Mobile phone card abnormal use identification method, device and equipment and storage medium

Abstract

The application provides a mobile card abnormal use identification method, device and equipment and a storage medium. The method comprises the following steps: acquiring communication related data collected by a plurality of mobile cards to be identified in a preset time period; acquiring an identifier of whether a plurality of static data indexes corresponding to each mobile card change based on the communication related data; determining each target mobile card according to the identifier of whether the plurality of static data indexes change; acquiring an identifier of whether a plurality of behavior data indexes corresponding to each target mobile card change and a change rate of each behavior data index based on the communication related data; acquiring a change rate of a network data index corresponding to each target mobile card based on the communication related data; obtaining a use behavior score corresponding to each target mobile card based on each identifier and each change rate; and judging whether the mobile card belongs to abnormal use based on the use behavior score. The data indexes referred to by the method are sufficient, the identification accuracy is high, and misjudgment is less likely to occur.

Description

Technical Field

[0001] This application relates to the field of communication security technology, and in particular to a method, apparatus, device and storage medium for identifying abnormal use of mobile phone cards. Background Technology

[0002] With the development of communication technology and the widespread use of mobile devices, SIM cards have become a necessity for users. As operators provide an increasing number of SIM cards, abnormal user behavior has emerged, including instances of SIM cards being used for illegal activities. Therefore, identifying abnormal SIM card usage is crucial for optimizing the telecommunications environment and protecting the interests of legitimate users.

[0003] Currently, existing technologies for identifying abnormal use of SIM cards mainly rely on whether the SIM card's network access time and self-paid plan details are reasonable.

[0004] However, the invention found that the existing technology has at least the following technical problems: the existing methods for identifying abnormal use of mobile phone cards are simple in method, have poor accuracy, and often have the problem of misjudgment. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for identifying abnormal use of mobile phone cards, in order to solve the problem that existing methods for identifying abnormal use of mobile phone cards are simple in identification, have poor accuracy, and often suffer from misjudgment.

[0006] Firstly, this application provides a method for identifying abnormal use of a mobile phone SIM card, including:

[0007] Acquire communication-related data collected from multiple SIM cards to be identified within a preset time period;

[0008] Based on the communication-related data, obtain the identifiers of whether multiple static data indicators corresponding to each SIM card have changed;

[0009] Each target SIM card is determined based on whether the multiple static data indicators have changed, wherein each target SIM card contains at least one indicator that a static data indicator has changed. Based on the communication-related data, the indicators that multiple behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator are obtained.

[0010] Based on the communication-related data, the rate of change of network data indicators corresponding to each target SIM card is obtained;

[0011] Based on the identifiers indicating whether the multiple static data indicators have changed, the identifiers indicating whether the multiple behavioral data indicators have changed, the change rate of each behavioral data indicator, and the change rate of the network data indicator, the usage behavior score corresponding to each target SIM card is obtained.

[0012] Based on the usage behavior scores corresponding to each target SIM card, a determination is made as to whether each target SIM card is being used abnormally.

[0013] In one possible design, the step of obtaining the identifiers of whether multiple static data indicators corresponding to each SIM card have changed based on the communication-related data includes: obtaining a first identifier of whether the device corresponding to each SIM card has changed, a second identifier of whether the permanent location has changed, a third identifier of whether the frequently used base station has changed, and a fourth identifier of whether the home location has changed, based on the communication-related data.

[0014] In one possible design, the identification of each target SIM card based on whether the plurality of static data indicators have changed, wherein each target SIM card includes at least one identifier indicating that a static data indicator has changed, and the acquisition of identifiers indicating whether the plurality of behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator based on the communication-related data, includes: for each target SIM card where at least one of the first identifier, the second identifier, the third identifier, and the fourth identifier has changed, acquiring a fifth identifier indicating whether the location of each target SIM card has changed, a sixth identifier indicating whether SMS messages are normal, and a seventh identifier indicating whether calls are normal, as well as the location movement change rate, SMS behavior change rate, and call behavior change rate, based on the communication-related data.

