Abnormal terminal identification method, device and medium

Abstract

The application provides an abnormal terminal identification method, device and medium, relates to the technical field of communication, and is used for solving the problem that the prior art may not effectively identify abnormal terminals, and the method comprises the following steps: when it is found that there are mutually conflicting first terminals and second terminals in a network, respectively acquiring a first trust degree score of the first terminals and a second trust degree score of the second terminals; and identifying whether the first terminals or the second terminals are abnormal terminals according to the first trust degree score and the second trust degree score. The application realizes the identification of abnormal terminals by acquiring the trust degree scores of the first terminals and the second terminals when it is found that there are mutually conflicting first terminals and second terminals in a network, and abnormal terminals are identified without preset information, so that there is no risk of leakage or illegal acquisition of the preset information, the effect of abnormal terminal identification is improved, and the network communication security is improved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an abnormal terminal identification method, apparatus, and computer-readable storage medium. Background Technology

[0002] Once an unauthorized terminal device accesses a communication network, it can damage network security through malicious actions. If an unauthorized terminal user obtains information about a legitimate terminal and impersonates it to illegally register and access the communication network, it can pose significant risks and hidden dangers to the network.

[0003] Existing methods for preventing unauthorized terminal access require pre-setting terminal access information in the network and judging whether the accessing terminal is abnormal based on the pre-set information in order to identify whether it is an unauthorized terminal access. If the pre-set information is leaked or illegally obtained, abnormal terminals cannot be effectively identified. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the prior art by providing an abnormal terminal identification method, apparatus and computer-readable storage medium, so as to solve the problem that the prior art may not be able to effectively identify abnormal terminals.

[0005] In a first aspect, the present invention provides a method for identifying abnormal terminals, the method comprising:

[0006] When a conflicting first terminal and second terminal are detected in the network, the first trust score of the first terminal and the second trust score of the second terminal are obtained respectively.

[0007] The first trust score and the second trust score are used to identify whether the first terminal or the second terminal is an abnormal terminal.

[0008] Optionally, the discovery of conflicting first and second terminals in the network specifically includes:

[0009] When a network access registration request is received from the first terminal, the SIM card number of the first terminal is obtained;

[0010] Determine whether a second terminal with the same SIM card number exists in the network based on the SIM card number;

[0011] If so, then a conflicting first and second terminal is detected in the network.

[0012] Optionally, the step of identifying whether the first terminal or the second terminal is an abnormal terminal based on the first trust score and the second trust score specifically includes:

[0013] If Va ≥V b If the first terminal is identified as not being an abnormal terminal, then the authentication process is performed on the first terminal according to the access network registration request.

[0014] If V a <V b If the first terminal is identified as an abnormal terminal, the network access registration request will be rejected.

[0015] Among them, V a V is the first trust score for the first terminal. b The second trust score is given to the second terminal.

[0016] Optionally, obtaining the first trust score of the first terminal and the second trust score of the second terminal respectively specifically includes:

[0017] A first roaming score for the first terminal is obtained based on the first roaming data of the first terminal, and a second roaming score for the second terminal is obtained based on the second roaming data of the second terminal;

[0018] A first traffic score for the first terminal is obtained based on the first traffic data of the first terminal, and a second traffic score for the second terminal is obtained based on the second traffic data of the second terminal.

[0019] A first trust score for the first terminal is obtained based on the first roaming score and the first traffic score of the first terminal, and a second trust score for the second terminal is obtained based on the second roaming score and the second traffic score of the second terminal.

[0020] Optionally, obtaining the first roaming score of the first terminal based on the first roaming data of the first terminal, and obtaining the second roaming score of the second terminal based on the second roaming data of the second terminal, specifically includes:

[0021] The number of first roaming base stations connected to the first terminal is collected according to a preset time length T. a The number M of second roaming base stations connected to the second terminal b ;

[0022] M respectively a and M b Substitute into the following formula to calculate the first roaming score V of the first terminal. ma and the second roaming score V of the second terminal mb :

[0023]

[0024] In the formula, Vm The roaming score for the terminal is defined as follows: k1 is the preset maximum roaming score, M is the number of roaming base stations, and P1 is the preset standard value for the number of roaming base stations.

