Device abnormal use identification method and device, electronic device, and storage medium

Abstract

The application provides a device abnormal use identification method and device, electronic equipment and a computer readable storage medium. The device abnormal use identification method comprises: obtaining operation characteristics of each to-be-identified device; performing outlier detection based on the operation characteristics of each to-be-identified device to obtain outlier devices in the to-be-identified devices; obtaining an abnormal degree of the outlier devices based on preset abnormal degree prediction parameters and the operation characteristics of the outlier devices; and determining the outlier devices as abnormal use devices if the abnormal degree is greater than a preset degree threshold. In the application, the abnormal use devices can be more accurately and comprehensively identified, and the identification comprehensiveness and efficiency of the abnormal use devices are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data anomaly identification, and particularly relates to a device abnormal use identification method and device, electronic equipment and a computer readable storage medium. BACKGROUND

[0002] With the popularity of e-commerce, online shopping has become an essential part of people's lives, thus driving the rapid development of the logistics industry, and the express volume also shows an explosive growth every year.

[0003] In the express transportation process, various types of devices such as delivery vehicles, transfer field devices, delivery terminal devices and portable printers are usually configured to improve work efficiency. However, the devices involved in the logistics scene are of various types, large in quantity and wide in range, so it is difficult to comprehensively and accurately identify whether there is an abnormal use behavior such as violation of rules through traditional manual static management. SUMMARY

[0004] The present application provides a device abnormal use identification method and device, electronic equipment and a computer readable storage medium, which can more accurately and comprehensively identify abnormal use devices and improve the identification comprehensiveness and efficiency of abnormal use devices.

[0005] In a first aspect, the present application provides a device abnormal use identification method, which comprises:

[0006] obtaining operation characteristics of each to-be-identified device;

[0007] performing outlier detection based on the operation characteristics of each to-be-identified device to obtain outlier devices in the to-be-identified devices;

[0008] based on a preset abnormality degree prediction parameter, predicting the abnormality degree of the outlier devices according to the operation characteristics of the outlier devices;

[0009] if the abnormality degree is greater than a preset degree threshold, determining the outlier devices as abnormal use devices.

[0010] In some embodiments of the present application, the outlier detection based on the operation characteristics of each to-be-identified device to obtain outlier devices in the to-be-identified devices comprises:

[0011] performing clustering on the to-be-identified devices according to the operation characteristics of the to-be-identified devices by a preset clustering algorithm to obtain the outlier devices in the to-be-identified devices.

[0012] In some embodiments of the present application, before the step of predicting the abnormality degree of the outlier device based on the preset abnormality degree prediction parameter according to the operation characteristics of the outlier device, the method further comprises the steps of:

[0013] obtaining the operation characteristics of each sample device;

[0014] training a preset isolation forest according to the operation characteristics of each sample device to obtain a trained isolation forest;

[0015] using the model parameters of the trained isolation forest as the abnormality degree prediction parameter.

[0016] In some embodiments of the present application, the step of detecting outliers based on the operation characteristics of each device to be identified to obtain outlier devices among the devices to be identified comprises the steps of:

[0017] encoding the operation characteristics of each device to be identified based on the feature encoding parameters learned in advance to obtain target encoded features of the operation characteristics of each device to be identified;

[0018] decoding the target encoded features based on the feature decoding parameters learned in advance to obtain target decoded features of the operation characteristics of each device to be identified;

[0019] determining whether each device to be identified is outlier data based on the similarity between the operation characteristics of each device to be identified and the target decoded features to obtain outlier devices among the devices to be identified.

[0020] In some embodiments of the present application, the step of obtaining the operation characteristics of each device to be identified comprises the steps of:

[0021] obtaining device usage data of each device to be identified;

[0022] obtaining device statistical data of each device to be identified;

[0023] obtaining the operation characteristics of each device to be identified based on the device usage data of each device to be identified and the device statistical data of each device to be identified.

[0024] In some embodiments of the present application, the step of obtaining the operation characteristics of each device to be identified comprises the steps of:

[0025] if each device to be identified is a connected device, the operation characteristics of each device to be identified are collected in real time through big data burying;

[0026] if each device to be identified is a non-connected device, the operation characteristics of each device to be identified are collected in real time through a connected device.

[0027] In some embodiments of this application, after determining that the outlier device is an abnormally used device, the method further includes:

[0028] Output a message indicating abnormal use of the outlier device.

[0029] Secondly, this application provides a device for identifying abnormal equipment use, the device comprising:

[0030] The acquisition unit is used to acquire the operational characteristics of each device to be identified.

[0031] The detection unit is used to detect outliers based on the operational characteristics of each device to be identified, and to identify outlier devices among the devices to be identified.

[0032] The prediction unit is used to predict the degree of anomalousness of the outlier device based on preset anomaly degree prediction parameters and the operational characteristics of the outlier device.

[0033] The identification unit is used to determine that the outlier device is an abnormally used device if the degree of abnormality is greater than a preset degree threshold.

[0034] In some embodiments of this application, the detection unit is specifically used for:

[0035] By using a preset clustering algorithm, the devices to be identified are clustered according to their operational characteristics to obtain outlier devices among them.

[0036] In some embodiments of this application, before predicting the anomaly degree of the outlier device based on preset anomaly degree prediction parameters and the operational characteristics of the outlier device, the prediction unit is specifically used for:

[0037] Obtain the operational characteristics of each sample device;

[0038] The preset isolated forest is trained based on the operational characteristics of each sample device to obtain a trained isolated forest;

[0039] The model parameters of the trained isolated forest are used as the anomaly prediction parameters.

[0040] In some embodiments of this application, the detection unit is specifically used for:

[0041] Based on the pre-learned feature encoding parameters, the operation features of each device to be identified are encoded to obtain the target encoded features of the operation features of each device to be identified.

[0042] The target coding feature is decoded by using the feature decoding parameter obtained through pre-learning to obtain target decoding features of the operation features of the devices to be identified.

[0043] Based on the similarity between the operation features of the devices to be identified and the target decoding features, it is determined whether the devices to be identified are outlier data, and outlier devices among the devices to be identified are obtained.