[0015] In one possible design, obtaining the usage behavior score corresponding to each target SIM card based on the identifiers of whether the multiple static data indicators have changed, the identifiers of whether the multiple behavioral data indicators have changed, the change rate of each behavioral data indicator, and the change rate of the network data indicator includes: performing data transformation and weighting processing based on the first identifier, the second identifier, the third identifier, the fourth identifier, the fifth identifier of whether the location has changed, the sixth identifier of whether the SMS is normal, the seventh identifier of whether the call is normal, and the change rate of location movement, SMS behavior, call behavior, and network data indicators to obtain the usage behavior score corresponding to each target SIM card.

[0016] In one possible design, the step of determining whether each target SIM card belongs to abnormal use based on the usage behavior score corresponding to each target SIM card includes: if the usage behavior score corresponding to any target SIM card is less than a preset abnormal threshold, then the identification result of the target SIM card is determined to be non-abnormal use; if the usage behavior score corresponding to any target SIM card is greater than or equal to the preset abnormal threshold, then the identification result of the target SIM card is determined to be abnormal use.

[0017] Secondly, this application provides a SIM card abnormal use identification device, comprising:

[0018] The data acquisition module is used to acquire communication-related data collected from multiple SIM cards to be identified within a preset time period;

[0019] The first indicator processing module is used to obtain the identifiers of whether multiple static data indicators corresponding to each mobile phone card have changed based on the communication-related data.

[0020] The second indicator processing module is used to determine each target SIM card based on whether the multiple static data indicators have changed, wherein each target SIM card contains at least one indicator that a static data indicator has changed, and obtains the indicators that multiple behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator based on the communication-related data.

[0021] The third indicator processing module is used to obtain the rate of change of network data indicators corresponding to each target SIM card based on the communication-related data.

[0022] The scoring processing module is used to obtain the usage behavior score corresponding to each target SIM card based on the identifiers of whether the multiple static data indicators have changed, the identifiers of whether the multiple behavioral data indicators have changed, the change rate of each behavioral data indicator, and the change rate of the network data indicator.

[0023] The identification and judgment module is used to judge based on the usage behavior score corresponding to each target SIM card to obtain the identification result of whether each target SIM card belongs to abnormal use.

[0024] In one possible design, the first indicator processing module is specifically used to obtain, based on the communication-related data, a first identifier indicating whether the device corresponding to each SIM card has changed, a second identifier indicating whether the permanent location has changed, a third identifier indicating whether the frequently used base station has changed, and a fourth identifier indicating whether the home location has changed.

[0025] In one possible design, the second indicator processing module is specifically used to obtain, based on the communication-related data, a fifth indicator indicating whether the location of each target SIM card has changed, a sixth indicator indicating whether the SMS is normal, and a seventh indicator indicating whether the call is normal, as well as the location movement change rate, SMS behavior change rate, and call behavior change rate, for each target SIM card where at least one of the first, second, third, and fourth indicators has changed.

[0026] Thirdly, this application provides a computer device, including: at least one processor and a memory;

[0027] The memory stores computer-executed instructions;

[0028] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the mobile phone card abnormal use identification method as described in the first aspect and various possible designs of the first aspect.

[0029] Fourthly, this application provides a computer storage medium storing computer execution instructions, which, when executed by a processor, implement the mobile phone card abnormal use identification method described in the first aspect and various possible designs of the first aspect.

[0030] The mobile phone SIM card abnormal use identification method, device, equipment, and storage medium provided in this application collect communication-related data from the SIM card within a preset time period. Based on this data, it obtains identifiers indicating whether multiple static data indicators and multiple behavioral data indicators have changed, as well as the change rates of each behavioral data indicator and network data indicator. Based on these identifiers and change rates, it performs data transformation and weighting processing to obtain a SIM card usage behavior score. The score is then used to determine whether the SIM card is being used abnormally. This identification method uses sufficient data indicators, has high accuracy, and is less prone to misjudgment. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a schematic diagram illustrating an application scenario of the mobile phone card abnormal usage identification method provided in this application embodiment;

[0033] Figure 2Flowchart of the mobile phone card abnormal use identification method provided in this application embodiment Figure 1 ;

[0034] Figure 3 Flowchart of the mobile phone card abnormal use identification method provided in this application embodiment Figure 2 ;

[0035] Figure 4 This is a schematic diagram of the structure of the SIM card abnormal use identification device provided in the embodiments of this application;

[0036] Figure 5 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] Telecommunications security risks refer to remote, non-contact illegal activities carried out against victims via telephone, internet, and SMS by fabricating false information and setting up fake events. Currently, with the advancement of telecommunications operators' "SIM card cut-off" campaigns, illegal telecommunications activities are shifting, primarily involving the purchase of long-term SIM cards for illicit activities, making the identification of these illegal SIM cards more difficult. Existing identification methods mainly rely on the SIM card's activation time and payment details, but this method is simple yet inaccurate, frequently resulting in false positives when dealing with cases involving the purchase of long-term SIM cards for illegal activities.