[0025] Optionally, obtaining the first traffic score of the first terminal based on the first traffic data of the first terminal, and obtaining the second traffic score of the second terminal based on the second traffic data of the second terminal, specifically includes:

[0026] Divide the preset busy period and preset idle period within a preset time length T;

[0027] Collect the average downlink traffic Q of the first terminal during the first busy period within the preset busy period. ma and the first idle hour average downlink flow Q within the preset idle period na and the second terminal's average downlink traffic Q during the second busy period within the preset busy period. mb and the second idle hour average downlink flow Q within the preset idle period nb ;

[0028] Q respectively ma Q na and Q mb Q nb Substitute into the following formula to calculate the first traffic score V of the first terminal. qa and the second traffic score V of the second terminal qb :

[0029] V q =k2*(Q m -Q n ) / Q m

[0030] In the formula, V q The terminal's traffic score is given by k2, where k2 is the preset maximum traffic score, and Q is the maximum traffic score. m Q represents the average downlink flow during the first busy period. n This represents the average downstream flow rate during the first off-peak period.

[0031] Optionally, obtaining a first trust score for the first terminal based on its first roaming score and first traffic score, and obtaining a second trust score for the second terminal based on its second roaming score and second traffic score, specifically includes:

[0032] With a preset time length T as the period, obtain the first roaming score V of the first terminal within n periods. mai and the second roaming score V of the second terminal mbi , i∈[0,n];

[0033] Using a preset time length T as the period, obtain the average value of the first traffic score of the first terminal within n periods. and the average of the second traffic score of the second terminal

[0034] V respectively mai , and V mbi , Substitute into the following formula to calculate the first trust score V of the first terminal. a and the second trust score V of the second terminal b :

[0035]

[0036] In the formula, V represents the trust score of the terminal, and α, β∈(0,1) are preset adjustment factors. mi For the roaming rating in the i-th cycle, The average value of the traffic score.

[0037] In a second aspect, the present invention provides an abnormal terminal identification device, comprising:

[0038] The acquisition module is used to acquire the first trust score of the first terminal and the second trust score of the second terminal respectively when a conflicting first terminal and second terminal are detected in the network.

[0039] The identification module, connected to the acquisition module, is used to identify whether the first terminal or the second terminal is an abnormal terminal based on the first trust score and the second trust score.

[0040] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the abnormal terminal identification method as described above.

[0041] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the abnormal terminal identification method described above.

[0042] This invention provides an abnormal terminal identification method, apparatus, and computer-readable storage medium. By identifying abnormal terminals when a conflicting first terminal and second terminal are discovered in the network, the trust scores of the first terminal and the second terminal are obtained respectively, thereby improving the effectiveness of abnormal terminal identification and thus enhancing network communication security. Attached Figure Description

[0043] Figure 1This is a flowchart of an abnormal terminal identification method according to an embodiment of the present invention;

[0044] Figure 2 This is a schematic diagram of the structure of an abnormal terminal identification device according to an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0046] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0047] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0048] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0049] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0050] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0051] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0052] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0053] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0054] To facilitate understanding of this invention, the problem of illegal terminal access in 5G (fifth-generation mobile communication technology) networks will be introduced first. 5G network is only one of the communication networks to which the method proposed in this application can be applied, and does not constitute a limitation.

