A method, device, computer equipment and medium for detecting abnormal matching

Abstract

The embodiment of the present invention discloses an abnormal matching detection method, device, computer equipment and medium. The method comprises: pre-processing the acquired full amount of call bill data to obtain call bill data; performing abnormal detection on the call bill data according to pre-configured detection rules to obtain abnormal matching results; and outputting the abnormal matching results in the form of a file. The embodiment of the present invention solves the problem of configuring multiple Internet of Things cards for abnormal detection in terminal devices, realizes the enhancement of the detection capability of abnormal Internet of Things cards, and reduces the abnormal use of Internet of Things cards.

Description

Technical Field

[0001] The embodiments of the present invention relate to computer data processing technology, and in particular to an abnormal matching detection method, device, computer equipment and medium. Background Art

[0002] With the rapid development of 5G technology, the technology of the Internet of Things industry under 5G scenarios has also made new developments. The new generation of information technology with the Internet of Things as the mainstream is becoming an important support for industrial transformation and upgrading. The number of IoT devices is getting larger and larger, and traditional economic activities will gradually penetrate into the IoT industry, which brings opportunities for the development of the IoT industry. As the top priority of such issues, IoT cards require strong regulatory measures to assist in the discovery of illegal use. In May 2021, the Ministry of Industry and Information Technology further promoted the "Card Cutting Action 2.0" and focused on the management of IoT cards and phone cards.

[0003] The inventor discovered the defects of the prior art during the invention process: most of the abnormal IoT cards that exist now are "sleeping cards", "silent cards", and "one certificate for multiple cards". It is crucial to strengthen the monitoring and discovery of abnormal IoT cards and focus on cleaning up and rectifying abnormal IoT cards, virtual operator stock cards and other high-risk cards. However, how to detect abnormal IoT cards is the key, thereby increasing the detection of abnormal Internet accounts and abnormal information on the Internet. The difficulty of protecting IoT devices is increasing. The neglect of security makes IoT devices extremely vulnerable and it is easy for attackers to discover loopholes and exploit them. At the same time, all network devices, platforms, and data resources in the entire ecosystem need to be monitored for security. Summary of the invention

[0004] The embodiments of the present invention provide an abnormal matching detection method, apparatus, computer equipment and medium, which solve the problem of configuring multiple Internet of Things cards for abnormal detection in a terminal device, so as to enhance the detection capability of abnormal Internet of Things cards.

[0005] In a first aspect, an embodiment of the present invention provides an abnormal matching detection method, which includes:

[0006] Preprocessing the acquired full amount of call bill data to obtain call bill data, wherein the call bill data includes at least one of the following: terminal device number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code;

[0007] Performing anomaly detection on the call record data through pre-configured detection rules to obtain anomaly matching results;

[0008] The abnormal matching result is output in the form of a file.

[0009] In a second aspect, an embodiment of the present invention further provides an abnormal matching detection device, the abnormal matching detection device comprising:

[0010] A call bill data acquisition module, used to pre-process the acquired full call bill data to obtain call bill data, wherein the call bill data includes at least one of the following: terminal equipment number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code;

[0011] An abnormal matching result obtaining module is used to perform abnormal detection on the call record data through pre-configured detection rules to obtain abnormal matching results;

[0012] The abnormal matching result output module is used to output the abnormal matching result in the form of a file.

[0013] In a third aspect, an embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the abnormal matching detection method as described in any embodiment of the present invention is implemented.

[0014] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, wherein when the program is executed by a processor, the abnormal matching detection method as described in any embodiment of the present invention is implemented.

