined to be an illegal card (a higher level of identification than a suspected card). In this case, the corresponding dense connectivity graph is obtained to form a target dense connectivity graph set. In this way, the dense connectivity graphs to which illegal cards belong are quickly screened to form the target dense connectivity graph set.

[0122] In one embodiment, the target dense connected atlas acquisition unit 105 is specifically configured to:

[0123] A distance threshold corresponding to the distance screening condition is obtained. If it is determined that a connected graph roaming distance corresponding to a dense connected graph is greater than the distance threshold, the corresponding dense connected graph is obtained to form a target dense connected graph set.

[0124] In this embodiment, the distance screening condition can be specifically set to a distance threshold (in specific implementation, the distance threshold can be set to a positive integer according to actual needs, such as 100). If it is determined that the roaming distance of the connected graph corresponding to a dense connected graph is greater than the distance threshold, then these dense connected graphs can all be selected as target dense connected graphs to form a target dense connected graph set.

[0125] In one embodiment, the IoT cloud SIM card pool identification device 100 based on a graph model further includes:

[0126] a target subset acquisition unit, configured to acquire a target deep data packet detection data subset corresponding to each target dense connected graph in the target dense connected graph set;

[0127] The risk level determination unit is used to obtain risk level information corresponding to each target dense connected graph based on the target deep data packet detection data subset corresponding to each target dense connected graph and a preset risk level determination strategy.

[0128] In this embodiment, since each SIM card number in the target densely connected graph corresponds to an illegal card, a target deep data packet inspection data subset of each illegal card can be obtained at this time, and then the specific usage behavior of the SIM card number is determined based on the access IP information of the target deep data packet inspection data subset. If the access IP information corresponds to a preset first type of URL (such as the URLs of various video websites), its risk level information is set to high; if the access IP information corresponds to a preset second type of URL (such as the URLs of various cloud server websites), its risk level information is set to low.

[0129] The device can comprehensively, accurately and quickly identify cloud SIM card pool users based on a graph model, and can accurately trace the usage behavior of card pool users.

[0130] The above-mentioned IoT cloud SIM card pool identification device based on the graph model can be implemented in the form of a computer program. The computer program can be used in the following ways: Figure 5 Runs on the computer equipment shown.

[0131] See also Figure 5 , Figure 5 1 is a schematic block diagram of a computer device provided by an embodiment of the present invention. The computer device 500 is a server or a server cluster.

[0132] See Figure 5 The computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a device bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

[0133] The storage medium 503 may store an operating device 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 may execute a method for identifying an IoT cloud SIM card pool based on a graph model.

[0134] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500.

[0135] The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute the Internet of Things cloud SIM card pool identification method based on the graph model.

[0136] The network interface 505 is used for network communication, such as providing data information transmission. Those skilled in the art will understand that Figure 5 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention and does not constitute a limitation on the computer device 500 to which the solution of the present invention is applied. The specific computer device 500 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0137] The processor 502 is configured to run a computer program 5032 stored in the memory to implement the method for identifying an IoT cloud SIM card pool based on a graph model disclosed in an embodiment of the present invention.

[0138] Those skilled in the art will understand that Figure 5 The embodiment of the computer device shown in the figure does not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structure and function of the memory and processor are the same as those in the figure. Figure 5 The embodiments shown are consistent and will not be described again here.

[0139] It should be understood that in the embodiment of the present invention, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0140] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium may be either non-volatile or volatile. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method for identifying an IoT cloud SIM card pool based on a graphical model disclosed in an embodiment of the present invention.

[0141] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0142] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, or units with the same function may be combined into one unit. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be an electrical, mechanical or other form of connection.

[0143] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

[0144] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0145] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a backend server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk.

[0146] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A method for identifying an IoT cloud SIM card pool based on a graph model, characterized in that: include: In response to the identification instruction, obtaining a deep data packet inspection data set corresponding to the identification instruction; wherein the deep data packet inspection data set includes a plurality of deep data packet inspection data, each deep data packet inspection data includes at least a customer name, a SIM card number, and a terminal IMEI number; Constructing a SIM card number point set and a terminal IMEI number point set according to the deep data packet inspection data set, and determining an undirected graph based on the SIM card number point set and the terminal IMEI number point set; Acquire connected graphs included in the undirected graph to form a connected graph set, and acquire connected graphs that meet a preset dense connected graph screening condition from the connected graph set to form a dense connected graph set; Obtaining a preset map adjacency matrix, and determining a connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set according to the map adjacency matrix; as well as If the connected graph roaming distance corresponding to a dense connected graph satisfies a preset first distance screening condition, the corresponding dense connected graph is obtained to form a target dense connected graph set.

