Iot card risk identification method, device and equipment and storage medium

Abstract

The application provides a kind of Internet of Things card risk identification method, device, equipment and storage medium, the method comprises: according to the original data of the multiple Internet of Things cards collected, extract features and corresponding characteristic values, and the characteristic value corresponding to feature is washed, according to preset algorithm, all features are screened, obtain candidate features, obtain the characteristic value of each cleaned candidate feature, input each cleaned characteristic value into normalization function to obtain each normalized characteristic value, according to all normalized characteristic values, calculate the risk coefficient of each Internet of Things card, according to the risk coefficient of multiple Internet of Things cards, divide the risk level of each Internet of Things card, output the risk level of multiple Internet of Things cards.The application calculates the normalized characteristic value of the characteristic value according to the characteristic value of the candidate feature, without calculating the maximum value and minimum value of the feature, so that the normalization process is not affected by the new characteristic value of the Internet of Things card, reduces the amount of data calculation, and further improves the efficiency of risk identification.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to an IoT card risk identification method, apparatus, device, and storage medium. Background Technology

[0002] The Internet of Things (IoT) is gradually being applied in various fields such as industry, agriculture, transportation, energy, and smart cities. Nowadays, with the diversification of business scenarios, IoT cards have encountered many risks and hidden dangers in the sales and use process. Therefore, it is crucial to identify the risks of IoT cards.

[0003] In existing technologies, the maximum and minimum value standardization method is usually used to limit the feature data to a certain range, and then the risk parameters of the IoT card are calculated based on the standardized feature data to achieve risk identification of the IoT card.

[0004] However, in existing technologies, as new feature data is added, the maximum and minimum values ​​will change, requiring the redefinition of standardized variables, which increases the computational load and leads to inefficiency in risk identification. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for identifying risks associated with Internet of Things (IoT) cards, in order to solve the problem of low risk identification efficiency caused by changes in the maximum and minimum values ​​of features as new feature values ​​are added to IoT cards.

[0006] Firstly, this application provides a method for identifying risks associated with Internet of Things (IoT) cards, including:

[0007] Based on the raw data collected from multiple IoT cards, features and corresponding feature values ​​are extracted, and the feature values ​​corresponding to the features are cleaned to obtain cleaned feature values.

[0008] All features are filtered according to a preset algorithm to obtain candidate features.

[0009] Obtain the cleaned feature values ​​of the candidate features, input the cleaned feature values ​​into a normalization function to calculate the normalized feature values, and summarize the normalized feature values ​​to obtain all the normalized feature values.

[0010] Based on all the normalized eigenvalues, calculate the risk coefficient for each IoT card.

[0011] The risk level of each IoT card is determined based on the risk coefficient of multiple IoT cards.

[0012] Output the risk level of the multiple IoT cards.

[0013] In one possible design, the step of inputting the cleaned feature values ​​into a normalization function to calculate the normalized feature values ​​includes: calculating the normalized feature values ​​based on the formula of the normalization function according to the cleaned feature values.

[0014] In one possible design, the step of filtering all features according to a preset algorithm to obtain candidate features includes:

[0015] All the features are defined as a feature set. Each feature in the feature set is used as an initial candidate set and input into a preset evaluation model to obtain an evaluation score for each candidate set. The candidate set with the highest evaluation score is determined, and the features in the candidate set with the highest evaluation score are identified as target features. The target features are then deleted from the feature set to obtain an updated feature set. The target features and any feature from the updated feature set are used as a new candidate set, and the new candidate set is input into the preset evaluation model to obtain an evaluation score for each new feature candidate set. Obtain a new candidate set with the highest evaluation score. If the evaluation score of the new candidate set with the highest evaluation score is greater than that of the candidate set with the highest evaluation score calculated previously, repeat the process of identifying the features in the new candidate set with the highest evaluation score as target features and deleting the target features from the feature set to obtain an updated feature set. Take any feature from the target features and the updated feature set as a new candidate feature and input the new candidate feature set into the preset evaluation model. Continue this process until the evaluation score of the new candidate set with the highest evaluation score is less than that of the candidate set with the highest evaluation score calculated previously. Then, identify the features in the candidate set with the highest evaluation score calculated previously as candidate features.