[0044] In some embodiments of the present application, the acquisition unit is specifically configured to:

[0045] Acquire device usage data of the devices to be identified;

[0046] Acquire device statistical data of the devices to be identified;

[0047] Based on the device usage data of the devices to be identified and the device statistical data of the devices to be identified, obtain operation features of the devices to be identified.

[0048] In some embodiments of the present application, the acquisition unit is specifically configured to:

[0049] If the devices to be identified are networked devices, the operation features of the devices to be identified are collected in real time through a big data burying point method;

[0050] If the devices to be identified are non-networked devices, the operation features of the devices to be identified are collected in real time through networked devices.

[0051] In some embodiments of the present application, the device abnormal use identification apparatus further comprises an output unit, and after the outlier device is determined to be an abnormal use device, the output unit is specifically configured to:

[0052] Output prompt information of the outlier device abnormal use.

[0053] In a third aspect, the present application further provides an electronic device, which comprises a processor and a memory, the memory stores a computer program, and the processor invokes the computer program in the memory to execute the steps in any device abnormal use identification method provided by the present application.

[0054] In a fourth aspect, the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is loaded by a processor to execute the steps in the device abnormal use identification method.

[0055] In the present application, in the first aspect, first, based on the operation characteristics of each to-be-identified device, outlier detection is performed to obtain outlier devices in each to-be-identified device, which can preliminarily screen out the operation characteristics of the outlier devices corresponding to the abnormal use devices; then, based on the preset abnormality degree prediction parameter, the abnormality degree of the outlier devices is obtained by prediction according to the operation characteristics of the outlier devices, which is used for identifying the abnormal use devices, so that whether the outlier devices are abnormal use devices can be further determined, and therefore the abnormal use devices can be more accurately identified, and the misjudgment of abnormal use can be reduced; in the second aspect, since various types of devices involved in the logistics scene can be automatically identified, the abnormal use monitoring does not need to be performed by the traditional manual static management mode, and the identification comprehensiveness and identification efficiency of the abnormal use devices are improved. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0057] Figure 1 is a scene schematic diagram of the device abnormal use identification system provided by the embodiments of the present application;

[0058] Figure 2 is a flow schematic diagram of the device abnormal use identification method provided by the embodiments of the present application;

[0059] Figure 3 is a structure schematic diagram of the autoencoder provided in the embodiments of the present application;

[0060] Figure 4 is an illustrative schematic diagram of the abnormal use device identification in the embodiments of the present application;

[0061] Figure 5 is an embodiment schematic diagram of the output prompt information provided by the embodiments of the present application;

[0062] Figure 6 is another embodiment schematic diagram of the output prompt information provided by the embodiments of the present application;

[0063] Figure 7 is an embodiment structure schematic diagram of the device abnormal use identification apparatus provided in the embodiments of the present application;

[0064] Figure 8 is an embodiment structure schematic diagram of the electronic device provided in the embodiments of the present application. DETAILED DESCRIPTION

[0065] With reference to the drawings and the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments of the present application, any person skilled in the art can obtain all other embodiments within the scope of the present application without creative effort.

[0066] In the description of the embodiments of the present application, it should be understood that the terms "first", "second" are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise explicitly specified.

[0067] The following description is given in order to enable any person skilled in the art to practice and use the present application. In the following description, details are set forth in order to explain the application. It will be apparent to one skilled in the art that the present application can be practiced without using these specific details. In other instances, well-known processes have not been described in detail in order to avoid unnecessarily obscuring the description of the embodiments of the present application. Therefore, the present application is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

[0068] The execution subject of the device abnormal use identification method of the embodiments of the present application can be the device abnormal use identification apparatus provided by the embodiments of the present application, or a server device, a physical host or a user equipment (UE) and other types of electronic devices integrated with the device abnormal use identification apparatus, wherein the device abnormal use identification apparatus can be realized in the form of hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a notebook computer, a palm computer, a desktop computer or a personal digital assistant (PDA).

[0069] The electronic device can run in a separate mode or in a device cluster mode. By applying the device abnormal use identification method provided by the embodiments of the present application, the abnormal use of the device can be more accurately and comprehensively identified, and the identification comprehensiveness and efficiency of the abnormal use of the device can be improved.

[0070] Referring to Figure 1 , Figure 1is a scene schematic diagram of a device abnormal use recognition system provided by an embodiment of the present application. The device abnormal use recognition system can include an electronic device 100, and the electronic device 100 is integrated with a device abnormal use recognition apparatus. For example, the electronic device can obtain operation characteristics of each to-be-recognized device; perform outlier detection based on the operation characteristics of the to-be-recognized devices to obtain outlier devices in the to-be-recognized devices; perform prediction based on a preset abnormality degree prediction parameter and the operation characteristics of the outlier devices to obtain an abnormality degree of the outlier devices; and if the abnormality degree is greater than a preset degree threshold, determine that the outlier devices are abnormal use devices.

[0071] In addition, as shown in Figure 1 , the device abnormal use recognition system can further include a memory 200 configured to store data, such as use data of the devices.

[0072] It should be noted that Figure 1 , the scene schematic diagram of the device abnormal use recognition system is only an example, and the device abnormal use recognition system and the scene described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that, as the device abnormal use recognition system evolves and new service scenarios appear, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0073] Next, a device abnormal use recognition method provided by an embodiment of the present application will be introduced. In the embodiment of the present application, an electronic device is taken as an execution subject, and the execution subject will be omitted in subsequent method embodiments for simplification and convenience of description.

[0074] Referring to Figure 2 , Figure 2 is a flowchart of a device abnormal use recognition method provided by an embodiment of the present application. It should be noted that, although a logical sequence is shown in the flowchart shown in Figure 2 or other drawings, in some cases, the steps shown or described herein can be performed in an order different from that shown herein. The device abnormal use recognition method includes steps 201 to 204, wherein:

[0075] 201, obtaining operation characteristics of each to-be-recognized device.

[0076] The to-be-recognized device refers to a device to be recognized for abnormal use. For example, a delivery vehicle, a transfer field device, a delivery terminal device, a portable printer, and various types of devices in a logistics scenario.

[0077] The operation feature of each to-be-identified device refers to a data representation feature obtained after structured processing such as statistical use information of each time period is performed according to basic use data of each to-be-identified device.

[0078] There are various ways to obtain the operation feature of each to-be-identified device in step 201, and exemplarily, the ways include:

[0079] I. Real-time collection of the operation feature of each to-be-identified device.