[0015] The technical solution provided by the embodiment of the present invention performs anomaly detection on the acquired call record data through pre-configured detection rules, and can obtain abnormal matching results of the call record data. According to the abnormal matching results, the abnormal situation of the terminal device configuring an abnormal Internet of Things card is obtained, thereby enhancing the abnormal Internet of Things card detection capability and reducing the abnormal use of the Internet of Things card. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of an abnormal matching detection method provided in Embodiment 1 of the present invention;

[0017] Figure 2 A flowchart of another abnormal matching detection method provided in Embodiment 2 of the present invention;

[0018] Figure 3 A flowchart of another abnormal matching detection method provided in Embodiment 3 of the present invention;

[0019] Figure 4 A flowchart of another abnormal matching detection method provided in Embodiment 4 of the present invention;

[0020] Figure 5is a structural schematic diagram of an abnormal matching detection device provided in Embodiment 5 of the present invention;

[0021] Figure 6 It is a structural diagram of a computer device provided in Embodiment 6 of the present invention. DETAILED DESCRIPTION

[0022] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0023] Embodiment 1

[0024] Figure 1 This is a flow chart of an abnormal match detection method provided in Embodiment 1 of the present invention. This embodiment can be applied to the case where a terminal device is configured with multiple IoT cards for abnormal detection. The method of this embodiment can be executed by an abnormal match detection device, which can be implemented by software and / or hardware, and the device can be configured in the terminal device.

[0025] Accordingly, the method specifically comprises the following steps:

[0026] S110: Pre-process the acquired full amount of call record data to obtain call record data.

[0027] Among them, the call bill data includes at least one of the following: terminal equipment number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code.

[0028] The full call bill data may be the call bill data of different terminal devices that can be obtained through operators within a certain period. The call bill data may be obtained by preprocessing the full call bill data. The specific method of preprocessing may include data cleaning, data integration and data transformation, etc. The specific method of preprocessing is not limited in this embodiment.

[0029] Among them, the IMEI code can be what is commonly referred to as the mobile phone serial number or the mobile phone "serial number", which is used to identify each independent mobile phone and other mobile communication devices in the mobile phone network, which is equivalent to the ID card of the mobile phone. The serial number has 15 to 17 digits. The first 8 digits (TAC) are the model approval number (6 digits in the early days), which is the code to distinguish the brand and model of the mobile phone. The next 2 digits (FAC) are the final assembly number, which represents the final assembly site code. The last 6 digits (SNR) are the serial number, which represents the production sequence number.

[0030] The TAC code can be assigned by the European Type Approval Center. The first three digits of the TAC code will change at different times. The first three digits of the old TAC code will not appear on current mobile phones. Some old models of mobile phones in the past basically started with 446 / 448.

[0031] The MSISDN code can be equivalent to the user telephone number of the fixed network, and is a public number for users to dial. Since the telephone number structure of mobile users in the GSM (Global System for Mobile Communications) system is based on the ISDN (Integrated Services Digital Network) numbering method, it is called MSISDN, which is the international ISDN number of mobile users. The encoding method of MSISDN is in accordance with the recommendations of CCITT (Consultative Committee of International Telephone and Telegraph). MSISDN refers to the number that the calling user needs to dial to call a mobile user in the GSM PLMN (Public Land Mobile Network). It has the same function as the fixed network PSTN (Public Switched Telephone Network) number. It is the number that can uniquely identify mobile users in the public telephone network switching network numbering plan.

[0032] The CELLID code may refer to a positioning technology, which is provided to the positioning user by obtaining information provided by the target terminal device. Its principle is to determine the location of the target terminal device by obtaining the cellular cell number where the target terminal device is located, and provide it to the positioning user. Specifically, the method of determining the cellular cell number through the CELLID code may be: selecting the cellular with the best signal quality, selecting the cellular network that is most recently related to the user terminal device, and selecting the cellular network that the user terminal device has used and is not yet ready to switch.

[0033] S120: Perform anomaly detection on the call record data using pre-configured detection rules to obtain anomaly matching results.

[0034] The pre-configured detection rules may be parameters in the call sheet data, and judgment and processing are performed according to certain rules. The abnormal matching result may be that the terminal device in the call sheet data has abnormal use of the Internet of Things card, and the abnormal matching result is obtained.

[0035] Specifically, the pre-configured detection rules may be a variety of rules such as a call record database matching result, a connection matrix determined according to the call record data, and a preset threshold comparison, but are not limited to the above rules.