[0016] In one possible design, calculating the risk coefficient of each IoT SIM card based on all the normalized eigenvalues ​​includes: calculating the difference coefficient of each eigenvalue based on all the normalized eigenvalues; calculating the information entropy of each eigenvalue based on the difference coefficient of each eigenvalue; calculating the independence weight of each eigenvalue based on the information entropy of each eigenvalue; and calculating the risk coefficient of each IoT SIM card based on the independence weight of each eigenvalue and the eigenvalue of each IoT SIM card.

[0017] In one possible design, classifying the risk level of each IoT SIM card based on its risk coefficient includes: if the risk coefficient is within a first preset range, then the IoT SIM card is determined to be at a low risk level; if the risk coefficient is within a second preset range, then the IoT SIM card is determined to be at a medium risk level; and if the risk coefficient is within a third preset range, then the IoT SIM card is determined to be at a high risk level.

[0018] In one possible design, before classifying the risk level of each IoT card based on its risk coefficients, the method further includes: performing a KS test on the risk coefficients of the multiple IoT cards to obtain a p-value. If the p-value is greater than a preset significance level, it is determined that the risk coefficients of the multiple IoT cards follow a normal distribution. If the p-value is not greater than the preset significance level, it is determined that the risk coefficients of the multiple IoT cards do not follow a normal distribution, and a new independence weight is selected.

[0019] In one possible design, selecting new independence weights includes: calculating a skewness coefficient based on the risk coefficients of the multiple IoT cards. If the skewness coefficient is greater than 1 or less than -1, it is determined to be a highly skewed distribution, and the independence weight of each feature is taken as the logarithm to the base 10 as the new independence weight. If the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the independence weight of each feature is taken as the natural logarithm as the new independence weight. If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the independence weight of each feature is taken as the new independence weight.

[0020] Secondly, this application provides an IoT card risk identification device, comprising:

[0021] The feature cleaning module is used to extract features and corresponding feature values ​​from the raw data collected from multiple IoT cards, and to clean the feature values ​​corresponding to the features to obtain cleaned feature values.

[0022] The feature selection module is used to filter all features according to a preset algorithm to obtain candidate features;

[0023] The normalization calculation module is used to obtain the cleaned feature values ​​of the candidate features, input the cleaned feature values ​​into the normalization function to calculate the normalized feature values, and summarize the normalized feature values ​​to obtain all the normalized feature values.

[0024] The risk coefficient calculation module is used to calculate the risk coefficient of each IoT card based on all the normalized feature values.

[0025] The risk level calculation module is used to classify the risk level of each IoT card based on the risk coefficients of multiple IoT cards;

[0026] The output module is used to output the risk level of the multiple IoT cards.

[0027] Thirdly, this application provides a computer device, including: at least one processor and a memory;

[0028] The memory stores computer-executed instructions;

[0029] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the IoT card risk identification method as described in the first aspect and various possible designs of the first aspect.

[0030] Fourthly, this application provides a computer storage medium storing computer execution instructions, which, when executed by a processor, implement the IoT card risk identification method described in the first aspect and various possible designs of the first aspect.

[0031] The IoT card risk identification method, apparatus, device, and storage medium provided in this application collect raw data from the IoT card, obtain candidate features and corresponding feature values ​​based on the raw data, and calculate the normalized feature value of the feature value itself through the candidate features and corresponding feature values. It does not require calculating the maximum and minimum values ​​of the features, so that the normalization process is not affected by the newly added feature values ​​of the IoT card, reducing the amount of data calculation and thus improving the efficiency of IoT card risk identification. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a schematic diagram illustrating an application scenario of the IoT card risk identification method provided in this application embodiment;

[0034] Figure 2 Flowchart of the IoT card risk identification method provided in this application embodiment Figure 1 ;

[0035] Figure 3 Flowchart of the IoT card risk identification method provided in this application embodiment Figure 2;

[0036] Figure 4 This is a schematic diagram of the structure of the IoT card risk identification device provided in the embodiments of this application;

[0037] Figure 5 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0040] With the widespread application of the Internet of Things (IoT) in various fields such as industry, agriculture, transportation, energy, and smart cities, and the diversification of business scenarios, numerous risks and hidden dangers have emerged in the sales and use of IoT SIM cards. Current technologies commonly employ a maximum-minimum-value standardization method to limit the collected physical network card (NIC) characteristic values ​​to a certain range, and then calculate the IoT SIM card's risk parameters based on these standardized characteristic values ​​to achieve risk identification. However, with the addition of new characteristic values ​​to the IoT SIM card, the maximum and minimum values ​​may change, requiring the redefinition of standardized variables, increasing computational load, and thus reducing the efficiency of risk identification.