[0080] ①Statistical use data such as time-sharing features of each to-be-identified device is taken as the operation feature of each to-be-identified device.

[0081] The time-sharing feature of each to-be-identified device can be specifically statistical information of basic use data of each to-be-identified device in each time period. For example, past hourly operation data, past hourly average use data of working days or holidays, etc.

[0082] The device use data of each to-be-identified device is data for reflecting the use and operation of each to-be-identified device.

[0083] ②Statistical device statistical data of each to-be-identified device is taken as the operation feature of each to-be-identified device.

[0084] The device statistical data of each to-be-identified device is other data related to the device, for example, use person change information, cost center change information, purchase date, purchase amount, supplier, etc.

[0085] ③The device use data and the device statistical data of each to-be-identified device are combined as the operation feature of each to-be-identified device. At this time, step 201 can specifically include: obtaining the device use data of each to-be-identified device; obtaining the device statistical data of each to-be-identified device; obtaining the operation feature of each to-be-identified device based on the device use data of each to-be-identified device and the device statistical data of each to-be-identified device.

[0086] Exemplarily, on one hand, past hourly operation data of each to-be-identified device, past hourly average use data of working days or holidays, etc. can be obtained as the device use data of each to-be-identified device; on the other hand, use person change information, cost center change information, purchase date, purchase amount, supplier, etc. of each to-be-identified device can be obtained as the device statistical data of each to-be-identified device; then, the device use data and the device statistical data of each to-be-identified device are spliced according to a certain data structure to obtain the operation feature of each to-be-identified device.

[0087] In some embodiments, step 201 can acquire the operation characteristics of each device to be identified in the past period of time for identification every interval of time, to identify whether there is abnormal use of the device.

[0088] Further, in order to improve the timeliness of identifying abnormal use of the device, in other embodiments, the operation characteristics of each device to be identified can also be collected in real time. For example, if the devices to be identified are networked devices, the operation characteristics of the devices to be identified are collected in real time through big data burying; if the devices to be identified are non-networked devices, the operation characteristics of the devices to be identified are collected in real time through networked devices. For example, for devices such as guns, office computers, and portable printers that can be directly or indirectly networked, the operation characteristics of the devices are collected in real time through big data burying; for devices such as delivery vehicles and belt machines that do not have networkable properties, a smart module can be installed, and the use information of the devices can be collected through communication between the smart module and the gateway (for example, a networkable camera is installed to capture the use situation of the device).

[0089] II. Reading the operation characteristics of each device to be identified from a preset database. As shown in Figure 5 or Figure 6 Before step 201, the operation characteristics of each device can be collected in advance and stored in a preset database in the manner shown in I above, and the operation characteristics of each device to be identified are directly read from the preset database in step 201.

[0090] 202. Detecting outliers based on the operation characteristics of each device to be identified to obtain outlier devices among the devices to be identified.

[0091] There are various ways to determine outlier devices among the devices to be identified in step 202, exemplarily including:

[0092] (1) Based on a clustering algorithm such as the OPTICS algorithm, the operation characteristics of each device to be identified are clustered to obtain outlier devices among the devices to be identified. At this time, step 202 can specifically include the following step 2021A:

[0093] 2021A. Clustering each device to be identified according to the operation characteristics of each device to be identified through a preset clustering algorithm to obtain outlier devices among the devices to be identified.

[0094] Exemplarily, before step 2021A, an OPTICS algorithm based on the idea of density clustering can be constructed, which is used to cluster each device to be identified according to the operation characteristics of each device to be identified in step 2021A to obtain outlier devices among the devices to be identified. For example, the construction process of the OPTICS algorithm can specifically include the following:

[0095] A1, obtain the operation characteristics of each sample device to obtain a sample set D.

[0096] Each sample in the sample set D is the operation characteristics of a sample device.

[0097] A2, set an initial Eps parameter and a MinPts parameter.

[0098] The Eps parameter is the distance threshold of the neighborhood of a sample, and the neighborhood is an Eps-neighborhood, which is defined as: for xj e D, the Eps-neighborhood of xj contains a subset of samples N Eps .

[0099] The MinPts parameter is the threshold of the number of samples in the Eps-neighborhood N Eps of a sample, that is, if the number of samples in the Eps-neighborhood of a sample xj is not less than MinPts, xj can be defined as a core object.

[0100] A3, based on the preset parameter adjustment range of the Eps parameter and the preset parameter adjustment range of the MinPts parameter, the value of the Eps parameter and the value of the MinPts parameter are combined into a pair of input parameters, and the sample set D is trained to find a pair of input parameters that best fit the data distribution of the sample set D.

[0101] For example, in step A3, the preset parameter adjustment range of the Eps parameter can be set as: Eps e (2, 3, 4, 5, 6, 7, 8), and the preset parameter adjustment range of the MinPts parameter can be set as: MinPts e (3, 4, 5, 6, 7, 8, 9, 10). Then, two-by-two combination is carried out to obtain a pair of input parameters for training, and finally a set of input parameters Eps = 3, MinPts = 5 that best fit the data distribution of the sample set D is obtained.

[0102] The clustering algorithm is used to cluster each to-be-identified device according to the operation characteristics of each to-be-identified device to obtain outlier devices in each to-be-identified device. Since multiple to-be-identified devices can be clustered at the same time to obtain outlier devices in multiple to-be-identified devices, batch abnormality identification of to-be-identified devices can be performed, thereby improving the detection speed of outlier devices to a certain extent, and further improving the identification efficiency of abnormal use devices. The improvement in identification efficiency is more obvious in a logistics scene involving a large number of devices, a large quantity of devices, and a wide range of devices.

[0103] (2) Based on the operation characteristics of each to-be-identified device, an autoencoder (AE) is used to perform anomaly detection on each to-be-identified device to obtain outlier devices in each to-be-identified device. Specifically, based on the autoencoder that has learned the operation characteristics of the normal use device in advance, the operation characteristics of each to-be-identified device are first encoded to obtain encoded characteristics, and then the encoded characteristics are decoded to obtain decoded characteristics; the similarity between the decoded characteristics and the operation characteristics of each to-be-identified device is compared to determine the outlier devices. At this time, step 202 can specifically include steps 2021B-2023B as follows:

[0104] 2021B, based on the feature encoding parameters learned in advance, the operation characteristics of each to-be-identified device are encoded to obtain the target encoding characteristics of the operation characteristics of each to-be-identified device.