[0036] S130: Output the abnormal matching result in the form of a file.

[0037] Specifically, the obtained abnormal matching results can be output in the form of a file, and can be fed back to relevant staff, so that the staff can perform abnormal matching analysis.

[0038] The technical solution provided by the embodiment of the present invention performs anomaly detection on the acquired call record data through pre-configured detection rules, and can obtain abnormal matching results of the call record data. According to the abnormal matching results, the abnormal situation of the terminal device configuring an abnormal Internet of Things card is obtained, thereby enhancing the abnormal Internet of Things card detection capability and reducing the abnormal use of the Internet of Things card.

[0039] Embodiment 2

[0040] Figure 2 A flowchart of another abnormal matching detection method provided in Embodiment 2 of the present invention. This embodiment is refined based on the above embodiments. In this embodiment, abnormal matching results are further refined by performing abnormal matching detection on the call list data according to pre-configured detection rules.

[0041] Accordingly, the method specifically comprises the following steps:

[0042] S210: Pre-process the acquired full amount of call record data to obtain call record data.

[0043] S220: Obtain the TAC code contained in the call bill data.

[0044] The call bill data includes the brand information and manufacturer of the first terminal device associated with the TAC code.

[0045] Among them, the first terminal device brand information and manufacturer can be in the call bill data, and different TAC codes correspond to the terminal device brand information and manufacturer. For example, when the TAC code is 44XXXX89, the corresponding first terminal device brand information and manufacturer can be Xiaomi, and the manufacturer is Shenzhen XX Company.

[0046] S230, determine whether the TAC code matches the standard TAC code in the call record database; if so, execute S240; if not, execute S280.

[0047] S240: Obtain the brand information and manufacturer of the second terminal device associated with the standard TAC in the call record database.

[0048] The brand information and manufacturer of the second terminal device may be in a call bill database, and different TAC codes correspond to the brand information and manufacturer of the terminal device.

[0049] S250, determining whether the brand information and manufacturer of the first terminal device are consistent with the brand information and manufacturer of the second terminal device; if so, executing S260; if not, executing S270.

[0050] S260: Determine whether the call record data is a normal match.

[0051] S270, determining that the call record data is an abnormal match; executing S280.

[0052] S280. Add the call record data corresponding to the TAC code to the call record database.

[0053] S290: Output the abnormal matching result in the form of a file.

[0054] For example, assume that there are three groups of data in the call bill data, which are: when the TAC code is 44XXXX89, the corresponding first terminal device brand information and manufacturer are Xiaomi and Shenzhen XX Company; when the TAC code is 46XXXX72, the corresponding first terminal device brand information and manufacturer are Huawei and Shenzhen XX Company; when the TAC code is 48XXXX66, the corresponding first terminal device brand information and manufacturer are OPPO and Guangdong XX Company. The standard TAC code and its corresponding second terminal device brand information and manufacturer in the call bill database are: when the standard TAC code is 44XXXX89, the corresponding second terminal device brand information and manufacturer are Xiaomi and Shenzhen XX Company; when the standard TAC code is 46XXXX72, the corresponding second terminal device brand information and manufacturer are VIVO and Shenzhen XX Company; when the standard TAC code is 47XXXX67, the corresponding second terminal device brand information and manufacturer are Huawei and Guangdong XX Company.

[0055] First, the TAC code included in the call bill data is obtained to obtain the brand information and manufacturer of the first terminal device associated with the TAC code included in the call bill data. Further, it is determined whether the TAC code matches the standard TAC code in the call bill database.

[0056] If so, obtain the brand information and manufacturer of the second terminal device associated with the standard TAC in the call record database. Specifically, since the TAC code is 44XXXX89 and 46XXXX72, it is consistent with the standard TAC code, the brand information and manufacturer of the second terminal device associated with the standard TAC are obtained, which are Xiaomi and Shenzhen XX Company; VIVO and Shenzhen XX Company. Correspondingly, determine the abnormal matching result according to the brand information and manufacturer of the first terminal device and the brand information and manufacturer of the second terminal device. Specifically, determine whether the brand information and manufacturer of the first terminal device are consistent with the brand information and manufacturer of the second terminal device; if so, determine that the call record data is a normal match; if not, determine that the call record data is an abnormal match. Further, after comparison, it can be determined that when the TAC code is 44XXXX89, the call record data is a normal match; and when the TAC code is 46XXXX72, the call record data is an abnormal match.