[0039] To address the aforementioned technical issues, this application provides the following technical concept: By collecting communication-related data from a SIM card within a preset time period, identifying whether multiple static data indicators have changed, identifying whether multiple behavioral data indicators have changed, and the change rates of each behavioral data indicator and network data indicator based on the communication-related data, and performing data transformation and weighting processing based on these indicators and change rates to obtain a SIM card usage behavior score; and making a judgment based on the usage behavior score to determine whether the SIM card is being used abnormally.

[0040] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0041] Figure 1 This is a schematic diagram illustrating an application scenario for the mobile phone card abnormal usage identification method provided in this application embodiment. For example... Figure 1 As shown, the system includes a computer device 101 and a display terminal 102. The computer device 101 analyzes communication-related data of the SIM card collected over a preset time period to output an identification result indicating whether the SIM card is being used abnormally. The display terminal 102 receives and displays the identification result from the computer device 101 for reference by operator staff.

[0042] Figure 2 Flowchart of the mobile phone card abnormal use identification method provided in this application embodiment Figure 1 The execution entity in this embodiment can be Figure 1 The computer device in the illustrated embodiment can be a single server or a cluster of several servers; this embodiment does not impose any particular limitation. Figure 2 As shown, the method includes:

[0043] S201: Obtain communication-related data collected from multiple SIM cards to be identified within a preset time period.

[0044] In this embodiment, the multiple SIM cards to be identified can be manually added by operator staff or automatically identified and selected by computer equipment based on existing training models from the communication system.

[0045] In this embodiment, the preset time period can be 6 months, 3 months or 1 month, and no special limitation is made here.

[0046] In this embodiment, communication-related data includes, but is not limited to, operator-related voice call detail records (CDRs), operator-related SMS call detail records (CDRs), and operator-related signaling call detail records (CDRs).

[0047] Specifically, communication-related data is obtained by summarizing the voice call details, SMS call details, and signaling call details collected by the operator.

[0048] S202: Based on communication-related data, obtain indicators of whether multiple static data indicators corresponding to each SIM card have changed.

[0049] In this embodiment, multiple static data indicators may include, but are not limited to, indicators of whether the device corresponding to the SIM card has changed, indicators of whether the permanent residence area has changed, indicators of whether the frequently used base station has changed, and indicators of whether the home location has changed. Accordingly, the identifiers indicating whether multiple static data indicators have changed include: identifiers of whether the device corresponding to the SIM card has changed, identifiers of whether the permanent residence area has changed, identifiers of whether the frequently used base station has changed, and identifiers of whether the home location has changed.

[0050] S203: Determine each target SIM card based on whether multiple static data indicators have changed, wherein each target SIM card contains at least one indicator indicating that a static data indicator has changed, and obtain the indicators indicating whether multiple behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator based on communication-related data.

[0051] Specifically, if at least one of the following changes occurs: whether the device corresponding to the SIM card has changed, whether the permanent residence area has changed, whether the frequently used base station has changed, or whether the home location has changed, then the corresponding SIM card is identified as a target SIM card. For each target SIM card, based on communication-related data, the indicators of whether multiple behavioral data indicators corresponding to each target SIM card have changed, as well as the change rate of each behavioral data indicator, are obtained.

[0052] In this embodiment, the indicators for whether multiple behavioral data indicators have changed include: an indicator for whether the location has changed, an indicator for whether the SMS message is normal, and an indicator for whether the call is normal. Correspondingly, the change rates of each behavioral data indicator are: location movement change rate, SMS behavior change rate, and call behavior change rate.

[0053] S204: Based on communication-related data, obtain the rate of change of network data indicators corresponding to each target SIM card.

[0054] In this embodiment, the rate of change of network data indicators corresponding to each target SIM card can be the rate of change of network address corresponding to the SIM card.