[0041] To address the aforementioned technical problems, this application proposes the following technical approach: The inventors envision designing a normalization function that calculates the normalized feature value using only the feature value itself, without needing to calculate the maximum and minimum values. This ensures the normalization process is unaffected by new feature values ​​from the IoT card, thereby improving the efficiency of risk identification. Detailed embodiments are described below.

[0042] Figure 1 This is a schematic diagram illustrating an application scenario of the IoT card risk identification method provided in this application embodiment. For example... Figure 1As shown, the system provided in this embodiment includes: computer equipment 101, IoT card 102, and risk identification platform 103.

[0043] The computer device 102 can be a single server or a service cluster consisting of multiple servers.

[0044] The computer device 101 extracts features and corresponding feature values ​​from the raw data collected from multiple IoT cards 102, calculates the risk level based on the features and corresponding data, and finally outputs the risk level of the IoT card 102 to the risk identification platform 103, so that the risk identification platform 103 can promptly handle the physical network card 102 that has a risk.

[0045] Figure 2 Flowchart of the IoT card risk identification method provided in this application embodiment Figure 1 The execution entity in this embodiment can be Figure 1 The computer equipment shown in the illustrated embodiment is not specifically limited in this embodiment. Figure 2 As shown, the method includes:

[0046] S201: Based on the raw data collected from multiple IoT cards, extract features and corresponding feature values, and clean the feature values ​​corresponding to the features to obtain cleaned feature values.

[0047] Specifically, various types of raw data from the IoT data platform are collected through APIs (Application Programming Interfaces).

[0048] The various types of raw data may include one or more of the following: real-time billing data, real-time usage data, connection service data, call data, and real-time internet access log data.

[0049] In this embodiment, various types of raw data are imported into the Spark tool for distributed computing to clean and transform the raw data. The cleaning of the various types of raw data includes:

[0050] I. Removing Completely Duplicate Original Data. Use the `count` and `distinct().count()` methods to obtain the total number of rows in the dataset and the number of rows after removing duplicates to determine if completely duplicate original data exists. Directly call the `dropDuplicates` method to remove completely duplicate rows. II. Handling Null Values. The original data may contain some features for which no data was collected. Use the `agg` function to operate on multiple columns of feature values, check the missing feature percentage for each column, and delete features with a missing percentage exceeding 70%. Alternatively, a threshold can be set, and the DataFrame API can be used to filter IoT cards with more than a certain number of missing feature values. Null values ​​can also be handled by imputing feature values. Imputation methods include: imputing the mean, median, mode, or training a model to predict based on other features.

[0051] S202: Filter all features according to the preset algorithm to obtain candidate features.

[0052] Specifically, step S202 includes Sa to Se:

[0053] Sa: Define all features as a feature set.

[0054] For example, the extracted features of the IoT card include Y1, Y2, ..., Y n Each feature includes m feature values. All features of the IoT cards are defined as a feature set, i.e., G = {Y1, Y2, ..., Y...}. n}

[0055] Sb: Each feature in the feature set is used as an initial candidate set and input into the preset evaluation model to obtain the evaluation score of each candidate set.

[0056] The preset evaluation model can be trained by the following method: obtaining feature sample data, which includes a large number of features and the corresponding label scores; and iteratively training the initial evaluation model based on the features and the corresponding label scores in the sample data to obtain the preset evaluation model.

[0057] Alternatively, the initial evaluation model can be a deep learning classifier.

[0058] For example, the features Y1, Y2, ..., Y of the IoT card are... n They are respectively designated as candidate sets G1, G2, ..., G n Input a preset evaluation model to obtain n evaluation scores.

[0059] Where G1={Y1}, G2={Y2},….,G n={Y n}

[0060] Sc: Determine the candidate set with the highest evaluation score, identify the features in the candidate set with the highest evaluation score as the target features, and delete the target features from the feature set to obtain the updated feature set.

[0061] For example, if candidate set G1 has the highest evaluation score, then feature Y1 in candidate set G1 is determined as the target feature. Simultaneously, Y1 is deleted from feature set G, resulting in an updated feature set G = {Y2, ..., Y...}. n}

[0062] Sd: Take any feature from the target feature and the updated feature set as a new candidate set, and input the new candidate set into the preset evaluation model to obtain the evaluation score of each new feature candidate set.