[0057] Otherwise, the bill data corresponding to the TAC code is added to the bill database. Specifically, since the TAC code is 48XXXX66, it does not match the standard TAC code, the TAC code and its corresponding first terminal device brand information and manufacturer can be added to the bill database.

[0058] Accordingly, the TAC code is 46XXXX72, the corresponding first terminal device brand information and manufacturer is Huawei and Shenzhen XX Company, and other relevant information are output in the form of a file.

[0059] The technical solution provided by the embodiment of the present invention performs anomaly detection on the acquired call bill data through the call bill database matching rules, and can further obtain abnormal matching results of the call bill data based on the comparison of the brand information and manufacturer of the first terminal device and the brand information and manufacturer of the second terminal device. The abnormal situation of the abnormal Internet of Things card configured with the terminal device is obtained based on the abnormal matching result, thereby realizing the detection of abnormal Internet of Things cards for bound machine cards, thereby reducing the abnormal use of Internet of Things cards and increasing the ability to detect abnormal Internet of Things cards.

[0060] Embodiment 3

[0061] Figure 3 This is a flow chart of another abnormal matching detection method provided in Embodiment 3 of the present invention. This embodiment is refined based on the above embodiments. In this embodiment, abnormal matching results are further refined by performing abnormal matching detection on the call list data according to pre-configured detection rules.

[0062] Accordingly, the method specifically comprises the following steps:

[0063] S310: Pre-process the acquired full amount of call record data to obtain call record data.

[0064] S320: Obtain the IMEI code and MSISDN code contained in the call bill data.

[0065] S330: When it is determined that the same IMEI code exists in the call bill data, the same IMEI code and the MSISDN code corresponding to the same IMEI code are output to obtain a first file.

[0066] The first file may be a file consisting of the same IMEI code and the MSISDN code corresponding to the IMEI code.

[0067] As described in Table 1 below, when the IMEI codes in the call bill data are 46XXXX72XXXXXXX96 and 44XXXX89XXXXXXX52, the same IMEI code exists. Further, the MSISDN code corresponding to the same IMEI code can be obtained. Specifically, when the IMEI code is 46XXXX72XXXXXXX96, the MSISDN code can be 86133XXXX3698, 86137XXXX6632, and 86133XXXX5896.

[0068] Table 1

[0069]

[0070] S340: When it is determined that the same MSISDN code exists in the call bill data, the same MSISDN code and the IMEI code corresponding to the same MSISDN code are output to obtain a second file.

[0071] The second file may be a file consisting of the same MSISDN code and the IMEI code corresponding to the MSISDN code.

[0072] As described in Table 2 below, when the MSISDN codes in the call bill data are 86133XXXX3698 and 86152XXXX6892, the same MSISDN code exists. Further, the IMEI code corresponding to the same MSISDN code can be obtained. Specifically, when the MSISDN code is 86133XXXX3698, the IMEI code can be 46XXXX72XXXXXXX96, 48XXXX79XXXXXXX88, and 49XXXX21XXXXXXX56.

[0073] Table 2

[0074]

[0075] S350: Delete duplicate data in the first file and the second file to obtain a third file.

[0076] The third file may be a file obtained by deleting duplicate data in the first file and the second file and sorting out corresponding data.

[0077] S360: Construct a connection matrix according to the third file.

[0078] The connection matrix may be a matrix formed by connecting the IMEI codes and the MSISDN codes in the third file.

[0079] S370, determining whether the connection matrix satisfies a preset connection matrix rule, if so, executing S380; if not, executing S390.

[0080] The preset connection matrix rule may be a connection matrix rule composed of different IMEI codes and MSISDN codes when the call list data is normal.