[0055] S205: Based on the indicators of whether multiple static data indicators have changed, the indicators of whether multiple behavioral data indicators have changed, and the change rates of each behavioral data indicator and the network data indicator, the usage behavior score corresponding to each target SIM card is obtained.

[0056] Specifically, the indicators of whether multiple static data indicators have changed and the indicators of whether multiple behavioral data indicators have changed are converted into numerical values ​​according to preset rules, and then weighted and summed with the change rates of each behavioral data indicator and the change rates of network data indicators to obtain the usage behavior score corresponding to the target mobile phone card.

[0057] S206: Based on the usage behavior score corresponding to each target SIM card, a judgment is made to obtain the identification result of whether each target SIM card belongs to abnormal use.

[0058] Specifically, if the usage behavior score corresponding to any target SIM card is less than a preset abnormal threshold, then the identification result of the target SIM card is determined to be non-abnormal usage; if the usage behavior score corresponding to any target SIM card is greater than or equal to the preset abnormal threshold, then the identification result of the target SIM card is determined to be abnormal usage.

[0059] For example, the preset anomaly threshold can be set to 60.

[0060] As described above, this method collects communication-related data from SIM cards within a preset time period. Based on this data, it identifies whether multiple static data indicators and multiple behavioral data indicators have changed, along with the change rates of each behavioral and network data indicator. Data transformation and weighting are then performed based on these indicators and change rates to obtain a SIM card usage behavior score. This score is then used to determine whether the SIM card is being used abnormally. This identification method uses sufficient data indicators, has high accuracy, and is less prone to misjudgment.

[0061] Figure 3 Flowchart of the mobile phone card abnormal use identification method provided in this application embodiment Figure 2 In the embodiments of this application, in Figure 2 Based on the provided embodiments, this embodiment offers a more detailed explanation of the steps. For example... Figure 3 As shown, the method includes:

[0062] S301: Acquire communication-related data collected from multiple SIM cards to be identified within a preset time period.

[0063] S302: Based on communication-related data, obtain the first identifier of whether the device corresponding to each SIM card has changed, the second identifier of whether the permanent location has changed, the third identifier of whether the frequently used base station has changed, and the fourth identifier of whether the home location has changed.

[0064] Specifically, the device information of the SIM card in the communication-related data within a preset time period is obtained. If the device information has changed within the preset time period, the first indicator to determine whether the SIM card device has changed is "yes"; otherwise, it is "no".

[0065] The device information can be a device serial number. For example, the device serial number can be the International Mobile Equipment Identity (IMEI) of a mobile phone.

[0066] Specifically, the system obtains the mobile phone card's permanent location within a preset time period from communication-related data. If the permanent location has changed within the preset time period, the second identifier indicating whether the permanent location has changed is "yes"; otherwise, it is "no".

[0067] The place of residence can be the province or city where the resident resides.

[0068] Specifically, the system obtains the frequently used base stations of the mobile phone card within a preset time period from communication-related data. If the resident area changes within the preset time period, the third identifier for determining whether the frequently used base station has changed is "yes"; otherwise, it is "no".

[0069] Specifically, the location of the SIM card within a preset time period is obtained from communication-related data. If the location has changed within the preset time period, the fourth identifier for determining whether the location has changed is "yes"; otherwise, it is "no".

[0070] Refer to Table 1, which is an example of an indicator of whether several static data indicators provided in this application have changed.

[0071] Table 1

[0072]

[0073] S303: For each target SIM card where at least one of the first identifier, second identifier, third identifier, and fourth identifier has changed, obtain, based on communication-related data, the fifth identifier indicating whether the location of each target SIM card has changed, the sixth identifier indicating whether the SMS message is normal, and the seventh identifier indicating whether the call is normal, as well as the location movement change rate, SMS behavior change rate, and call behavior change rate.

[0074] Specifically, the location information of the SIM card within a preset time period is obtained from the communication-related data. If the location information changes within the preset time period, the first identifier of the fifth identifier that determines whether the location of the SIM card has changed is "yes"; otherwise, it is "no".

[0075] The location information can be latitude and longitude.

[0076] Specifically, the system retrieves SMS messages from the SIM card within a preset time period from communication-related data. If any sensitive words appear in the SMS messages within the preset time period, the sixth indicator determining whether the SIM card's SMS messages are normal is "yes"; otherwise, it is "no".