[0063] For example, from the updated feature set G = {Y2, ..., Y} n Choose one feature and the target feature Y1 from the set G1, G2, ..., G2 as a new candidate set. n-1 Input a preset evaluation model to obtain n-1 evaluation scores.

[0064] Where G1={Y1,Y2}, G2={Y1,Y3},….,G n ={Y1,Y n}

[0065] Se: Obtain the new candidate set with the highest evaluation score. If the evaluation score of the new candidate set with the highest evaluation score is greater than that of the candidate set with the highest evaluation score calculated in the previous calculation, repeat the process of determining the features in the new candidate set with the highest evaluation score as target features and deleting the target features from the feature set to obtain an updated feature set. Take any feature from the target features and the updated feature set as a new candidate feature and input the new feature candidate set into the preset evaluation model. Continue until the evaluation score of the new candidate set with the highest evaluation score is less than that of the candidate set with the highest evaluation score calculated in the previous calculation. Then, determine the features in the candidate set with the highest evaluation score calculated in the previous calculation as candidate features.

[0066] For example, if the candidate set G2 = {Y1, Y3} has the highest evaluation score, and the evaluation score of G2 = {Y1, Y3} is higher than that of the candidate set G1 = {Y1} with the highest evaluation score in the previous calculation, then features Y1 and Y3 in the candidate set G2 are determined as target features. Simultaneously, Y3 is deleted from the feature set G, resulting in the updated feature set G = {Y2, Y4, ..., Y...}. n}

[0067] Repeat the process of selecting one feature and the target feature from the updated feature set G as a new candidate set, inputting the preset evaluation model, and selecting the feature from the candidate set with the highest evaluation score that is higher than the previous highest evaluation score as the target feature.

[0068] If, in the (k+1)th iteration, one feature and the target feature are randomly selected from the updated feature set G as a new candidate set, and input into a pre-defined evaluation model, the evaluation scores of the nk candidate sets are obtained. Among these, the evaluation score of the candidate set with the highest evaluation score is no higher than the highest evaluation score obtained in the kth iteration. Then, the feature in the candidate set with the highest evaluation score determined in the kth iteration is selected as the candidate feature, where k... <n。

[0069] S203: Obtain the cleaned feature values ​​of each candidate feature, input each cleaned feature value into the normalization function to calculate each normalized feature value, summarize each normalized feature value to obtain all normalized feature values.

[0070] Specifically, in step S203, the process of inputting each cleaned feature value into a normalization function to calculate each normalized feature value includes: if there are n candidate features... ′ There are *m* features, each with *m* feature values. Based on the cleaned feature values, the normalized feature values ​​are calculated using the following formula of the normalization function:

[0071]

[0072] In the formula, i <n ′ ,j <m,x ij Let X be the j-th feature value of the i-th feature after cleaning. ij It is the normalized eigenvalue of the j-th eigenvalue of the i-th feature.

[0073] S204: Calculate the risk coefficient for each IoT card based on all normalized eigenvalues.

[0074] Specifically, step S204 includes Sf to Si:

[0075] Sf: Calculate the difference coefficient for each eigenvalue based on all normalized eigenvalues.

[0076] Wherein, the difference coefficient of each normalized eigenvalue represents the proportion p of the j-th eigenvalue corresponding to the i-th eigenvalue among all eigenvalues ​​corresponding to the i-th eigenvalue. ij The formula for calculating is as follows:

[0077]

[0078] In the formula, X ijThis represents the j-th feature value corresponding to the i-th feature after normalization, where i takes the value 1, 2, 3, ..., n. ′ .

[0079] Sg: The information entropy of each feature is calculated based on the difference coefficient of each feature value.

[0080] Specifically, the information entropy E of the i-th feature i The calculation formula is as follows:

[0081]

[0082] In the formula, i takes values ​​of 1, 2, 3, ..., n ′ .

[0083] Sh: Calculate the independence weight of each feature based on the information entropy of each feature.

[0084] Specifically, the independence weight ω of the i-th feature i The calculation formula is as follows:

[0085]

[0086] In the formula, i takes values ​​of 1, 2, 3, ..., n ′ .

[0087] Si: The risk coefficient of each IoT card is calculated based on the independence weight of each feature and the feature value of each IoT card.