[0081] S380: Determine whether the call record data is a normal match.

[0082] S390: Determine that the call record data is an abnormal match.

[0083] S3100. Output the abnormal matching result in the form of a file.

[0084] The technical solution provided by the embodiment of the present invention performs abnormal detection on the acquired call sheet data through the connection matrix rule determined by the call sheet data, and can further obtain the abnormal matching result of the call sheet data by comparing the connection matrix composed of the IMEI code and the MSISDN code with the preset connection matrix rule, and obtain the abnormal situation of the abnormal configuration of the terminal device IoT card according to the abnormal matching result. The problem of abnormal detection of non-bound machine cards is solved, the detection capability of abnormal IoT cards is enhanced, and the detection range of abnormal IoT cards is increased, thereby reducing the illegal abuse of IoT cards.

[0085] Embodiment 4

[0086] Figure 4 A flowchart of another abnormal matching detection method provided in Embodiment 4 of the present invention. This embodiment is refined based on the above embodiments. In this embodiment, abnormal matching results are further refined by performing abnormal matching detection on the call list data according to pre-configured detection rules.

[0087] Accordingly, the method specifically comprises the following steps:

[0088] S410: Pre-process the acquired full amount of call record data to obtain call record data.

[0089] S420: Obtain the IMEI code, MSISDN code and CELLID code contained in the call bill data.

[0090] S430, determine whether there is an IMEI code with more than one associated MSISDN code in the call bill data, if so, execute S340; if not, execute S370.

[0091] S440: Divide the call bill data of the IMEI code according to unit time to obtain a call bill data division result.

[0092] The call bill data division result includes the number of base station cells and the number of SIM cards.

[0093] The call bill data division result may be a specific division result of the number of base station cells and the number of SIM cards corresponding to a certain terminal device in the call bill data within a unit event.

[0094] Specifically, the number of base station cells can be obtained according to the CELLID code; the number of SIM cards can be obtained according to the MSISDN code, and one MSISDN code corresponds to one SIM card.

[0095] S450, determine whether the number of base station cells and the number of SIM cards of the IMEI code included in the call bill data division result are greater than a preset threshold, if so, execute S460; if not, execute S470.

[0096] S460: Determine that the call record data is an abnormal match; and execute S380.

[0097] S470: Determine whether the call record data is a normal match.

[0098] S480: Output the abnormal matching result in the form of a file.

[0099] For example, assume that in the call bill database per unit time, when each terminal device communicates, the number of corresponding standard base station cells is 3 and the number of SIM cards is 2. Assume that there are 3 IMEI codes, namely: IMEI code 1, corresponding to 2 MSISDN codes, the number of corresponding base station cells per unit time is 2, and the number of SIM cards is 2; IMEI code 2, corresponding to 5 MSISDN codes, the number of corresponding base station cells per unit time is 8, and the number of SIM cards is 4; IMEI code 3, corresponding to 1 MSISDN code, the number of corresponding base station cells per unit time is 1, and the number of SIM cards is 2.

[0100] First, the IMEI code, MSISDN code and CELLID code contained in the call bill data are obtained. Then, it is determined whether there is an IMEI code with more than one associated MSISDN code in the call bill data.

[0101] If so, the call bill data of the IMEI code is divided according to unit time to obtain the call bill data division result. Specifically, the number of MSISDN codes associated with IMEI code 1 and IMEI code 2 is greater than one. It is necessary to determine whether the number of base station cells and the number of SIM cards of the IMEI code contained in the call bill data division result are greater than the preset threshold. Since the number of base station cells corresponding to IMEI code 1 and the number of SIM cards in unit time are 2, which are less than the preset threshold, the call bill data is determined to be a normal match. Since the number of base station cells corresponding to IMEI code 2 and the number of SIM cards in unit time are 8, which are greater than the preset threshold, the call bill data is determined to be an abnormal match, and the abnormal match result is output in the form of a file.