2. The method for identifying an IoT cloud SIM card pool based on a graph model according to claim 1, characterized in that: If the connected graph roaming distance corresponding to the dense connected graph satisfies the preset first distance screening condition, after obtaining the corresponding dense connected graph to form a target dense connected graph set, the method further includes: Obtaining a target deep data packet detection data subset corresponding to each target dense connected graph in the target dense connected graph set; According to the target deep data packet detection data subset corresponding to each target dense connected graph and the preset risk level determination strategy, the risk level information corresponding to each target dense connected graph is obtained.

3. The method for identifying an IoT cloud SIM card pool based on a graph model according to claim 1, characterized in that: The determining of an undirected graph based on the SIM card number point set and the terminal IMEI number point set includes: If it is determined that there is a connection relationship between SIM card numbers in the SIM card number point set, or there is a connection relationship between the SIM card number in the SIM card number point set and the terminal IMEI number in the terminal IMEI number point set, the obtained connection relationship will be used to connect the corresponding points in the SIM card number point set and the terminal IMEI number point set until all connection relationships are determined to obtain an undirected graph.

4. The method for identifying an IoT cloud SIM card pool based on a graph model according to claim 1, characterized in that: The obtaining of a connected graph included in the undirected graph to form a connected graph set includes: The connected graphs included in the undirected graph are obtained by depth-first traversal or breadth-first traversal to form a connected graph set.

5. The method for identifying an IoT cloud SIM card pool based on a graph model according to claim 1, characterized in that: The method of obtaining connected graphs that meet a preset dense connected graph screening condition from the connected graph set to form a dense connected graph set includes: Obtaining an i-th connected graph in the connected graph set; wherein an initial value of i is 1 and a value range of i is [1, N], where N represents the total number of connected graphs in the connected graph set; Get the first total number of points and the second total number of edges in the i-th connected graph; If it is determined that the first total number of points and the second total number of edges in the i-th connected graph meet the preset dense connected graph screening condition, storing the i-th connected graph into a dense connected graph set; wherein the initial value of the dense connected graph set is a null value; Increment i by 1 to update the value of i; If it is determined that i does not exceed N, returning to the step of obtaining the i-th connected graph in the connected graph set; If it is determined that i exceeds N, the dense connected atlas is obtained.

6. The method for identifying an IoT cloud SIM card pool based on a graph model according to claim 1, characterized in that: The determining, according to the map adjacency matrix, a connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set includes: Obtaining a j-th dense connected graph in the dense connected graph set; wherein an initial value of j is 1 and a value range of j is [1, M], where M represents the total number of dense connected graphs in the dense connected graph set; Obtaining a roaming distance of each point in the j-th dense connected graph according to the map adjacency matrix, and summing the roaming distances of each point in the j-th dense connected graph to obtain a j-th connected graph roaming distance of the j-th dense connected graph; Increment j by 1 to update the value of j; If it is determined that j does not exceed M, returning to the step of obtaining the j-th dense connected graph in the dense connected graph set; If it is determined that j exceeds M, the roaming distance from the first connected graph to the Mth connected graph is obtained.

7. The method for identifying an IoT cloud SIM card pool based on a graph model according to claim 1, characterized in that: If the connected graph roaming distance corresponding to the dense connected graph satisfies the preset first distance screening condition, obtaining the corresponding dense connected graph to form a target dense connected graph set includes: A distance threshold corresponding to the distance screening condition is obtained. If it is determined that a connected graph roaming distance corresponding to a dense connected graph is greater than the distance threshold, the corresponding dense connected graph is obtained to form a target dense connected graph set.

8. An IoT cloud SIM card pool identification device based on a graph model, characterized in that: include: a data set acquisition unit, configured to, in response to an identification instruction, acquire a deep data packet inspection data set corresponding to the identification instruction; wherein the deep data packet inspection data set includes a plurality of deep data packet inspection data, each deep data packet inspection data including at least a customer name, a SIM card number, and a terminal IMEI number; An undirected graph acquisition unit, configured to construct a SIM card number point set and a terminal IMEI number point set according to the deep data packet inspection data set, and determine an undirected graph based on the SIM card number point set and the terminal IMEI number point set; a dense connected graph acquisition unit, configured to acquire connected graphs included in the undirected graph to form a connected graph set, and acquire connected graphs that meet a preset dense connected graph screening condition from the connected graph set to form a dense connected graph set; a roaming distance acquisition unit, configured to acquire a preset map adjacency matrix, and determine a connected graph roaming distance corresponding to each dense connected graph in the dense connected graph set according to the map adjacency matrix; as well as The target dense connected graph set acquisition unit is configured to acquire the corresponding dense connected graph to form a target dense connected graph set if the connected graph roaming distance corresponding to the dense connected graph satisfies a preset first distance screening condition.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for identifying an Internet of Things cloud SIM card pool based on a graph model according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to perform the method for identifying an Internet of Things cloud SIM card pool based on a graph model according to any one of claims 1 to 7.

Images