[0088] Specifically, the independence weights corresponding to each feature are multiplied by the normalized feature values ​​corresponding to each feature to obtain the partial feature weight values ​​of each IoT card. The partial feature weight values ​​of each IoT card are then summed to obtain the risk coefficient of each IoT card.

[0089] For example, the risk coefficient f of the j-th IoT card j The calculation formula is as follows:

[0090]

[0091] In the formula, Y ij Let represent the normalized feature value corresponding to the i-th feature of the j-th IoT card, where j takes the value 1, 2, 3, ..., m.

[0092] S205: Based on the risk coefficients of multiple IoT cards, classify the risk level of each IoT card.

[0093] Specifically, if the risk coefficient is within a first preset range, the IoT card is classified as low-risk. If the risk coefficient is within a second preset range, the IoT card is classified as medium-risk. If the risk coefficient is within a third preset range, the IoT card is classified as high-risk.

[0094] Here, the calculation methods for the first preset range, the second preset range, and the third preset range are as follows:

[0095] First, calculate the average μ and variance σ of the replacement risk coefficients for multiple IoT cards. 2 The calculation formula is as follows:

[0096]

[0097]

[0098] In the formula, f j Let be the risk coefficient of the j-th IoT card, and m be the total number of IoT cards.

[0099] The first preset range is the risk coefficient f. j Satisfying μ-σ <f j <μ+σ, the second preset range is the risk coefficient f j Satisfying μ-2σ <f j <μ+2σ, the third preset range is the risk coefficient f j Satisfy f j <μ-2σ or f j >μ+2σ.

[0100] S206: Output the risk level of multiple IoT cards.

[0101] Specifically, the risk level of the IoT card is sent to the risk identification platform, so that the risk identification platform can issue a warning to the device where the IoT card is located if it is at medium risk, and cancel or block the IoT card if it is at high risk.

[0102] The IoT card risk identification method provided in this embodiment collects the original data of the IoT card, obtains candidate features and corresponding feature values ​​based on the original data, and calculates the normalized feature value of the feature value itself through the candidate features and corresponding feature values. It does not require calculating the maximum and minimum values ​​of the features, so that the normalization process is not affected by the newly added feature values ​​of the IoT card, reducing the amount of data calculation and thus improving the efficiency of IoT card risk identification.

[0103] Figure 3 Flowchart of the IoT card risk identification method provided in this application embodiment Figure 2In this embodiment of the application, the specific implementation method for determining whether the risk coefficients of multiple IoT cards satisfy a normal distribution and how to adjust parameters to make the risk coefficients of multiple IoT cards satisfy a normal distribution is described in detail before S205. For example... Figure 3 As shown, the method includes:

[0104] S301: Perform the KS test on the risk coefficients of the multiple IoT cards to obtain the p_value.

[0105] The KS test is a non-parametric test commonly used to determine whether a sample conforms to a pre-given distribution, or whether the probability distributions of two samples are different. In other words, it checks whether it is reliable to claim that an observed sample follows a certain distribution.

[0106] Specifically, it is determined whether the risk coefficient of the IoT card follows (μ, σ). 2 Given a normal distribution, write down the hypothesis:

[0107] H0: Risk coefficient X ~ N(μ,σ) 2 )

[0108] H1: The risk coefficient does not follow the distribution shown above.

[0109] The risk factors for replacing IoT SIM cards are ranked from lowest to highest, according to a table. That is, the rejection region of H0 Where m is the total number of IoT cards, and D is calculated using the following formula:

[0110] d k1 =|F n (x k )-F0(x k )|

[0111] d k2 =|F n (x k )-F0(x k-1 )|

[0112] δ k =max(d k1 ,d k2 )

[0113] D = max(δ) k )

[0114] Among them, F n (x) = N / m, where N is the cumulative number of times. The existing function in Excel, =NORM.DIST(x,μ,σ,TRUE), is used to calculate F0(x), where x is the replacement risk coefficient of the IoT card.

[0115] S302: Determine if the p-value is greater than the significance level. If yes, proceed to S303; otherwise, proceed to S304.

[0116] The preset significance level is 0.05.

[0117] S303: Determine that the risk coefficients of multiple IoT cards follow a normal distribution;

[0118] S304: Select new independence weights.