[0105] Wherein, the target encoding characteristics refer to the encoded characteristics obtained by encoding the operation characteristics of each to-be-identified device through the feature encoding parameters.

[0106] Wherein, the feature encoding parameters are used to encode the operation characteristics of each device to obtain the encoded characteristics of the operation characteristics of each device. The feature encoding parameters are learned through the autoencoder, and the process of learning the feature encoding parameters through the autoencoder will be described in detail in the following (such as steps C1-C2). To simplify the description, it will not be repeated here.

[0107] In some embodiments, the feature encoding parameters learned by the autoencoder in steps C1-C2 can be extracted, and the operation characteristics of each to-be-identified device are encoded through the extracted feature encoding parameters to obtain the target encoding characteristics of the operation characteristics of each to-be-identified device.

[0108] In some embodiments, the operation characteristics of each to-be-identified device can be directly input into the trained autoencoder in steps C1-C2, and the feature encoder in the autoencoder encodes the operation characteristics of each to-be-identified device according to the learned feature encoding parameters to obtain the target encoding characteristics of the operation characteristics of each to-be-identified device.

[0109] 2022B, the target encoding characteristics are decoded through the feature decoding parameters learned in advance to obtain the target decoding characteristics of the operation characteristics of each to-be-identified device.

[0110] Wherein, the target decoding characteristics refer to the decoded characteristics obtained by decoding the target encoding characteristics through the feature decoding parameters.

[0111] The feature decoding parameter is used to decode the encoded features of the operation features of each device to obtain decoded features of the operation features of each device. The feature decoding parameter is obtained by learning of a self-encoder. The process of learning of the feature decoding parameter by the self-encoder will be described in detail below (such as steps C1-C2). For the sake of simplicity, the description will not be repeated here.

[0112] In some embodiments, the feature decoding parameter obtained by the self-encoder in steps C1-C2 can be extracted. The target encoded features are decoded by the extracted feature decoding parameter to obtain target decoded features of the operation features of each to-be-identified device.

[0113] In some embodiments, the operation features of each to-be-identified device can be directly input into the self-encoder trained in steps C1-C2. The target encoded features of the operation features of each to-be-identified device are decoded by the feature decoder in the self-encoder according to the learned feature decoding parameter to obtain target decoded features of the operation features of each to-be-identified device.

[0114] 2023B, based on the similarity between the operation features of each to-be-identified device and the target decoded features, determining whether the to-be-identified device is an outlier data, obtaining an outlier device in the to-be-identified device.

[0115] For example, step 2023B can include steps B1-B4 as follows:

[0116] B1, obtaining the similarity between the operation features of each to-be-identified device and the target decoded features.

[0117] In step B1, the similarity between the operation features of each to-be-identified device and the target decoded features can be obtained in various ways, for example, by calculating the cosine distance, Manhattan distance or Hamming distance between the operation features of each to-be-identified device and the target decoded features, thereby obtaining the similarity between the operation features of each to-be-identified device and the target decoded features.

[0118] B2, obtaining a preset similarity abnormal threshold.

[0119] (1) Real-time calculation. At this time, step B2 specifically includes steps B21-B25 as follows:

[0120] B21, obtaining the operation features of each sample device in N sample devices.

[0121] The sample device refers to each device used to determine the similarity abnormal threshold. For example, each to-be-identified device can also be used as a sample device.

[0122] The operation characteristic of the sample device refers to a representation characteristic of operation data of the sample device.

[0123] The manner of obtaining the operation characteristic of each sample device in step B21 is similar to the manner of obtaining the operation characteristic of each to-be-identified device in step 201, and details can be referred to the related description above, which will not be repeated here.

[0124] B22, encode the operation characteristic of each sample device by using the feature encoding parameter to obtain a sample encoding characteristic of each sample device.

[0125] The manner of obtaining the sample encoding characteristic in step B22 is similar to the manner of obtaining the target encoding characteristic in step 2021B, and details can be referred to the related description above, which will not be repeated here.

[0126] B23, decode the sample encoding characteristic of each sample device by using the feature decoding parameter to obtain a sample decoding characteristic of each sample device.

[0127] The manner of obtaining the sample decoding characteristic in step B23 is similar to the manner of obtaining the target decoding characteristic in step 2022B, and details can be referred to the related description above, which will not be repeated here.

[0128] B24, obtain a sample similarity between the operation characteristic of each sample device and the sample decoding characteristic to obtain N sample similarities.

[0129] The sample similarity refers to a similarity between the operation characteristic of the sample device and the sample decoding characteristic.

[0130] The manner of obtaining the sample similarity in step B24 is similar to the manner of obtaining the similarity between the target encoding characteristic and the operation characteristic of each to-be-identified device in step 2023B, and details can be referred to the related description above, which will not be repeated here.

[0131] B25, determine the similarity abnormality threshold based on the N sample similarities.

[0132] There are various manners of determining the similarity abnormality threshold based on the N sample similarities, and exemplary manners include:

[0133] Manner 1: determining the similarity abnormal threshold value based on the 3σ criterion. In the 3σ criterion, the values in (μ-3σ, μ+3σ) are normal values, that is, the values less than (μ-3σ) or greater than (μ+3σ) can be regarded as abnormal values. Therefore, in the embodiments of the present application, the operation characteristics of each to-be-identified device whose similarity is less than (μ-3σ) of the N sample similarities can be regarded as abnormal (i.e., the operation characteristics of the outlier device). At this time, step B25 can specifically include: obtaining the mean and standard deviation of the N sample similarities; and determining the similarity abnormal threshold value based on the mean and standard deviation.

[0134] For example, the N=5 sample similarities are 0.90, 0.80, 0.98, 0.95, and 0.70, respectively. The mean of the N sample similarities is μ=0.866, and the standard deviation is σ=0.10307279. At this time, the similarity abnormal threshold value can be determined as (μ-3σ)=0.556781631 based on the 3σ criterion, the mean, and the standard deviation.