[0055] Currently, to prevent unauthorized terminal devices from accessing the 5G network and causing damage to network security through malicious behavior, NAS (Network Attached Storage) signaling can be used to verify the SIM (Subscriber Identity Module) card information of the terminal during network registration and to perform security authentication on the terminal. Specifically, when the terminal initiates registration with the 5G network, it encrypts the SUPI (Subscriber Identity Permanent Identifier) ​​into a SUCI (Subscriber Identity Concealed Identifier). The AMF (Access and Mobility Management Function) forwards the SUCI to the AUSF (Authentication Server Function) and UDM (Unified Data Management) for authentication and obtains the decrypted SUPI. The AMF generates a 5G-GUTI (Globally Unique Temporary UE Identity) based on the SUPI and saves the mapping relationship for future registration or PDU (Protocol Data Unit) session requests, thus completing the terminal registration. However, if unauthorized users obtain information about legitimate terminals, they can impersonate legitimate terminals and illegally register and access the 5G network, posing significant risks and vulnerabilities. Current technology requires pre-setting terminal access information in the network to identify unauthorized terminal registration and access. If this pre-set information is leaked or illegally obtained, it cannot prevent abnormal terminal access. Although the SIM card identification code can also help determine the legitimacy of the terminal, and the identification code is unique, the network will normally verify the SIM card identification code. However, sometimes unauthorized terminals can bypass the identification code verification process, creating vulnerabilities that allow unauthorized terminals to access the network.

[0056] In view of this, this application proposes an abnormal terminal identification method that does not require any pre-setting of information or conditions in the network. Instead, it analyzes the daily usage behavior data of the terminal, calculates the terminal access trust level using a pre-set evaluation algorithm, and finally identifies the abnormal terminal, thus avoiding the risk of abnormal terminals accessing the network due to information leakage.

[0057] Example 1:

[0058] like Figure 1 As shown, Embodiment 1 of the present invention provides an abnormal terminal identification method, the method comprising:

[0059] S1. When a conflicting first terminal and second terminal are found in the network, the first trust score of the first terminal and the second trust score of the second terminal are obtained respectively.

[0060] S2. Identify whether the first terminal or the second terminal is an abnormal terminal based on the first trust score and the second trust score.

[0061] Specifically, in this embodiment, the method identifies abnormal terminals by obtaining the trust scores of the first and second terminals respectively when a conflicting first terminal and second terminal are found in the network. This method does not require pre-set information to identify abnormal terminals, and there is no risk of pre-set information being leaked or illegally obtained, which improves the effectiveness of abnormal terminal identification and thus improves network communication security.

[0062] Optionally, the discovery of conflicting first and second terminals in the network specifically includes:

[0063] When a network access registration request is received from the first terminal, the SIM card number of the first terminal is obtained;

[0064] Determine whether a second terminal with the same SIM card number exists in the network based on the SIM card number;

[0065] If so, then a conflicting first and second terminal is detected in the network.

[0066] Specifically, in this embodiment, taking a 5G network as an example, if an illegal terminal does not register its SIM card in the operator's information system before use, it generally needs to send a registration request to access the operator's network after restarting. Illegal terminals will impersonate normal terminals to access the operator's network. If two or more terminals with the same number are online in the network, it is highly likely that one of them is illegal. Therefore, when the 5G network receives a registration request from the first terminal A to access the network, before performing the 5G authentication process, it determines whether there is a second terminal with the same SIM card number online in the network. If so, the second terminal already online is marked as B, and the terminal access trust scoring process is executed. If there is no second terminal with the same SIM card number in the network, the registration request of the first terminal A is allowed, and the access process for the first terminal A is completed according to the 5G network access process.

[0067] Optionally, obtaining the first trust score of the first terminal and the second trust score of the second terminal respectively specifically includes:

[0068] A first roaming score for the first terminal is obtained based on the first roaming data of the first terminal, and a second roaming score for the second terminal is obtained based on the second roaming data of the second terminal;

[0069] A first traffic score for the first terminal is obtained based on the first traffic data of the first terminal, and a second traffic score for the second terminal is obtained based on the second traffic data of the second terminal.

[0070] A first trust score for the first terminal is obtained based on the first roaming score and the first traffic score of the first terminal, and a second trust score for the second terminal is obtained based on the second roaming score and the second traffic score of the second terminal.

