Iot card risk level processing method and device, server and storage medium

Abstract

The application provides a kind of Internet of Things card risk level processing method, device, server and storage medium, the method comprises: collecting the feature data corresponding to multiple features of Internet of Things card, pre-processing the feature data corresponding to multiple features, obtain the feature data corresponding to multiple features after pre-processing, according to the feature data corresponding to multiple features after pre-processing, entropy weight method is used to calculate the entropy weight of each feature respectively, according to the entropy weight of each feature, obtain the risk coefficient of Internet of Things card, according to the risk coefficient of Internet of Things card, obtain the risk level of Internet of Things card, the risk level of Internet of Things card is sent to security monitoring platform, to make security monitoring platform according to the risk level of Internet of Things card warning for relevant personnel disposal.The application calculates the risk coefficient of each Internet of Things card and divides risk level by using the strategy of entropy weight method, realizes the improvement of Internet of Things card risk monitoring accuracy.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to a method, apparatus, server, and storage medium for processing the risk level of IoT cards. Background Technology

[0002] As one of the core carriers of the Internet of Things (IoT), IoT SIM cards are currently widely used in intelligent terminal devices requiring wireless data transmission, such as intelligent transportation, smart healthcare, connected vehicles, and smart wearable devices. Initially, major operators only offered IoT SIM card services to enterprise customers and did not sell them to individual users. However, with the diversification of business scenarios, numerous security risks have emerged in the sales and use of IoT SIM cards, making risk monitoring of IoT SIM cards crucial.

[0003] Currently, the existing technology uses the analytic hierarchy process (AHP) to monitor the risk level of IoT cards. This involves eliminating unreasonable weights, setting weights for different indicators, and then calculating the risk level of the IoT card.

[0004] However, in existing technologies, when there are too many indicators to calculate, it becomes impossible to accurately determine the importance of the indicators, and thus impossible to accurately set the weights of the indicators. The weight setting is affected by subjective human factors, resulting in poor accuracy in risk monitoring of IoT cards. Summary of the Invention

[0005] This application provides a method, device, server, and storage medium for processing the risk level of IoT cards. It calculates the risk coefficient of each IoT card by adopting the entropy weight method and classifies the risk level of IoT cards to solve the problem of poor accuracy in risk monitoring of IoT cards caused by the influence of human subjective factors on weight setting.

[0006] Firstly, this application provides a method for handling the risk level of an Internet of Things (IoT) card, including:

[0007] Collect IoT card data, wherein the collected IoT card data includes feature data corresponding to multiple features;

[0008] The feature data corresponding to the multiple features are preprocessed to obtain the preprocessed feature data corresponding to the multiple features.

[0009] Based on the feature data corresponding to the preprocessed multiple features, the entropy weight of each feature is calculated using the entropy weight method.

[0010] The risk coefficient of the IoT card is obtained based on the entropy weight of each feature.

[0011] The risk level of the IoT card is obtained based on the IoT card risk coefficient.

[0012] The Internet of Things card risk level is sent to a security monitoring platform, so that the security monitoring platform gives an early warning according to the Internet of Things card risk level for relevant personnel to handle.

[0013] In a possible design, the entropy weight method is used to calculate the entropy weight of each feature according to the feature data corresponding to the preprocessed features.

[0014] The feature data corresponding to each preprocessed feature is subjected to a de-dimensioning process to obtain standardized feature data corresponding to each feature.

[0015] According to each standardized feature data, a difference coefficient of the standardized feature data is obtained.

[0016] According to the difference coefficient of each standardized feature data, an information entropy of each feature is obtained.

[0017] According to the information entropy of each feature, an entropy weight of each feature is calculated.

[0018] In a possible design, after the Internet of Things card risk coefficient is obtained according to the entropy weight of each feature, the method further includes:

[0019] The Internet of Things card risk coefficient is subjected to k-s test to obtain a p_value value.

[0020] If the p_value value is greater than a preset significance level, it is determined that the Internet of Things card risk coefficient satisfies a normal distribution; if the p_value value does not satisfy the condition of being greater than the preset significance level, it is determined that the Internet of Things card risk coefficient does not satisfy the normal distribution, and a new entropy weight is selected.

[0021] In a possible design, if the p_value value does not satisfy the condition of being greater than the preset significance level, it is determined that the Internet of Things card risk coefficient does not satisfy the normal distribution, and a new entropy weight is selected, including:

[0022] A skewness coefficient is calculated according to the Internet of Things card risk coefficient.

[0023] If the skewness coefficient is greater than 1 or less than -1, it is determined that the distribution is highly skewed, and the entropy weight of each feature is taken as the logarithm with base 10 as the new entropy weight.

[0024] If the skewness coefficient is between 0.5 and 1 or -1 and -0.5, it is determined that the distribution is moderately skewed, and the entropy weight of each feature is taken as the natural logarithm as the new entropy weight.

[0025] If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the entropy weight of each feature is used as the new entropy weight.

[0026] In one possible design, obtaining the IoT card risk coefficient based on the entropy weight of each feature includes:

[0027] The entropy weight of each feature is multiplied by the feature data corresponding to each preprocessed feature to obtain the weight of each feature of the IoT card;

[0028] The risk coefficient of the IoT card is obtained by summing the weights of each feature of the IoT card.