[0102] If not, it is determined that the call bill data is a normal match. Specifically, since IMEI code 3 corresponds to 1 MSISDN code, it is determined that IMEI code 3 in the call bill data is a normal match.

[0103] The technical solution provided by the embodiment of the present invention performs abnormal detection on the acquired call data through the preset threshold rule determined by the call data, and compares the number of base station cells and the number of SIM cards of the IMEI code with the preset threshold, so as to further obtain the abnormal matching result of the call data, and obtain the abnormal situation of the abnormal configuration of the terminal device IoT card according to the abnormal matching result. The problem of abnormal detection of multiple IoT cards associated with a terminal device is solved, and the detection range of abnormal IoT cards is increased. By comparing the number of base station cells and the preset threshold of the SIM card, the abnormal call data can be judged more accurately, thereby enhancing the detection capability of abnormal IoT cards.

[0104] Embodiment 5

[0105] Figure 5 : is a schematic diagram of the structure of an abnormal matching detection device provided in Embodiment 5 of the present invention. The abnormal matching detection device provided in this embodiment can be implemented by software and / or hardware, and can be configured in a terminal device to implement an abnormal matching detection method in the embodiment of the present invention. Figure 5 As shown, the device may specifically include: a call list data obtaining module 510, an abnormal matching result obtaining module 520 and an abnormal matching result output module 530.

[0106] The call bill data acquisition module 510 is used to pre-process the acquired full call bill data to obtain call bill data, wherein the call bill data includes at least one of the following: terminal device number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code;

[0107] The abnormal matching result obtaining module 520 is used to perform abnormal detection on the call record data according to a pre-configured detection rule to obtain an abnormal matching result;

[0108] The abnormal matching result output module 530 is used to output the abnormal matching result in the form of a file.

[0109] The technical solution provided by the embodiment of the present invention performs anomaly detection on the acquired call record data through pre-configured detection rules, and can obtain abnormal matching results of the call record data. According to the abnormal matching results, the abnormal situation of the terminal device configuring an abnormal Internet of Things card is obtained, thereby enhancing the abnormal Internet of Things card detection capability and reducing the abnormal use of the Internet of Things card.

[0110] On the basis of the above embodiments, the abnormal matching result obtaining module 520 can be specifically used for: a TAC code acquisition unit, used to obtain the TAC code contained in the call bill data, wherein the call bill data contains the first terminal device brand information and manufacturer associated with the TAC code; a TAC code judgment unit, used to judge whether the TAC code hits the standard TAC code in the call bill database; an abnormal matching result determination unit, used to obtain the second terminal device brand information and manufacturer associated with the standard TAC in the call bill database if the TAC code hits the standard TAC code in the call bill database, and determine the abnormal matching result according to the first terminal device brand information and manufacturer and the second terminal device brand information and manufacturer; a call bill database adding unit, used to add the call bill data corresponding to the TAC code to the call bill database if the TAC code does not hit the standard TAC code in the call bill database.

[0111] Based on the above embodiments, the abnormal matching result determination unit can be specifically used to: determine whether the brand information and manufacturer of the first terminal device are consistent with the brand information and manufacturer of the second terminal device; if so, determine that the call bill data is a normal match; if not, determine that the call bill data is an abnormal match.

[0112] On the basis of the above embodiments, the abnormal matching result obtaining module 520 can be specifically used for: an IMEI code and MSISDN code obtaining unit, which is used to obtain the IMEI code and MSISDN code contained in the call bill data; a first file obtaining unit, which is used to output the same IMEI code and the MSISDN code corresponding to the same IMEI code to obtain a first file when it is determined that the same IMEI code exists in the call bill data; a second file obtaining unit, which is used to output the same MSISDN code and the IMEI code corresponding to the same MSISDN code to obtain a second file when it is determined that the same MSISDN code exists in the call bill data; and an abnormal matching result obtaining unit, which is used to obtain the abnormal matching result according to the first file and the second file.