[0071] Specifically, in this embodiment, the terminal trust score is obtained based on two dimensions: terminal roaming and terminal traffic usage. This is because normal terminals often exhibit certain patterns in these two dimensions. For example, they may engage in some roaming behavior but generally do not frequently change locations, and they may use traffic regularly but generally do not continuously use large amounts of traffic. In contrast, abnormal terminals may exhibit the opposite patterns to evade monitoring or commit illegal acts. Therefore, a trust score to determine whether a terminal is abnormal can be obtained based on the terminal's roaming and traffic data. Specifically, the access trust score V of the first terminal A and the second terminal B can be calculated by evaluating during network access. a V b According to V a V b Determine whether to allow the first terminal A to access the network, where the score value Va V b Can be rated by roaming V ma V mb and traffic rating V qa V qb Calculated.

[0072] Optionally, obtaining the first roaming score of the first terminal based on the first roaming data of the first terminal, and obtaining the second roaming score of the second terminal based on the second roaming data of the second terminal, specifically includes:

[0073] The number of first roaming base stations connected to the first terminal is collected according to a preset time length T. a The number M of second roaming base stations connected to the second terminal b ;

[0074] M respectively a and M b Substitute into the following formula to calculate the first roaming score V of the first terminal. ma and the second roaming score V of the second terminal mb :

[0075]

[0076] In the formula, V m The roaming score for the terminal is defined as follows: k1 is the preset maximum roaming score, M is the number of roaming base stations, and P1 is the preset standard value for the number of roaming base stations.

[0077] Specifically, in this embodiment, a terminal will normally have neither too many nor too few roaming base stations within a certain period of time; otherwise, the terminal may be an abnormal terminal. This is based on statistical analysis. Therefore, a preset time length T is used as a period, and within each period, the number M (M...) of roaming base stations for the first terminal A and the second terminal B is collected from the 5G network through data acquisition. a and M b The roaming rating is set to a score range of [0, k1], and the roaming rating V is calculated using Formula 1 above. m (V ma and V mbIn Formula 1 above, connecting to a certain number of roaming base stations is considered normal communication behavior, such as when the terminal user is traveling or on a business trip, and can be given a higher score. However, frequently changing roaming base stations may be an abnormal measure taken by illegal terminals to evade supervision, and therefore should be given a lower score. The specific definition of roaming can be divided according to region, city, province, or country. Alternatively, multiple base stations connected within the same roaming area can be considered as the same connection behavior. For example, if a user connects to multiple base stations within the same city's administrative area, it can be considered as the same connection behavior, and the number of roaming base stations at this time can be considered as 1. The purpose is to distinguish whether the terminal is frequently switching its displayed location. The specific definition method can be designed in combination with the needs of identifying anomalies.

[0078] Optionally, obtaining the first traffic score of the first terminal based on the first traffic data of the first terminal, and obtaining the second traffic score of the second terminal based on the second traffic data of the second terminal, specifically includes:

[0079] Divide the preset busy period and preset idle period within a preset time length T;

[0080] Collect the average downlink traffic Q of the first terminal during the first busy period within the preset busy period. ma and the first idle hour average downlink flow Q within the preset idle period na and the second terminal's average downlink traffic Q during the second busy period within the preset busy period. mb and the second idle hour average downlink flow Q within the preset idle period nb ;

[0081] Q respectively ma Q na and Q mb Q nb Substitute into the following formula to calculate the first traffic score V of the first terminal. qa and the second traffic score V of the second terminal qb :

[0082]

[0083] In the formula, V q The terminal's traffic score is given by k2, where k2 is the preset maximum traffic score, and Q is the maximum traffic score. m Q represents the average downlink flow during the first busy period. n This represents the average downstream flow rate during the first off-peak period.