[0077] Specifically, the system obtains call information of the SIM card within a preset time period from communication-related data. If sensitive words appear in the call information within the preset time period, the seventh indicator to determine whether the SIM card's call is normal is "yes"; otherwise, it is "no".

[0078] Specifically, if the first identifier of the fifth identifier indicating whether the location corresponding to the SIM card has changed is "yes", then the location change rate of the SIM card is determined based on the number of times the location information changes. For example, the location change rate of the SIM card is obtained by multiplying the number of location information changes by a preset location coefficient.

[0079] Specifically, if the sixth indicator for whether the SMS messages corresponding to the SIM card are normal is "yes", then the SMS behavior change rate of the SIM card is determined based on the number of sensitive words appearing in the SMS messages. For example, the SMS behavior change rate of the SIM card is obtained by multiplying the number of sensitive words appearing in the SMS messages by a preset SMS coefficient.

[0080] Specifically, if the seventh indicator for whether a call is normal is "yes", the call behavior change rate of the SIM card is determined based on the number of sensitive words appearing in the call information. For example, the call behavior change rate of the SIM card is obtained by multiplying the number of sensitive words appearing in the call information by a preset call coefficient.

[0081] Referring to Table 2, which is an example of whether the various behavioral data indicators provided in this application have changed and the rate of change of each behavioral data indicator.

[0082] Table 2

[0083]

[0084]

[0085] S304: Based on communication-related data, obtain the rate of change of network data indicators corresponding to each target SIM card.

[0086] In this embodiment, the rate of change of network data indicators corresponding to each target SIM card can be the rate of change of network address corresponding to the SIM card.

[0087] Among them, the rate of change of network address can be measured by the rate of change of public network address ownership.

[0088] Specifically, the public network address ownership change rate of the SIM card is determined based on the number of times the public network address ownership changes. For example, the public network address ownership change rate of the SIM card is obtained by multiplying the number of times the public network address ownership changes by a preset network coefficient.

[0089] Referring to Table 2, Table 2 provides an example of whether multiple static data indicators and multiple behavioral data indicators have changed, as well as the change rate of each behavioral data indicator and the change rate of the network data indicator provided in this application.

[0090] Table 3

[0091]

[0092] S305: Based on the first, second, third, and fourth identifiers, the fifth identifier indicating whether the location has changed, the sixth identifier indicating whether the SMS is normal, and the seventh identifier indicating whether the call is normal, as well as the change rates of location movement, SMS behavior, call behavior, and network data indicators, perform data transformation and weighting to obtain the usage behavior score corresponding to each target SIM card.

[0093] In this embodiment, the first, second, third, and fourth identifiers, the fifth identifier indicating whether the location has changed, the sixth identifier indicating whether the SMS message is normal, and the seventh identifier indicating whether the call is normal are converted into numerical values ​​according to preset rules. For example, each identifier that is "yes" is recorded as 1, and each identifier that is "no" is recorded as 0.

[0094] Specifically, the values ​​of the first identifier indicating whether the device has changed and the fifth identifier indicating whether the location has changed are weighted to calculate the abnormal device replacement score for the SIM card.

[0095] For example, the equipment replacement anomaly score = the value of the first identifier indicating whether the equipment has changed * 80 + the value of the fifth identifier indicating whether the location has changed * 20.

[0096] Specifically, the values ​​of the second identifier indicating whether the permanent residence location has changed, the value of the third identifier indicating whether the frequently used base stations have changed, the rate of change of location movement, and the rate of change of network data indicators are weighted and processed to calculate the abnormal geographical location score of the mobile phone card.

[0097] For example, the geographic location anomaly score = the value of the second identifier indicating whether the permanent residence area has changed * 30 + the value of the third identifier indicating whether the frequently used base stations have changed * 20 + the location movement change rate * 20 + the change rate of network data indicators * 30.

[0098] Specifically, the abnormal behavior score of the SIM card is calculated by weighting the values ​​of the sixth indicator (whether the SMS message is normal), the seventh indicator (whether the call is normal), the SMS behavior change rate, and the call behavior change rate.

[0099] For example, the abnormal behavior score = the value of the sixth indicator of whether the SMS is normal * 20 + the value of the seventh indicator of whether the call is normal * 30 + SMS behavior change rate * 20 + call behavior change rate * 30.