[0119] Specifically, if p_value > 0.05, that is... Determine if the risk coefficient follows a normal distribution. If p_value < 0.05, that is... If the risk coefficient does not conform to a normal distribution, a new independence weight is selected. Specifically, step S304 includes Sj-Sk:

[0120] Sj: Calculate the skewness coefficient based on the risk coefficients of multiple IoT cards.

[0121] Specifically, the formula for calculating the skewness coefficient SK is as follows:

[0122]

[0123]

[0124] Where m is the total number of IoT cards, and x is the risk coefficient of the IoT cards. denoted as the average risk coefficient of multiple IoT cards, and s is the standard deviation of the risk coefficients of multiple IoT cards.

[0125] Sk: If the skewness coefficient is greater than 1 or less than -1, it is determined to be a highly skewed distribution, and the independence weight of each feature is taken as the logarithm to the base 10 as the new independence weight.

[0126] Specifically, the new independence weight ω i The calculation formula is as follows:

[0127]

[0128] If the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the natural logarithm of the independence weight of each feature is taken as the new independence weight.

[0129] Specifically, the new independence weight ω i The calculation formula is as follows:

[0130]

[0131] If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the independence weight of each feature is used as the new independence weight.

[0132] Specifically, the new independence weight ω i The calculation formula is as follows:

[0133]

[0134] The IoT card risk identification method provided in this embodiment obtains the p_value by performing a KS test on the risk coefficient of the IoT card, and then determines whether the risk coefficient of the IoT card meets the normal distribution, thereby determining whether the calculated risk coefficient of the IoT card is valid. By adjusting the independence weights of each feature to process the normally distributed data, the validity of the risk coefficient of the IoT card is guaranteed.

[0135] Figure 4 This is a schematic diagram of the structure of the IoT card risk identification device provided in an embodiment of this application. Figure 5 As shown, the IoT card risk identification device includes: a feature cleaning module 401, a feature selection module 402, a normalization calculation module 403, a risk coefficient calculation module 404, a risk level calculation module 405, and an output module 403.

[0136] The feature cleaning module 401 is used to extract features and corresponding feature values ​​from the raw data collected from multiple IoT cards, clean the feature values ​​corresponding to the features, and obtain cleaned feature values.

[0137] The feature selection module 402 is used to filter all features according to a preset algorithm to obtain candidate features.

[0138] The normalization calculation module 403 is used to obtain the cleaned feature values ​​of each candidate feature, input each cleaned feature value into the normalization function to calculate each normalized feature value, and summarize each normalized feature value to obtain all normalized feature values.

[0139] The risk coefficient calculation module 404 is used to calculate the risk coefficient of each IoT card based on all normalized feature values.

[0140] The risk level calculation module 405 is used to classify the risk level of each IoT card based on the risk coefficient of multiple IoT cards.

[0141] Output module 406 is used to output the risk level of multiple IoT cards.

[0142] In one possible implementation, the normalization calculation module 403 is specifically used to calculate the normalized feature values ​​based on the formula of the normalization function inputted from the cleaned feature values.

[0143] In one possible implementation, the feature selection module 402 is specifically used to determine all the features as a feature set. Each feature in the feature set is used as an initial candidate set and input into a preset evaluation model to obtain an evaluation score for each candidate set. The candidate set with the highest evaluation score is determined, and the features in the candidate set with the highest evaluation score are identified as target features. The target features are then deleted from the feature set to obtain an updated feature set. The target features and any feature from the updated feature set are used as a new candidate set, and the new candidate set is input into the preset evaluation model to obtain an evaluation score for each new feature candidate set. Obtain a new candidate set with the highest evaluation score. If the evaluation score of the new candidate set with the highest evaluation score is greater than that of the candidate set with the highest evaluation score calculated previously, repeat the process of identifying the features in the new candidate set with the highest evaluation score as target features and deleting the target features from the feature set to obtain an updated feature set. Take any feature from the target features and the updated feature set as a new candidate feature and input the new candidate feature set into the preset evaluation model. Continue this process until the evaluation score of the new candidate set with the highest evaluation score is less than that of the candidate set with the highest evaluation score calculated previously. Then, identify the features in the candidate set with the highest evaluation score calculated previously as candidate features.