[0084] Specifically, in this embodiment, the uplink traffic of the terminal is generally signaling interaction, with very small traffic volumes, making it difficult to analyze. Downlink traffic, however, varies significantly and can be used as an analytical indicator. Since the usage behavior of unauthorized terminals is generally automatic and does not distinguish between busy and off-peak hours, while the usage behavior of normal terminals typically distinguishes between busy and off-peak hours, this can be used as a reference indicator for determining whether a terminal is unauthorized. A common time period division is busy hours (08:00-23:00) and off-peak hours (23:00-08:00). Within a preset time length T, the terminal's traffic data is periodically collected daily according to busy and off-peak hours. Traffic data within multiple preset time lengths T can be collected to calculate the average traffic. The average downlink traffic Q of the first terminal A and the second terminal B is collected from the 5G network through data acquisition. m (Q ma and Q mb ) and Q n (Q na and Q nb The score range for the traffic flow rating is set to [0, k2]. For ease of calculation, k2 can be set to k1. The downlink average traffic flow rating V is calculated using the formula 2 above. q (V qa and V qb Downlink traffic can better reflect a user's willingness to use data. Normal users typically use more data during busy times and less during off-peak times. Therefore, in Formula 2 above, this type of data usage characteristic will result in a higher data score, and vice versa. Of course, the busy and off-peak times mentioned in this example are just examples. In practice, different time period divisions can be given based on the user profile characteristics of the end user. Data collection is not limited to downlink traffic; other types of traffic that need to be collected can also be set.

[0085] Optionally, obtaining a first trust score for the first terminal based on its first roaming score and first traffic score, and obtaining a second trust score for the second terminal based on its second roaming score and second traffic score, specifically includes:

[0086] With a preset time length T as the period, obtain the first roaming score V of the first terminal within n periods. mai and the second roaming score V of the second terminal mbi , i∈[0,n];

[0087] Using a preset time length T as the period, obtain the average value of the first traffic score of the first terminal within n periods. and the average of the second traffic score of the second terminal

[0088] V respectivelymai , and V mbi , Substitute into the following formula to calculate the first trust score V of the first terminal. a and the second trust score V of the second terminal b :

[0089]

[0090] In the formula, V represents the trust score of the terminal, and α, β∈(0,1) are preset adjustment factors. mi For the roaming rating in the i-th cycle, The average value of the traffic score.

[0091] Specifically, in this embodiment, a high roaming base station score indicates that the terminal is within a reasonable range of normal roaming behavior; a high downlink average traffic score indicates that the terminal distinguishes between busy and off-peak hours, which conforms to normal usage behavior; based on the comprehensive score of the above two indicators, the legitimacy of the terminal can be more reasonably determined; therefore, using the roaming score V calculated above... m and traffic rating V q The access trust score V(V) of the terminal is calculated using Formula 3 above. a and V b ), where V m V was obtained through calculations over multiple cycles. mi (V mai and V mbi Let be the roaming score for the i-th cycle, and the length of each cycle is a preset time length T. and The calculation method can calculate the flow score V within each preset time length T. q Then, the average traffic score over n periods is obtained as... Alternatively, the average flow score over n periods can be directly calculated as... By comparing user behavior metrics with those of legitimate terminals, a comprehensive analysis is conducted to determine whether a terminal is an illegitimate terminal.

[0092] Optionally, the step of identifying whether the first terminal or the second terminal is an abnormal terminal based on the first trust score and the second trust score specifically includes:

[0093] If V a ≥V b If the first terminal is identified as not being an abnormal terminal, then the authentication process is performed on the first terminal according to the access network registration request.

[0094] If V a <V bIf the first terminal is identified as an abnormal terminal, the network access registration request will be rejected.

[0095] Among them, V a V is the first trust score for the first terminal. b The second trust score is given to the second terminal.