[0135] Manner 2: determining the similarity abnormal threshold value based on the box plot Figure Four Figure Four For example, the N=5 sample similarities are 0.90, 0.80, 0.98, 0.95, and 0.70, respectively. The mean of the N sample similarities is μ=0.866, and the standard deviation is σ=0.10307279. At this time, the similarity abnormal threshold value can be determined as (μ-3σ)=0.556781631 based on the 3σ criterion, the mean, and the standard deviation.

[0135] Manner 2: determining the similarity abnormal threshold value based on the box plot Figure Four Figure Four For example, the N=5 sample similarities are 0.90, 0.80, 0.98, 0.95, and 0.70, respectively. The mean of the N sample similarities is μ=0.866, and the standard deviation is σ=0.10307279. At this time, the similarity abnormal threshold value can be determined as (μ-3σ)=0.556781631 based on the 3σ criterion, the mean, and the standard deviation.

[0136] For example, it is assumed that k=3, and the N=5 sample similarities are 0.90, 0.80, 0.98, 0.95, and 0.70, respectively. The upper quartile of the N sample similarities is Q1=0.8, and the lower quartile is Q3=0.95. At this time, the similarity abnormal threshold value can be determined as (Q1-k(Q3-Q1))=0.35 based on the box plot Figure Four

[0137] Since the similarity abnormal threshold value for determining whether each to-be-identified device is abnormal (i.e., whether it is an outlier device) is determined according to the N sample similarities obtained according to the N sample devices, the rationality of the value of the similarity abnormal threshold value can be improved to some extent, thereby improving the detection accuracy of whether each to-be-identified device is abnormal (i.e., whether it is an outlier device) subsequently.

[0138] (2) Directly read. For example, the similarity abnormal threshold value calculated in real time by the above-mentioned (1) is stored in a preset database, and the preset similarity abnormal threshold value can be directly read from the preset database in step B2.

[0139] B3, when the similarity is less than the similarity abnormal threshold value, determining that the operation characteristics of each to-be-identified device are the operation characteristics of an outlier device.

[0140] B4, when the similarity is greater than or equal to the similarity abnormal threshold value, determining that each to-be-identified device is a normal device.

[0141] For example, assuming that the similarity abnormal threshold value determined in step B2 is 85%, when the similarity between the operation characteristics of each to-be-identified device and the target decoding characteristics is 80%, the similarity between the operation characteristics of each to-be-identified device and the target decoding characteristics is 80%, which is less than the similarity abnormal threshold value of 85%, at this time, it can be determined that each to-be-identified device is an outlier device.

[0142] When the similarity between the operation characteristics of each to-be-identified device and the target decoding characteristics is 90%, the similarity between the operation characteristics of each to-be-identified device and the target decoding characteristics is 90%, which is greater than the similarity abnormal threshold value of 85%, at this time, it can be determined that each to-be-identified device is a normal normal device.

[0143] Further, in order to improve the accuracy of whether each to-be-identified device is abnormal (i.e., whether it is an outlier device), the similarity between the target encoding characteristics and the operation characteristics of each to-be-identified device can be determined to be less than the similarity abnormal threshold value determined based on the above-mentioned method 1 and less than the similarity abnormal threshold value determined based on the above-mentioned method 2, and when the similarity between the target encoding characteristics and the operation characteristics of each to-be-identified device is less than the similarity abnormal threshold values determined based on the above-mentioned methods 1 and 2, it is determined that each to-be-identified device is abnormal (i.e., an outlier device).

[0144] Exemplarily, the above-mentioned autoencoder can be learned by the following steps C1-C2:

[0145] C1, obtaining operation characteristics of a plurality of normal use devices.

[0146] C2, the operation characteristics of the plurality of normal use devices are taken as inputs of the autoencoder to be learned, the autoencoder is trained, and a learned autoencoder is obtained.

[0147] The operation characteristics of the normal use device refer to the representation characteristics of the operation data of the normal use device.

[0148] The autoencoder is a multi-layer neural network that encodes the input representation X into a new representation Y and then decodes Y back to X. It is an unsupervised learning algorithm that uses the backpropagation algorithm to train the network so that the output equals the input. The autoencoder is a kind of neural network that can try to copy the input to the output after training. The autoencoder has a hidden layer h inside, which can generate a code representation of the input. The network can be regarded as consisting of two parts: an encoder represented by the function h = f(x) and a decoder that generates a reconstruction r = g(h).

[0149] As shown in Figure 3 The autoencoder includes an encoder and a decoder. The encoder is used to encode the operation characteristics X of each device to be identified to obtain the encoded characteristics Zy. The decoder is used to decode the encoded characteristics Zy of the encoder to obtain and output the decoded characteristics X'.

[0150] By using the operation characteristics of the normal use devices to train the autoencoder, a trained autoencoder is obtained. Since the encoder can learn the function h = f(x) based on the commonality between the operation characteristics of the normal use devices, and the decoder can learn the function r = g(h) based on the commonality between the operation characteristics of the normal use devices, the trained autoencoder can learn the commonality between the operation characteristics of the normal use devices. Therefore, the trained autoencoder can better restore the operation characteristics of the normal use devices, and relatively speaking, it is difficult to accurately restore the operation characteristics of the abnormal normal use devices. Therefore, the target decoded characteristics are obtained by using the learned feature encoding parameters and feature decoding parameters, and the similarity between the target decoded characteristics of each device to be identified and the operation characteristics of each device to be identified can accurately detect whether each device to be identified is abnormal (i.e., whether it is an outlier device).

[0151] At this time, the feature encoding parameters of the encoder in the autoencoder are used to encode the target original characteristics in step 2021B to obtain the target encoded characteristics, and the feature decoding parameters of the decoder in the autoencoder are used to decode the target encoded characteristics in step 2022B to obtain the target decoded characteristics.

[0152] 203, based on the preset abnormality degree prediction parameter, the operation characteristics of the outlier device are predicted to obtain the abnormality degree of the outlier device.

[0153] The outlier device refers to a to-be-identified device determined as an outlier according to operation characteristics of each to-be-identified device.

[0154] The abnormality degree of the outlier device is used to reflect a probability of abnormal use of the outlier device.