[0144] In one possible implementation, the risk coefficient calculation module 404 is specifically used to calculate the difference coefficient of each feature value based on all normalized feature values. Based on the difference coefficient of each feature value, the information entropy of each feature is calculated. Based on the information entropy of each feature, the independence weight of each feature is calculated. Based on the independence weight of each feature and the feature value of each IoT card, the risk coefficient of each IoT card is calculated. In one possible implementation, the risk level calculation module 405 is specifically used to determine the risk level of the IoT card as low risk if the risk coefficient is within a first preset range; determine the risk level of the IoT card as medium risk if the risk coefficient is within a second preset range; and determine the risk level of the IoT card as high risk if the risk coefficient is within a third preset range.

[0145] In one possible implementation, the IoT SIM card risk identification device further includes a normal distribution judgment module. This module is specifically used to perform a KS test on the risk coefficients of multiple IoT SIM cards to obtain a p-value. If the p-value is greater than a preset significance level, it is determined that the risk coefficients of the multiple IoT SIM cards conform to a normal distribution. If the p-value is not greater than the preset significance level, it is determined that the risk coefficients of the multiple IoT SIM cards do not conform to a normal distribution, and a new independence weight is selected.

[0146] In one possible implementation, the IoT SIM card replacement risk monitoring device further includes a normal distribution correction module. This module is specifically used to calculate a skewness coefficient based on the risk coefficients of multiple IoT SIM cards. If the skewness coefficient is greater than 1 or less than -1, it is determined to be a highly skewed distribution, and the independence weight of each feature is taken as the logarithm to the base 10, which is used as the new independence weight. If the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the independence weight of each feature is taken as the natural logarithm, which is used as the new independence weight. If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the independence weight of each feature is used as the new independence weight.

[0147] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0148] Figure 5 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application. Figure 5 As shown, the computer device in this embodiment includes: a processor 501 and a memory 502; wherein

[0149] Memory 502 is used to store instructions executed by the computer;

[0150] The processor 501 is configured to execute computer execution instructions stored in the memory to implement the various steps performed by the computer device in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments.

[0151] Alternatively, the memory 502 can be either standalone or integrated with the processor 501.

[0152] When the memory 502 is set up independently, the computer device also includes a bus 503 for connecting the memory 502 and the processor 501.

[0153] This application embodiment also provides a computer storage medium storing computer execution instructions. When the processor executes the computer execution instructions, the IoT card risk identification method described above is implemented.

[0154] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements the IoT card risk identification method as described above.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0156] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0157] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0158] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0159] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0160] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0161] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0162] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0163] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0164] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0165] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for identifying risks associated with Internet of Things (IoT) cards, characterized in that, Applied to computer equipment, including: Based on the raw data collected from multiple IoT cards, features and corresponding feature values ​​are extracted, and the feature values ​​corresponding to the features are cleaned to obtain cleaned feature values. All features are filtered according to a preset algorithm to obtain candidate features; Obtain the cleaned feature values ​​of the candidate features, input the cleaned feature values ​​into the normalization function to calculate the normalized feature values, and summarize the normalized feature values ​​to obtain all the normalized feature values. Calculate the risk coefficient for each IoT card based on all the normalized eigenvalues. Based on the risk coefficients of multiple IoT cards, the risk level of each IoT card is determined; Output the risk level of the multiple IoT cards; The step of filtering all features according to a preset algorithm to obtain candidate features includes: All of the aforementioned features are defined as a feature set; Each feature in the feature set is used as an initial candidate set and input into a preset evaluation model to obtain an evaluation score for each candidate set. Determine the candidate set with the highest evaluation score, identify the features in the candidate set with the highest evaluation score as target features, and delete the target features from the feature set to obtain the updated feature set; The target feature and any feature in the updated feature set are used as a new candidate set, and the new candidate set is input into the preset evaluation model to obtain the evaluation score of each new feature candidate set. Obtain a new candidate set with the highest evaluation score. If the evaluation score of the new candidate set with the highest evaluation score is greater than that of the candidate set with the highest evaluation score calculated previously, repeat the process of identifying the features in the new candidate set with the highest evaluation score as target features and deleting the target features from the feature set to obtain an updated feature set. Take any feature from the target features and the updated feature set as a new candidate feature and input the new candidate feature set into the preset evaluation model. Continue this process until the evaluation score of the new candidate set with the highest evaluation score is less than that of the candidate set with the highest evaluation score calculated previously. Then, identify the features in the candidate set with the highest evaluation score calculated previously as candidate features.