[0100] Finally, the scores for abnormal device replacement, abnormal geographical location, and abnormal behavior are weighted and summed to obtain the usage behavior score corresponding to the SIM card.

[0101] For example, the usage behavior score corresponding to the SIM card = device replacement anomaly score * 0.4 + geographical location anomaly score * 0.4 + anomaly behavior score * 0.4.

[0102] S306: If the usage behavior score of any target SIM card is less than the preset abnormal threshold, the identification result of the target SIM card is determined to be non-abnormal usage; if the usage behavior score of any target SIM card is greater than or equal to the preset abnormal threshold, the identification result of the target SIM card is determined to be abnormal usage.

[0103] For example, the usage behavior score of SIM card 1: 186XXXX1234 is (80+20)*0.4+(0+0+20+1)*0.4+(20+0+2+3)*0.4=58.4, so the identification result of SIM card 1 is non-abnormal usage.

[0104] The usage behavior score for SIM card 2: 186XXXX1235 is (0+20)*0.4+(30+0+20+0.9*30)*0.4+(20+0+0.9*20+0.9*30)*0.5=64.8. Therefore, the identification result of SIM card 2 is abnormal usage.

[0105] As described above, the method collects communication-related data from SIM cards within a preset time period to obtain a first identifier indicating whether the device has changed, a second identifier indicating whether the permanent location has changed, a third identifier indicating whether the frequently used base station has changed, and a fourth identifier indicating whether the home location has changed. It then continues to obtain a fifth identifier indicating whether the location has changed, a sixth identifier indicating whether SMS messages are normal, and a seventh identifier indicating whether calls are normal, as well as the rate of change in location movement, SMS behavior, and call behavior; and the rate of change in network data indicators. Based on these identifiers and rates of change, a usage behavior score is finally calculated. Based on the usage behavior score, a judgment is made to determine whether each SIM card is being used abnormally. This identification method uses sufficient data indicators, has high accuracy, and is less prone to misjudgment.

[0106] Figure 4 This is a schematic diagram of the structure of the SIM card abnormal use identification device provided in an embodiment of this application. Figure 4 As shown, the SIM card abnormal use identification device 40 includes: a data acquisition module 401, a first indicator processing module 402, a second indicator processing module 403, a third indicator processing module 404, a score processing module 405, and an identification and judgment module 406.

[0107] Among them, the data acquisition module 401 is used to acquire communication-related data collected from multiple SIM cards to be identified within a preset time period;

[0108] The first indicator processing module 402 is used to obtain, based on the communication-related data, whether multiple static data indicators corresponding to each mobile phone card have changed;

[0109] The second indicator processing module 403 is used to determine each target SIM card based on whether the multiple static data indicators have changed, wherein each target SIM card includes at least one indicator that a static data indicator has changed, and obtains the indicators that multiple behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator based on the communication-related data.

[0110] The third indicator processing module 404 is used to obtain the rate of change of network data indicators corresponding to each target SIM card based on the communication-related data.

[0111] The scoring processing module 405 is used to obtain the usage behavior score corresponding to each target SIM card based on the identifiers of whether the multiple static data indicators have changed, the identifiers of whether the multiple behavioral data indicators have changed, the change rate of each behavioral data indicator, and the change rate of the network data indicator.

[0112] The identification and judgment module 406 is used to make a judgment based on the usage behavior score corresponding to each target SIM card, and obtain the identification result of whether each target SIM card belongs to abnormal use.

[0113] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0114] In one possible design, the first indicator processing module 402 is specifically used to obtain, based on the communication-related data, a first identifier indicating whether the device corresponding to each SIM card has changed, a second identifier indicating whether the permanent location has changed, a third identifier indicating whether the frequently used base station has changed, and a fourth identifier indicating whether the home location has changed.

[0115] In one possible design, the second indicator processing module 403 is specifically used to obtain, based on the communication-related data, a fifth indicator indicating whether the location of each target SIM card has changed, a sixth indicator indicating whether the SMS message is normal, and a seventh indicator indicating whether the call is normal, as well as the location movement change rate, SMS behavior change rate, and call behavior change rate, for each target SIM card where at least one of the first, second, third, and fourth indicators has changed.