[0155] The abnormality degree prediction parameter in step 203 is obtained by learning a preset model (such as an unsupervised learning model, such as an iForest model, or a supervised learning model). The following examples are given to illustrate learning of the abnormality degree prediction parameter based on the unsupervised learning model and the supervised learning model.

[0156] 1) The abnormality degree prediction parameter is obtained based on unsupervised learning. When the abnormality degree prediction parameter is obtained based on unsupervised learning, only the input feature data of the sample (i.e., the operation characteristics of the sample device) needs to be obtained, and the unsupervised learning model is learned based on the self-learning ability of the unsupervised learning model, without the need for data labeling, thereby avoiding the problem of high time cost of a large amount of data labeling to a certain extent. For example, assuming that the unsupervised learning model is an iForest model, the abnormality degree prediction parameter can be obtained through the following steps D1 to D3:

[0157] D1, obtaining operation characteristics of each sample device.

[0158] D2, training the preset iForest according to the operation characteristics of each sample device to obtain a trained iForest.

[0159] For example, the operation characteristics of each sample device can be used to train the preset iForest based on a direct method of probability density function estimation (i.e., find the distribution parameters of each category in the feature space, and then classify), to obtain a trained iForest.

[0160] For another example, the operation characteristics of each sample device can be used to train the preset iForest based on a simple clustering method of similarity measurement between samples (i.e., find the core or initial kernel of different categories, and then gather samples into different categories according to the similarity measurement between the samples and the core), to obtain a trained iForest.

[0161] D3, using model parameters of the trained iForest as the abnormality degree prediction parameter.

[0162] After the model parameters of the trained isolation forest are trained through steps D1-D2, in step 203, the operation features of the outlier device can be directly input into the trained isolation forest, and the abnormality degree of the outlier device can be predicted according to the operation features of the outlier device through the abnormality degree prediction parameters in the trained isolation forest. Alternatively, the model parameters of the trained isolation forest can be extracted as the abnormality degree prediction parameters in step D3, and in step 203, the abnormality degree of the outlier device can be predicted according to the extracted abnormality degree prediction parameters according to the operation features of the outlier device.

[0163] 2) Obtain the abnormality degree prediction parameters based on supervised learning. At this time, the abnormality degree prediction parameters can be obtained through steps E1-E3 as follows:

[0164] E1, obtain the operation features of each sample device and the use category label of each sample device.

[0165] The use category label of each sample device is used to indicate the actual result of whether each sample device is abnormally used.

[0166] E2, train a preset model according to the operation features of each sample device to obtain a trained model.

[0167] Exemplarily, first, a preset model (for example, a neural network model that can be used for a classification task) is used to predict whether each sample device is abnormally used according to the operation features of each sample device; then, the loss value of the preset model is determined according to the predicted result of whether each sample device is abnormally used and the actual result of whether each sample device is abnormally used; then, the model parameters of the preset model are adjusted according to the loss value of the preset model until the preset stop training condition is met, and the trained model is obtained.

[0168] E3, the model parameters of the trained model are used as the abnormality degree prediction parameters.

[0169] After obtaining the trained model, based on the model parameters of the trained model, the classification result of whether the device is abnormally used can be predicted according to the operation features of the device, and the probability of the device being abnormally used can be determined; the probability of the device being abnormally used determined by the trained model can be used as the abnormality degree of the device.

[0170] At this point, in step 203, the operational characteristics of the outlier device can be input into the trained model. Using the anomaly prediction parameters in the trained model, a classification result indicating whether the outlier device is being used aberrantly is predicted based on its operational characteristics. The probability of the outlier device being used aberrantly is then determined as the degree of anomaly. Alternatively, in step D3, the model parameters of the trained model can be extracted as anomaly prediction parameters. In step 203, based on these extracted anomaly prediction parameters and the operational characteristics of the outlier device, a classification result indicating whether the outlier device is being used aberrantly is predicted. The probability of the outlier device being used aberrantly is then determined as the degree of anomaly.

[0171] 204. If the degree of abnormality is greater than a preset degree threshold, then the outlier device is determined to be an abnormally used device.

[0172] The specific value of the preset degree threshold can be set according to the actual situation, and there is no restriction on the specific value of the preset degree threshold here.

[0173] For example, if the anomaly level of an outlier device (e.g., 90%) is greater than a preset threshold (e.g., 70%), the outlier device can be directly identified as an abnormally used device. If the anomaly level of an outlier device (e.g., 10%) is greater than a preset threshold (e.g., 70%), the outlier device can be directly identified as a normally used device.

[0174] Please refer to Figure 4 , Figure 4 This is an illustrative diagram illustrating the identification of abnormal device usage in an embodiment of this application. It uses the operational characteristics of outlier devices detected by the OPTICS algorithm and the degree of anomaly assessed by the iForest model as an example. Figure 4 As shown in (b), step 203 can be performed based on the result of step 202. That is, after identifying outlier devices among the devices to be identified in step 202, step 203 only predicts the degree of anomalousness of the outlier devices based on their operational characteristics. Or, as... Figure 4 As shown in (a), steps 202 and 203 can be executed simultaneously. For example, in step 202, while outlier detection is performed based on the operational characteristics of each device to be identified, step 203 also predicts the degree of abnormality of each device to be identified based on the operational characteristics of each device to be identified (including the degree of abnormality of outlier devices). Then, in step 204, if a device to be identified is identified as an outlier device and its degree of abnormality is greater than a preset degree threshold (i.e., the degree of abnormality of the outlier device is greater than the preset degree threshold), then the outlier device is regarded as an abnormal device.

[0175] In practical applications, some devices may be added to the whitelist through registration for special reasons. Furthermore, to meet business needs, these whitelisted devices can be filtered out in step 201, meaning they are removed from the list of devices to be identified without further data processing. Alternatively, to enrich the sample data, whitelisted devices can be added to the list of devices to be identified, and in step 202, when an outlier device is identified as a whitelisted device, it can be directly treated as a normally used device.

[0176] Furthermore, to facilitate standardized use of the equipment, after identifying an outlier device as an abnormally used device, a prompt message indicating abnormal use of the outlier device can be output.

[0177] The prompts can be displayed in the form of voice announcements, text displays, or indicator lights. There are no restrictions on the specific form of the prompts.