2. The method according to claim 1, characterized in that, The step of inputting the cleaned feature values ​​into a normalization function to calculate each normalized feature value includes: Based on the cleaned feature values, the normalized feature values ​​are calculated using the formula of the normalization function as follows: In the formula, The first after cleaning The first feature 1 eigenvalue, For the first The first feature Normalized eigenvalues ​​of eigenvalues.

3. The method according to claim 1, characterized in that, The step of calculating the risk coefficient for each IoT card based on all the normalized eigenvalues ​​includes: Based on all the normalized eigenvalues, the difference coefficient for each eigenvalue is calculated; The information entropy of each feature is calculated based on the difference coefficient of each feature value; The independence weight of each feature is calculated based on the information entropy of each feature. The risk coefficient of each IoT card is calculated based on the independence weight of each feature and the feature value of each IoT card.

4. The method according to any one of claims 1 to 3, characterized in that, The method of classifying the risk level of each IoT card based on the risk coefficients of multiple IoT cards includes: If the risk coefficient is within a first preset range, then the risk level of the IoT card is determined to be low risk. If the risk coefficient is within the second preset range, then the risk level of the IoT card is determined to be medium risk. If the risk coefficient is within the third preset range, then the risk level of the IoT card is determined to be high risk.

5. The method according to claim 1, characterized in that, Before classifying the risk level of each IoT card based on the risk coefficients of multiple IoT cards, the following steps are also included: The risk coefficients of the multiple IoT cards are subjected to the KS test to obtain the p_value. If the p_value is greater than the preset significance level, then the risk coefficients of the multiple IoT cards are determined to follow a normal distribution. If the p_value does not meet the requirement of being greater than the preset significance level, then it is determined that the risk coefficients of the multiple IoT cards do not meet the normal distribution, and a new independence weight is selected.

6. The method according to claim 5, characterized in that, The selection of new independence weights includes: The skewness coefficient is calculated based on the risk coefficients of the multiple IoT cards; If the skewness coefficient is greater than 1 or less than -1, it is determined to be a highly skewed distribution, and the independence weight of each feature is taken as the logarithm to the base 10 as the new independence weight. If the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the natural logarithm of the independence weight of each feature is taken as the new independence weight. If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the independence weight of each feature is taken as the new independence weight.

7. An IoT card risk identification device, characterized in that, include: The feature cleaning module is used to extract features and corresponding feature values ​​from the raw data collected from multiple IoT cards, and to clean the feature values ​​corresponding to the features to obtain cleaned feature values. The feature selection module is used to filter all features according to a preset algorithm to obtain candidate features; The normalization calculation module is used to obtain the cleaned feature values ​​of the candidate features, input the cleaned feature values ​​into the normalization function to calculate the normalized feature values, and summarize the normalized feature values ​​to obtain all the normalized feature values. The risk coefficient calculation module is used to calculate the risk coefficient of each IoT card based on all the normalized feature values. The risk level calculation module is used to classify the risk level of each IoT card based on the risk coefficients of multiple IoT cards; The output module is used to output the risk level of the multiple IoT cards; The feature selection module is specifically used to determine all the features as a feature set; and to input each feature in the feature set as an initial candidate set into a preset evaluation model to obtain an evaluation score for each candidate set. The candidate set with the highest evaluation score is determined, and the features in the candidate set with the highest evaluation score are identified as target features. The target features are then deleted from the feature set to obtain an updated feature set. The target features and any feature in the updated feature set are used as a new candidate set, and the new candidate set is input into the preset evaluation model to obtain the evaluation score of each new feature candidate set. Obtain a new candidate set with the highest evaluation score. If the evaluation score of the new candidate set with the highest evaluation score is greater than that of the candidate set with the highest evaluation score calculated previously, repeat the process of identifying the features in the new candidate set with the highest evaluation score as target features and deleting the target features from the feature set to obtain an updated feature set. Take any feature from the target features and the updated feature set as a new candidate feature and input the new candidate feature set into the preset evaluation model. Continue this process until the evaluation score of the new candidate set with the highest evaluation score is less than that of the candidate set with the highest evaluation score calculated previously. Then, identify the features in the candidate set with the highest evaluation score calculated previously as candidate features.

8. A computer device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the IoT card risk identification method as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that, The computer storage medium stores computer execution instructions, and when the processor executes the computer execution instructions, it implements the IoT card risk identification method as described in any one of claims 1 to 6.

Images