[0113] On the basis of the above embodiments, the abnormal matching result obtaining unit can be specifically used to: delete duplicate data in the first file and the second file to obtain a third file; construct a connection matrix according to the third file; determine whether the connection matrix satisfies the preset connection matrix rules, and if so, determine that the call list data is a normal match; otherwise, determine that the call list data is an abnormal match.

[0114] On the basis of the above embodiments, the abnormal matching result obtaining module 520 can be specifically used for: an IMEI code, MSISDN code and CELLID code acquisition unit, used to obtain the IMEI code, MSISDN code and CELLID code contained in the call bill data; a call bill data judgment unit, used to judge whether there is an IMEI code with an associated MSISDN code greater than one in the call bill data, and if so, determine the abnormal matching result according to the IMEI code; a normal matching determination unit, used to determine that the call bill data is a normal match if there is no IMEI code with an associated MSISDN code greater than one in the call bill data.

[0115] On the basis of the above embodiments, the call bill data judgment unit can be specifically used to: divide the call bill data of the IMEI code according to unit time to obtain the call bill data division result, wherein the call bill data division result includes the number of base station cells and the number of SIM cards; determine whether the number of base station cells and the number of SIM cards of the IMEI code contained in the call bill data division result are greater than a preset threshold value, and if so, determine that the call bill data is an abnormal match; otherwise, determine that the call bill data is a normal match.

[0116] The above-mentioned abnormal matching detection device can execute the abnormal matching detection method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0117] Embodiment 6

[0118] Figure 6 Schematic diagram of the structure of a computer device provided by Embodiment 6 of the present invention. Figure 6 As shown, the device includes a processor 610, a memory 620, an input device 630, and an output device 640; the number of processors 610 in the device can be one or more. Figure 6 A processor 610 is taken as an example; the processor 610, memory 620, input device 630 and output device 640 in the device can be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0119] The memory 620, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the abnormal matching detection method in the embodiment of the present invention (for example, the call data acquisition module 510, the abnormal matching result acquisition module 520 and the abnormal matching result output module 530). The processor 610 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 620, that is, to implement the above-mentioned abnormal matching detection method, which includes: pre-processing the acquired full call data to obtain call data, wherein the call data includes at least one of the following: terminal device number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code; performing abnormal detection on the call data according to pre-configured detection rules to obtain abnormal matching results; and outputting the abnormal matching results in the form of a file.

[0120] The memory 620 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 620 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 620 may further include a memory remotely arranged relative to the processor 610, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0121] The input device 630 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 640 may include a display device such as a display screen.

[0122] Embodiment 7

[0123] Embodiment 7 of the present invention also provides a computer-readable storage medium, wherein the computer-readable instructions are used to execute an abnormal matching detection method when executed by a computer processor, the method comprising: pre-processing the acquired full amount of call bill data to obtain call bill data, wherein the call bill data comprises at least one of the following: terminal equipment number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code; performing abnormality detection on the call bill data through pre-configured detection rules to obtain abnormal matching results; and outputting the abnormal matching results in the form of a file.

[0124] Of course, the computer-readable storage medium provided in the embodiment of the present invention has computer-readable instructions that are not limited to the method operations described above, and can also execute related operations in the abnormal matching detection method provided in any embodiment of the present invention.

[0125] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FLASH), a hard disk or an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0126] It is worth noting that in the embodiment of the above-mentioned abnormal matching detection device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0127] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for detecting abnormal matching, characterized in that: include: Preprocessing the acquired full amount of call bill data to obtain call bill data, wherein the call bill data includes at least one of the following: terminal device number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code; Performing anomaly detection on the call record data through pre-configured detection rules to obtain anomaly matching results; Outputting the abnormal matching result in the form of a file; The abnormality detection is performed on the call record data by using the pre-configured detection rules to obtain the abnormality matching result, including: Obtaining the IMEI code, MSISDN code and CELLID code contained in the call bill data; Determine whether there is an IMEI code with more than one associated MSISDN code in the call bill data, and if so, determine an abnormal matching result according to the IMEI code; Otherwise, determining that the call record data is a normal match; Wherein, determining the abnormal matching result according to the IMEI code includes: Dividing the call bill data of the IMEI code according to unit time to obtain a call bill data division result, wherein the call bill data division result includes the number of base station cells and the number of SIM cards; Determine whether the number of base station cells and the number of SIM cards of the IMEI code included in the call bill data division result is greater than a preset threshold, and if so, determine that the call bill data is an abnormal match; Otherwise, determining that the call record data is a normal match; Wherein, the number of base station cells is obtained according to the CELLID code.