[0178] For example, such as Figure 5 As shown, after determining that an outlier device is an abnormally used device, a prompt message about the abnormal use of the outlier device can be output locally on the electronic device, or the prompt message about the abnormal use of the outlier device can be output to the service terminal of logistics management.

[0179] For example, such as Figure 6 As shown, after identifying an outlier device as an abnormally used device, a notification message about the abnormal use of the device can be output to the management terminal at the site where the outlier device is located. For example, assuming that device 3 is identified as an outlier device in step 202, and the abnormality level of device 3 is detected to be greater than a preset threshold in step 203, then device 3 can be determined to be an abnormally used device, and a notification message about the abnormal use of device 3 can be output to the management terminal 3 at the site where device 3 is located, so that on-site personnel can manage it in a timely manner.

[0180] As can be seen from the above, in the embodiments of this application, firstly, outlier detection is performed based on the operational characteristics of each device to be identified to obtain outlier devices among the devices to be identified. This allows for the initial screening of operational characteristics of outlier devices that may correspond to devices used abnormally. Then, based on preset anomaly degree prediction parameters, the anomaly degree of the outlier devices is predicted according to their operational characteristics to identify devices used abnormally. This further determines whether the outlier devices are used abnormally, thus enabling more accurate identification of devices used abnormally and reducing misjudgments of abnormal usage. Secondly, since it can automatically identify various types of equipment involved in logistics scenarios, there is no need for traditional manual static management methods for monitoring abnormal usage, improving the comprehensiveness and efficiency of identifying devices used abnormally.

[0181] In order to better implement the device abnormal use recognition method in the embodiments of the present application, on the basis of the device abnormal use recognition method, the embodiments of the present application also provide a device abnormal use recognition apparatus, as shown in Figure 7 FIG. 7 is a schematic structural diagram of an embodiment of the device abnormal use recognition apparatus in the embodiments of the present application. The device abnormal use recognition apparatus 700 includes:

[0182] An acquisition unit 701 is configured to acquire operation features of each to-be-recognized device.

[0183] A detection unit 702 is configured to perform outlier detection based on the operation features of each to-be-recognized device to obtain outlier devices in the to-be-recognized devices.

[0184] A prediction unit 703 is configured to perform prediction based on preset abnormality degree prediction parameters and the operation features of the outlier devices to obtain abnormality degrees of the outlier devices.

[0185] An identification unit 704 is configured to determine that the outlier devices are abnormal use devices if the abnormality degrees are greater than a preset degree threshold.

[0186] In some embodiments of the present application, the detection unit 702 is specifically configured to:

[0187] perform clustering on the to-be-recognized devices according to the operation features of the to-be-recognized devices by using a preset clustering algorithm to obtain the outlier devices in the to-be-recognized devices.

[0188] In some embodiments of the present application, before the prediction based on the preset abnormality degree prediction parameters and the operation features of the outlier devices to obtain the abnormality degrees of the outlier devices, the prediction unit 703 is specifically configured to:

[0189] acquire operation features of each sample device;

[0190] train a preset isolated forest according to the operation features of the sample devices to obtain a trained isolated forest;

[0191] use model parameters of the trained isolated forest as the abnormality degree prediction parameters.

[0192] In some embodiments of the present application, the detection unit 702 is specifically configured to:

[0193] perform encoding on the operation features of the to-be-recognized devices based on feature encoding parameters learned in advance to obtain target encoding features of the operation features of the to-be-recognized devices;

[0194] decode the target coding feature by using the feature decoding parameter obtained through pre-learning, to obtain target decoding features of the operation features of the devices to be identified;

[0195] Based on the similarity between the operation features of the devices to be identified and the target decoding features, it is determined whether the devices to be identified are outlier data, to obtain outlier devices among the devices to be identified.

[0196] In some embodiments of the present application, the acquisition unit 701 is specifically configured to:

[0197] Acquire device usage data of the devices to be identified;

[0198] Acquire device statistical data of the devices to be identified;

[0199] Based on the device usage data of the devices to be identified and the device statistical data of the devices to be identified, obtain operation features of the devices to be identified.

[0200] In some embodiments of the present application, the acquisition unit 701 is specifically configured to:

[0201] If the devices to be identified are networked devices, the operation features of the devices to be identified are collected in real time through a big data burying point method;

[0202] If the devices to be identified are non-networked devices, the operation features of the devices to be identified are collected in real time through networked devices.

[0203] In some embodiments of the present application, the device abnormal use identification apparatus 700 further comprises an output unit (not shown in the figure), and after it is determined that the outlier device is an abnormal use device, the output unit is specifically configured to:

[0204] Output prompt information of the outlier device abnormal use.

[0205] In implementation, each of the above units can be implemented as an independent entity, or can be combined as the same or several entities, and the specific implementation of each of the above units can refer to the method embodiments in the foregoing, which will not be repeated here.

[0206] Since the device abnormal use identification apparatus can perform the method of the present application as described above, Figures 1 to 6 corresponding to the steps in the device abnormal use identification method in any embodiment, the method of the present application as described above, Figures 1 to 6 corresponding to the beneficial effects that can be achieved by the device abnormal use identification method in any embodiment, which are described in detail in the foregoing, and will not be repeated here.

[0207] Further, in order to implement the device abnormal use recognition method in the embodiments of the present application better, based on the device abnormal use recognition method, the embodiments of the present application further provide an electronic device, refer to Figure 8 , Figure 8 A structural schematic diagram of the electronic device in the embodiments of the present application is shown, specifically, the electronic device provided by the embodiments of the present application includes a processor 801, the processor 801 is used to implement the device abnormal use recognition method as described above when executing the computer program stored in a memory 802. Figures 1 to 6 corresponding to the steps of the device abnormal use recognition method in any embodiment; or the processor 801 is used to implement the functions of the units in the embodiments as described above when executing the computer program stored in the memory 802. Figure 7 corresponding to the functions of the units in the embodiments.

[0208] For example, the computer program can be divided into one or more modules / units, one or more modules / units are stored in the memory 802 and executed by the processor 801 to complete the embodiments of the present application. One or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which is used to describe the execution process of the computer program in the computer device.

[0209] The electronic device can include, but is not limited to, the processor 801 and the memory 802. Those skilled in the art can understand that the schematic diagram is only an example of the electronic device and does not constitute a limitation on the electronic device, and can include more or fewer components than the schematic diagram, or combine certain components, or different components, for example, the electronic device can also include an input / output device, a network access device, a bus, etc., the processor 801, the memory 802, the input / output device and the network access device are connected through the bus.