[0096] Specifically, in this embodiment, the access trust score V calculated earlier is used to compare the access trust score values ​​of the first terminal A and the second terminal B. If V a ≥V b The network allows the first terminal A's access registration request, and the first terminal A continues to execute the 5G authentication process; if V a <V b If the first terminal A is deemed an abnormal terminal, the network will prohibit the access registration request of the first terminal A and prevent it from accessing the 5G network. If the first terminal A is deemed a normal terminal, corresponding measures can also be taken against the second terminal B. For example, the second terminal B can be deemed an abnormal terminal and required to exit the network connection, or other means can be used to continue to determine whether the second terminal B is an abnormal terminal before taking corresponding measures.

[0097] Furthermore, although this embodiment 1 uses the first terminal A as the abnormal terminal identification object and the terminal accessing the 5G network as the identification scenario, those skilled in the art can easily understand that there is no limiting relationship between the first terminal A and the second terminal B, and the method of the present invention can also be used to identify whether two or more conflicting terminals that are already connected to the network are abnormal terminals, etc.

[0098] The method described in Example 1 analyzes the daily usage behavior data of the terminal, calculates the terminal access trust level using a pre-set evaluation algorithm, and finally identifies abnormal terminals. This can prevent abnormal terminals from accessing the network due to information leakage and improve the security of network communication.

[0099] Example 2:

[0100] like Figure 2 As shown, Embodiment 2 of the present invention provides an abnormal terminal identification device, comprising:

[0101] The acquisition module 1 is used to acquire the first trust score of the first terminal and the second trust score of the second terminal respectively when a conflicting first terminal and second terminal are found in the network.

[0102] The identification module 2, connected to the acquisition module 1, is used to identify whether the first terminal or the second terminal is an abnormal terminal based on the first trust score and the second trust score.

[0103] Optionally, the acquisition module 1 includes a discovery unit for discovering conflicting first and second terminals in the network, specifically including:

[0104] The number acquisition subunit is used to acquire the SIM card number of the first terminal when a network access registration request is received from the first terminal;

[0105] The number determination subunit, connected to the number acquisition subunit, is used to determine whether a second terminal with the same SIM card number exists in the network based on the SIM card number.

[0106] A conflict determination subunit, connected to the determination number subunit, is used to detect, if yes, a conflicting first terminal and a conflicting second terminal exist in the network.

[0107] Optionally, the acquisition module 1 includes a scoring unit, used to acquire a first trust score for the first terminal and a second trust score for the second terminal, specifically including:

[0108] A roaming rating unit is used to obtain a first roaming rating of the first terminal based on the first roaming data of the first terminal, and to obtain a second roaming rating of the second terminal based on the second roaming data of the second terminal;

[0109] A traffic scoring unit is used to obtain a first traffic score of the first terminal based on the first traffic data of the first terminal, and to obtain a second traffic score of the second terminal based on the second traffic data of the second terminal.

[0110] A trust rating unit, connected to the roaming rating unit and the traffic rating unit, is used to obtain a first trust rating of the first terminal based on the first roaming rating and the first traffic rating of the first terminal, and to obtain a second trust rating of the second terminal based on the second roaming rating and the second traffic rating of the second terminal.

[0111] Optionally, the roaming rating unit specifically includes:

[0112] The first collection subunit is used to collect the number M of the first roaming base stations connected to the first terminal according to a preset time length T. a The number M of second roaming base stations connected to the second terminal b ;

[0113] The first computing unit, connected to the first collecting subunit, is used to respectively process M a and M b Substitute into the following formula to calculate the first roaming score V of the first terminal. ma and the second roaming score V of the second terminalmb :

[0114]

[0115] In the formula, V m The roaming score for the terminal is defined as follows: k1 is the preset maximum roaming score, M is the number of roaming base stations, and P1 is the preset standard value for the number of roaming base stations.