[0116] In one possible design, the third indicator processing module 404 is specifically used to perform data conversion and weighted processing based on the first identifier, the second identifier, the third identifier, the fourth identifier, the fifth identifier indicating whether the location has changed, the sixth identifier indicating whether the SMS is normal, the seventh identifier indicating whether the call is normal, as well as the change rate of location movement, the change rate of SMS behavior, the change rate of call behavior, and the change rate of network data indicators, to obtain the usage behavior score corresponding to each target SIM card.

[0117] In one possible design, the identification and judgment module 406 is specifically used to determine that the identification result of any target SIM card is not abnormal if the usage behavior score corresponding to any target SIM card is less than a preset abnormal threshold; and to determine that the identification result of any target SIM card is abnormal if the usage behavior score corresponding to any target SIM card is greater than or equal to the preset abnormal threshold.

[0118] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0119] Figure 5 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application. Figure 5 As shown, the computer device 50 in this embodiment includes: a processor 501 and a memory 502; wherein

[0120] Memory 502 is used to store instructions executed by the computer;

[0121] The processor 501 is configured to execute computer execution instructions stored in the memory to implement the various steps performed by the computer device in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments.

[0122] Alternatively, the memory 502 can be either standalone or integrated with the processor 501.

[0123] When the memory 502 is set up independently, the computer device also includes a bus 503 for connecting the memory 502 and the processor 501.

[0124] This application embodiment also provides a computer storage medium storing computer execution instructions. When the processor executes the computer execution instructions, the abnormal use identification method of the mobile phone card described above is implemented.

[0125] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements the mobile phone card abnormal usage identification method described above.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0127] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0128] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0129] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0130] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0131] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0132] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0133] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0134] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0135] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for identifying abnormal use of a mobile phone SIM card, characterized in that, Applied to computer equipment, including: Acquire communication-related data collected from multiple SIM cards to be identified within a preset time period; Based on the communication-related data, indicators of whether multiple static data indicators corresponding to each SIM card have changed are obtained; the multiple static data indicators include: indicators of whether the device corresponding to the SIM card has changed, indicators of whether the permanent residence area has changed, indicators of whether the frequently used base station has changed, and indicators of whether the home location has changed. Each target SIM card is determined based on whether the plurality of static data indicators have changed, wherein each target SIM card contains at least one indicator indicating that a static data indicator has changed; Based on the communication-related data, indicators of whether multiple behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator are obtained. The multiple behavioral data indicators include: indicators of whether the location has changed, indicators of whether the SMS is normal, and indicators of whether the call is normal. The change rates of the behavioral data indicators include: location movement change rate, SMS behavior change rate, and call behavior change rate. The location movement change rate is determined by multiplying the number of location changes by a preset location coefficient. The SMS behavior change rate is determined by multiplying the number of sensitive words appearing in the SMS by a preset SMS coefficient. The call behavior change rate is determined by multiplying the number of sensitive words appearing in the call by a preset call coefficient. Based on the communication-related data, the rate of change of network data indicators corresponding to each target SIM card is obtained; the rate of change of network data indicators is determined by the product of the number of times the public network address ownership changes and a preset network coefficient. Based on the identifiers indicating whether the multiple static data indicators have changed, the identifiers indicating whether the multiple behavioral data indicators have changed, the change rate of each behavioral data indicator, and the change rate of the network data indicator, the usage behavior score corresponding to each target SIM card is obtained. Based on the usage behavior scores corresponding to each target SIM card, a determination is made as to whether each target SIM card is being used abnormally.

2. The method according to claim 1, characterized in that, The step of obtaining indicators of whether multiple static data indicators corresponding to each SIM card have changed based on the communication-related data includes: Based on the communication-related data, obtain the first identifier of whether the device corresponding to each SIM card has changed, the second identifier of whether the permanent location has changed, the third identifier of whether the frequently used base station has changed, and the fourth identifier of whether the home location has changed.

3. The method according to claim 2, characterized in that, The step of identifying each target SIM card based on whether the plurality of static data indicators have changed, wherein each target SIM card includes at least one identifier indicating that a static data indicator has changed, and obtaining the identifiers indicating whether the plurality of behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator based on the communication-related data, includes: For each target SIM card where at least one of the first identifier, second identifier, third identifier, and fourth identifier has changed, a fifth identifier indicating whether the location of each target SIM card has changed, a sixth identifier indicating whether the SMS message is normal, and a seventh identifier indicating whether the call is normal are obtained based on the communication-related data, as well as the location movement change rate, SMS behavior change rate, and call behavior change rate.