[0210] The processor 801 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The processor is the control center of the electronic device, and connects all parts of the electronic device through various interfaces and lines.

[0211] The memory 802 can be used to store computer programs and / or modules. The processor 801 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 802 and by calling the data stored in the memory 802. The memory 802 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device (such as audio data, video data, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0212] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described equipment malfunction identification device, electronic equipment, and its corresponding units can be found in, for example... Figures 1 to 6 The description of the device abnormal usage identification method corresponding to any embodiment will not be repeated here.

[0213] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0214] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute the present application. Figures 1 to 6 For the steps in the device abnormal use identification method corresponding to any embodiment, please refer to the following for specific operations: Figures 1 to 6 The description of the device abnormal usage identification method in any embodiment will not be repeated here.

[0215] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0216] Because of the instructions stored in the computer-readable storage medium, the present application can be executed as described above. Figures 1 to 6 Corresponding to the steps in the device abnormal use identification method in any embodiment, this application can be implemented as described above. Figures 1 to 6Corresponding to the beneficial effects that can be achieved by the device abnormal use identification method in any embodiment, the details are described above, and will not be repeated here.

[0217] The above describes in detail the device abnormal use identification method, device, electronic device and computer readable storage medium provided by the embodiments of the present application. The principles and implementation manners of the present application are described by applying specific examples. The above embodiment description is only used to help understand the method and core idea of the present application. Meanwhile, for those skilled in the art, the specific implementation manner and application range will be changed according to the idea of the present application. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A device abnormal use recognition method characterized by, The method comprises: obtaining operation characteristics of each to-be-identified device; performing outlier detection based on the operation characteristics of each to-be-identified device to obtain outlier devices among the to-be-identified devices; based on a preset abnormality degree prediction parameter, predicting the abnormality degree of the outlier devices according to the operation characteristics of the outlier devices; if the abnormality degree is greater than a preset degree threshold, determining that the outlier devices are abnormal use devices; wherein, the outlier detection based on the operation characteristics of each to-be-identified device to obtain outlier devices among the to-be-identified devices comprises: based on a pre-learned feature encoding parameter, encoding the operation characteristics of each to-be-identified device to obtain target encoded features of the operation characteristics of each to-be-identified device; decoding the target encoded features by a pre-learned feature decoding parameter to obtain target decoded features of the operation characteristics of each to-be-identified device; based on the similarity between the operation characteristics of each to-be-identified device and the target decoded features, determining whether each to-be-identified device is an outlier device to obtain outlier devices among the to-be-identified devices; wherein, the feature encoding parameter and the feature decoding parameter are learned by a self-encoder; the self-encoder is learned by the following steps: obtaining operation characteristics of a plurality of normal use devices; training the self-encoder by taking the operation characteristics of the plurality of normal use devices as the input of the self-encoder to be learned to obtain a learned self-encoder.

2. The device abnormal use recognition method according to claim 1, characterized by, The outlier detection based on the operation characteristics of each to-be-identified device to obtain outlier devices among the to-be-identified devices comprises: performing clustering on each to-be-identified device according to the operation characteristics of each to-be-identified device by a preset clustering algorithm to obtain outlier devices among the to-be-identified devices.

3. The device abnormal use recognition method of claim 1, wherein Before the prediction of the abnormality degree of the outlier devices based on the preset abnormality degree prediction parameter according to the operation characteristics of the outlier devices, it further comprises: obtaining operation characteristics of each sample device; training a preset isolation forest according to the operation characteristics of each sample device to obtain a trained isolation forest; taking the model parameters of the trained isolation forest as the abnormality degree prediction parameter.

4. The device abnormal use recognition method of claim 1, wherein The operation characteristics of each to-be-identified device are obtained by: obtaining device usage data of each to-be-identified device; obtaining device statistical data of each to-be-identified device; obtaining operation characteristics of each to-be-identified device based on the device usage data of each to-be-identified device and the device statistical data of each to-be-identified device.

5. The device abnormal use recognition method of claim 1, wherein The operation characteristics of each to-be-identified device are obtained by: if each to-be-identified device is a connected device, the operation characteristics of each to-be-identified device are collected in real time by a big data burying method; if each to-be-identified device is a non-connected device, the operation characteristics of each to-be-identified device are collected in real time by a connected device.

6. The device misuse recognition method according to any one of claims 1 to 5, characterized by, After determining that the outlier devices are abnormal use devices, it further comprises: outputting prompt information of the abnormal use of the outlier devices.

7. An apparatus abnormal use recognition device characterized by comprising: The device abnormal use identification apparatus comprises: An acquisition unit is configured to acquire operation characteristics of each to-be-identified device; A detection unit is configured to perform outlier detection based on the operation characteristics of each to-be-identified device, to obtain outlier devices among the to-be-identified devices; A prediction unit is configured to perform prediction based on preset abnormality degree prediction parameters and the operation characteristics of the outlier devices, to obtain abnormality degrees of the outlier devices; An identification unit is configured to determine that the outlier devices are abnormal use devices if the abnormality degrees are greater than a preset degree threshold; The detection unit is configured to: Encode the operation characteristics of each to-be-identified device based on pre-learned feature encoding parameters, to obtain target encoded features of the operation characteristics of each to-be-identified device; Decode the target encoded features based on pre-learned feature decoding parameters, to obtain target decoded features of the operation characteristics of each to-be-identified device; Determine whether each to-be-identified device is outlier data based on similarities between the operation characteristics of each to-be-identified device and the target decoded features, to obtain outlier devices among the to-be-identified devices; The feature encoding parameters and the feature decoding parameters are obtained through a self-encoder; and the self-encoder is obtained through the following steps: Acquire operation characteristics of a plurality of normal use devices; Use the operation characteristics of the plurality of normal use devices as input of a to-be-learned self-encoder, to train the self-encoder, and obtain a learned self-encoder.

8. An electronic device, comprising: A processor and a memory, the memory stores a computer program, and the processor invokes the computer program in the memory to execute the device abnormal use identification method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in the device abnormal use identification method in any one of claims 1 to 6.

Images