2. The method according to claim 1, characterized in that The abnormality detection is performed on the call record data by using the pre-configured detection rules to obtain the abnormality matching result, including: Acquire the TAC code contained in the call bill data, wherein the call bill data contains brand information and manufacturer of the first terminal device associated with the TAC code; Determine whether the TAC code matches a standard TAC code in a call record database; If yes, obtaining the brand information and manufacturer of the second terminal device associated with the standard TAC in the call record database, and determining an abnormal matching result according to the brand information and manufacturer of the first terminal device and the brand information and manufacturer of the second terminal device; Otherwise, the call record data corresponding to the TAC code is added to the call record database.

3. The method according to claim 2, wherein determining the abnormal matching result according to the brand information and manufacturer of the first terminal device and the brand information and manufacturer of the second terminal device comprises: Determining whether the brand information and manufacturer of the first terminal device are consistent with the brand information and manufacturer of the second terminal device; If yes, it is determined that the call record data is a normal match; If not, it is determined that the call record data is an abnormal match.

4. The method according to claim 1, characterized in that: The abnormality detection is performed on the call record data by using the pre-configured detection rules to obtain the abnormality matching result, including: Obtaining the IMEI code and MSISDN code contained in the call bill data; When it is determined that the same IMEI code exists in the call bill data, the same IMEI code and the MSISDN code corresponding to the same IMEI code are output to obtain a first file; When it is determined that the same MSISDN code exists in the call bill data, the same MSISDN code and the IMEI code corresponding to the same MSISDN code are output to obtain a second file; The abnormal matching result is obtained according to the first file and the second file.

5. The method according to claim 4, characterized in that The obtaining the abnormal matching result according to the first file and the second file includes: Deleting duplicate data from the first file and the second file to obtain a third file; constructing a connection matrix according to the third file; Determine whether the connection matrix satisfies a preset connection matrix rule, and if so, determine that the call record data is a normal match; Otherwise, it is determined that the call record data is an abnormal match.

6. An abnormal matching detection device, characterized in that: include: A call bill data acquisition module, used to pre-process the acquired full call bill data to obtain call bill data, wherein the call bill data includes at least one of the following: terminal equipment number IMEI code, base station number TAC code, Internet of Things card number MSISDN code and base station cell number CELLID code; An abnormal matching result obtaining module is used to perform abnormal detection on the call record data through pre-configured detection rules to obtain abnormal matching results; An abnormal matching result output module is used to output the abnormal matching result in the form of a file; The abnormal matching result obtaining module is specifically used for: An IMEI code, MSISDN code and CELLID code acquisition unit, used to acquire the IMEI code, MSISDN code and CELLID code contained in the call bill data; a call bill data determination unit, configured to determine whether there is an IMEI code associated with more than one MSISDN code in the call bill data, and if so, determine an abnormal matching result according to the IMEI code; A normal match determination unit, configured to determine that the call bill data is a normal match if there is no IMEI code associated with more than one MSISDN code in the call bill data; The call bill data determination unit is specifically used for: Dividing the call bill data of the IMEI code according to unit time to obtain a call bill data division result, wherein the call bill data division result includes the number of base station cells and the number of SIM cards; Determine whether the number of base station cells and the number of SIM cards of the IMEI code included in the call bill data division result is greater than a preset threshold, and if so, determine that the call bill data is an abnormal match; Otherwise, determining that the call record data is a normal match; Wherein, the number of base station cells is obtained according to the CELLID code.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the abnormal matching detection method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal matching detection method as described in any one of claims 1 to 5 is implemented.

Images