[0116] Optionally, the traffic scoring unit specifically includes:

[0117] The time period sub-unit is used to divide the preset busy period and preset idle period within a preset time length T;

[0118] The second collection subunit, connected to the time-segmentation subunit, is used to collect the first terminal's average downlink traffic Q during the first busy period within a preset busy time period. ma and the first idle hour average downlink flow Q within the preset idle period na and the second terminal's average downlink traffic Q during the second busy period within the preset busy period. mb and the second idle hour average downlink flow Q within the preset idle period nb ;

[0119] The second calculation subunit, connected to the second collection subunit, is used to respectively calculate Q ma Q na and Q mb Q nb Substitute into the following formula to calculate the first traffic score Vqa of the first terminal and the second traffic score V of the second terminal. qb :

[0120] V q =k2*(Q m -Q n ) / Q m

[0121] In the formula, V q The terminal's traffic score is given by k2, where k2 is the preset maximum traffic score, and Q is the maximum traffic score. m Q represents the average downlink flow during the first busy period. n This represents the average downstream flow rate during the first off-peak period.

[0122] Optionally, the trust rating unit specifically includes:

[0123] The first cycle acquisition subunit is used to acquire the first roaming score V of the first terminal within a preset time length T. mai and the second roaming score V of the second terminal mbi , i∈[0,n];

[0124] The second cycle acquisition subunit is used to acquire the average value of the first traffic score of the first terminal within a preset time period T. and the average of the second traffic score of the second terminal

[0125] The third calculation subunit, connected to the first periodic acquisition subunit and the second periodic acquisition subunit, is used to respectively calculate V mai , and Substitute into the following formula to calculate the first trust score V of the first terminal. a and the second trust score V of the second terminal b :

[0126]

[0127] In the formula, V represents the trust score of the terminal, and α, β∈(0,1) are preset adjustment factors. mi For the roaming rating in the i-th cycle, The average value of the traffic score.

[0128] The apparatus described in Example 2 corresponds to the method described in Example 1, and Example 2 can be understood in conjunction with Example 1.

[0129] Example 3:

[0130] like Figure 3 As shown, Embodiment 3 of the present invention provides a computer device, including a memory 10 and a processor 20. The memory 10 stores a computer program. When the processor 20 runs the computer program stored in the memory 10, the processor 20 executes the abnormal terminal identification method as described in Embodiment 1.

[0131] The memory 10 is connected to the processor 20. The memory 10 can be a flash memory, a read-only memory, or another type of memory. The processor 20 can be a central processing unit or a microcontroller.

[0132] Example 3 provides a computer device for identifying abnormal terminals by acquiring a trust score, thereby effectively identifying abnormal terminals accessing the communication network and improving network communication security.

[0133] Example 4:

[0134] Embodiment 4 of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the abnormal terminal identification method as described in Embodiment 1.

[0135] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0136] Example 4 provides a computer-readable storage medium for identifying abnormal terminals by acquiring trust scores, thereby effectively identifying abnormal terminals accessing the communication network and improving network communication security.

[0137] Embodiments 1-4 of the present invention provide an abnormal terminal identification method, device and computer-readable storage medium. By obtaining the trust scores of the first terminal and the second terminal respectively when a conflicting first terminal and second terminal are found in the network, the abnormal terminal is identified, thereby improving the effect of abnormal terminal identification and improving network communication security.

[0138] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal terminals, characterized in that, The method includes: When a registration request to access the network is received from a first terminal using a SIM card that has not been pre-registered in the operator's information system, it is determined whether a second terminal with the same SIM card number as the first terminal exists in the network. If so, the first access trust score of the first terminal and the second access trust score of the second terminal are obtained based on the terminal's roaming status and data usage, respectively, including: The number of first roaming base stations connected to the first terminal is collected according to a preset time length T. Number of second roaming base stations connected to the second terminal , respectively by and Calculate the first roaming score of the first terminal and the second roaming score of the second terminal , Within a preset time period T, a preset busy period and a preset idle period are divided, and the average downlink traffic of the first terminal during the first busy period within the preset busy period is collected. and the first idle hour average downlink flow within the preset idle period and the second terminal's average downlink traffic during the second busy period within the preset busy period. and the second off-peak average downlink flow rate within the preset off-peak period , respectively and Substitute into the following formula to calculate the first traffic score of the first terminal. and the second traffic score of the second terminal : In the formula, Score the traffic of the terminal. The preset maximum traffic score, This represents the average downlink traffic during peak hours. This refers to the average downlink flow rate during off-peak hours. With a preset time length T as the period, obtain The first roaming score of the first terminal within a certain period and the second roaming score of the second terminal , With a preset time length T as the period, obtain The average value of the first traffic score of the first terminal within each period and the average of the second traffic score of the second terminal , respectively and Substitute into the following formula to calculate the first access trust score of the first terminal. and the second access trust score of the second terminal : In the formula, V represents the terminal's access trust score. As a preset adjustment factor, For the first Roaming ratings for each cycle, The average value of the traffic score; Based on the first access trust score and the second access trust score, one of the first terminal or the second terminal is identified as an abnormal terminal and the other as a normal terminal. The abnormal terminal is prevented from accessing the network, while the normal terminal is allowed to access the network.