4. The method according to claim 3, characterized in that, The usage behavior score for each target SIM card is obtained based on the identifiers indicating whether the multiple static data indicators have changed, the identifiers indicating whether the multiple behavioral data indicators have changed, the change rate of each behavioral data indicator, and the change rate of the network data indicator, including: Based on the first identifier, the second identifier, the third identifier, the fourth identifier, the fifth identifier indicating whether the location has changed, the sixth identifier indicating whether the SMS is normal, and the seventh identifier indicating whether the call is normal, as well as the change rates of location movement, SMS behavior, call behavior, and network data indicators, data conversion and weighting are performed to obtain the usage behavior score corresponding to each target SIM card.

5. The method according to any one of claims 1 to 4, characterized in that, The step of determining whether each target SIM card belongs to abnormal use based on the usage behavior score corresponding to each target SIM card includes: If the usage behavior score of any target SIM card is less than the preset abnormal threshold, then the identification result of any target SIM card is determined to be non-abnormal usage. If the usage behavior score of any target SIM card is greater than or equal to a preset abnormal threshold, then the identification result of any target SIM card is determined to be abnormal usage.

6. A device for identifying abnormal use of a mobile phone SIM card, characterized in that, include: The data acquisition module is used to acquire communication-related data collected from multiple SIM cards to be identified within a preset time period; The first indicator processing module is used to obtain the identifiers of whether multiple static data indicators corresponding to each mobile phone card have changed based on the communication-related data. The multiple static data indicators include: whether the device corresponding to the SIM card has changed, whether the permanent residence area has changed, whether the frequently used base station has changed, and whether the location of origin has changed. The second indicator processing module is used to determine each target SIM card based on whether the multiple static data indicators have changed, wherein each target SIM card contains at least one indicator indicating that a static data indicator has changed; based on the communication-related data, it obtains the indicators indicating whether multiple behavioral data indicators corresponding to each target SIM card have changed and the change rate of each behavioral data indicator; the multiple behavioral data indicators include: indicators of whether the location has changed, indicators of whether the SMS is normal, and indicators of whether the call is normal, and the change rate of the behavioral data indicators includes: location movement change rate, SMS behavior change rate, and call behavior change rate; wherein, the location movement change rate is determined by the product of the number of location changes and a preset location coefficient, the SMS behavior change rate is determined by the product of the number of sensitive words appearing in the SMS and a preset SMS coefficient, and the call behavior change rate is determined by the product of the number of sensitive words appearing in the call and a preset call coefficient; The third indicator processing module is used to obtain the rate of change of network data indicators corresponding to each target SIM card based on the communication-related data; the rate of change of network data indicators is determined by the product of the number of times the public network address ownership changes and a preset network coefficient. The scoring processing module is used to obtain the usage behavior score corresponding to each target SIM card based on the identifiers of whether the multiple static data indicators have changed, the identifiers of whether the multiple behavioral data indicators have changed, the change rate of each behavioral data indicator, and the change rate of the network data indicator. The identification and judgment module is used to judge based on the usage behavior score corresponding to each target SIM card to obtain the identification result of whether each target SIM card belongs to abnormal use.

7. The apparatus according to claim 6, characterized in that, The first indicator processing module is specifically used to obtain, based on the communication-related data, a first identifier indicating whether the device corresponding to each SIM card has changed, a second identifier indicating whether the permanent location has changed, a third identifier indicating whether the frequently used base station has changed, and a fourth identifier indicating whether the home location has changed.

8. The apparatus according to claim 7, characterized in that, The second indicator processing module is specifically used to obtain, based on the communication-related data, a fifth indicator indicating whether the location of each target SIM card has changed, a sixth indicator indicating whether the SMS is normal, and a seventh indicator indicating whether the call is normal, as well as the location movement change rate, SMS behavior change rate, and call behavior change rate, for each target SIM card where at least one of the first, second, third, and fourth indicators has changed.

9. A computer device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the mobile phone card abnormal use identification method as described in any one of claims 1 to 5.

10. A computer storage medium, characterized in that, The computer storage medium stores computer execution instructions. When the processor executes the computer execution instructions, it implements the mobile phone card abnormal use identification method as described in any one of claims 1 to 5.

Images