2. The method according to claim 1, characterized in that, The discovery of a first terminal and a second terminal with the same SIM card number in the network specifically includes: When a network access registration request is received from the first terminal, the SIM card number of the first terminal is obtained; Determine whether a second terminal with the same SIM card number exists in the network based on the SIM card number; If so, then a conflicting first and second terminal is detected in the network.

3. The method according to claim 2, characterized in that, The step of identifying whether the first terminal or the second terminal is an abnormal terminal based on the first access trust score and the second access trust score specifically includes: like If the first terminal is identified as not being an abnormal terminal, then the authentication process is performed on the first terminal according to the access network registration request. like If the first terminal is identified as an abnormal terminal, the network access registration request will be rejected. in, The first access trust score is given to the first terminal. The second access trust score is given to the second terminal.

4. An abnormal terminal identification device, characterized in that, include: The acquisition module is used to determine whether a second terminal with the same SIM card number as the first terminal exists in the network when a first terminal sends a registration request to access the network using a SIM card that has not been registered in the operator's information system in advance. If so, it acquires the first access trust score of the first terminal and the second access trust score of the second terminal based on the terminal's roaming status and data usage, respectively. Specifically, this includes: The roaming scoring unit is used to collect the number of first roaming base stations connected to the first terminal according to a preset time length T. Number of second roaming base stations connected to the second terminal respectively by and Calculate the first roaming score of the first terminal and the second roaming score of the second terminal , The traffic scoring unit is used to divide a preset busy period and a preset idle period within a preset time length T, and to collect the average downlink traffic of the first terminal during the first busy period within the preset busy period. and the first idle hour average downlink flow within the preset idle period and the second terminal's average downlink traffic during the second busy period within the preset busy period. and the second off-peak average downlink flow rate within the preset off-peak period , respectively and Substitute into the following formula to calculate the first traffic score of the first terminal. and the second traffic score of the second terminal : In the formula, Score the traffic of the terminal. The preset maximum traffic score, This represents the average downlink traffic during peak hours. This refers to the average downlink flow rate during off-peak hours. The trust rating unit, connected to the roaming rating unit and the traffic rating unit, is used to obtain [data / information] at a preset time period T. The first roaming score of the first terminal within a certain period and the second roaming score of the second terminal , With a preset time length T as the period, obtain The average value of the first traffic score of the first terminal within each period and the average of the second traffic score of the second terminal , respectively and Substitute into the following formula to calculate the first access trust score of the first terminal. and the second access trust score of the second terminal : In the formula, V represents the terminal's access trust score. As a preset adjustment factor, For the first Roaming ratings for each cycle, The average value of the traffic score; The identification module, connected to the acquisition module, is used to identify one of the first terminal or the second terminal as an abnormal terminal and the other as a normal terminal based on the first access trust score and the second access trust score, thereby preventing the abnormal terminal from accessing the network and allowing the normal terminal to access the network.

5. A computer device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the abnormal terminal identification method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the abnormal terminal identification method as described in any one of claims 1-3.

Images