[0029] In one possible design, the preprocessing of the feature data corresponding to the plurality of features to obtain preprocessed feature data corresponding to the plurality of features includes:

[0030] Detect the feature data corresponding to the multiple features;

[0031] If erroneous data is detected in the feature data, the average of the two observations before and after the erroneous data is used to replace the erroneous data.

[0032] If missing data is detected in the feature data, the median of the feature is used to fill the missing data;

[0033] If duplicate data is detected in the feature data, the duplicate data is deleted directly.

[0034] If noisy data is detected in the feature data, a clustering algorithm is used to group similar features together and remove outliers.

[0035] Secondly, this application provides an IoT card risk level processing device, comprising:

[0036] The data acquisition module is used to collect feature data corresponding to multiple features of the IoT card;

[0037] The data preprocessing module is used to preprocess the feature data corresponding to the multiple features to obtain the preprocessed feature data corresponding to the multiple features.

[0038] The entropy weight calculation module is used to calculate the entropy weight of each feature based on the feature data corresponding to the preprocessed multiple features, using the entropy weight method.

[0039] The risk coefficient calculation module is used to obtain the IoT card risk coefficient based on the entropy weight of each feature.

[0040] The risk level processing module is used to obtain the risk level of the IoT card based on the risk coefficient of the IoT card;

[0041] The risk output module is used to send the risk level of the IoT card to the security monitoring platform, so that the security monitoring platform can issue an early warning based on the risk level of the IoT card for relevant personnel to handle.

[0042] In one possible design, the entropy weight calculation module is specifically used for: performing dimensionless processing on the feature data corresponding to each preprocessed feature to obtain standardized feature data corresponding to each feature; obtaining the difference coefficient of each standardized feature data based on each standardized feature data; obtaining the information entropy of each feature based on the difference coefficient of each standardized feature data; and calculating the entropy weight of each feature based on the information entropy of each feature.

[0043] Thirdly, this application provides a server, including: at least one processor and a memory;

[0044] The memory stores computer-executed instructions;

[0045] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the IoT card risk level processing method as described in the first aspect and various possible designs of the first aspect.

[0046] Fourthly, this application provides a computer storage medium storing computer execution instructions, which, when executed by a processor, implement the IoT card risk level processing method described in the first aspect and various possible designs of the first aspect.

[0047] The IoT card risk level processing method, device, server, and storage medium provided in this application calculate the weight value of each feature of the IoT card using the entropy weight method. The risk coefficient of each IoT card is calculated using the weight value of each feature and the feature data of each IoT card. The risk level of each IoT card is divided according to the risk coefficient of each IoT card. Risk warning is performed using the risk level of the IoT card, which can reduce the influence of subjective factors and achieve accurate risk monitoring of IoT cards. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a schematic diagram illustrating an application scenario of the IoT card risk level processing method provided in the embodiments of this application;

[0050] Figure 2 Flowchart of the IoT card risk level processing method provided in this application embodiment Figure 1 ;

[0051] Figure 3 Flowchart of the IoT card risk level processing method provided in this application embodiment Figure 2 ;

[0052] Figure 4 This is a schematic diagram of the IoT card risk level processing device provided in the embodiments of this application;

[0053] Figure 5 This is a schematic diagram of the hardware structure of the server provided in an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0055] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0056] As one of the core carriers of the Internet of Things (IoT), IoT SIM cards refer to mobile communication services provided by operators using dedicated IoT number segments and networks. They offer functions such as SMS, voice, and data traffic and are currently widely used in intelligent terminal devices requiring wireless data transmission, such as intelligent transportation, smart healthcare, connected vehicles, and smart wearable devices. Due to the large issuance volume of IoT SIM cards, they have become tools for criminals to conduct cybercrime. Current technologies commonly use the Analytic Hierarchy Process (AHP) to evaluate the risks of IoT SIM cards. First, experts subjectively assign weights to risk indicators of the IoT SIM cards. Then, a random sampling consensus algorithm is used to filter out unreasonable weights from some experts, and the remaining weights fitted by multiple experts for the same risk indicator are used as the final weight value of the IoT SIM card risk indicator. However, when there are too many IoT SIM card risk indicators to calculate and the data volume is large, judging the importance between each pair of risk indicators may become difficult, and may even affect the consistency of the hierarchical single ranking and overall ranking, causing the consistency test to fail. The setting of risk indicator weights is influenced by subjective human factors, leading to poor accuracy in IoT SIM card risk monitoring.

[0057] To address the aforementioned technical problems, this application proposes the following technical concept: Based on feature data obtained from processing IoT card data, an entropy weighting method is used to calculate the weight value of each feature of the IoT card, and a risk coefficient for each IoT card is calculated. Based on the risk coefficient of each IoT card, a risk level is assigned to each IoT card. Using the risk level of the IoT card for risk warning can reduce the influence of subjective factors and achieve accurate risk monitoring of the IoT card. Detailed embodiments are described below.

[0058] Figure 1 This is a schematic diagram illustrating an application scenario of the IoT card risk level processing method provided in this application embodiment. For example... Figure 1 As shown, the system provided in this embodiment includes: server 101, IoT card 102, and security monitoring platform 103.

[0059] The server 101 is used to collect IoT card data from IoT card 102, process the IoT card risk level of IoT card 102, and finally send the IoT card risk level of IoT card 102 to security monitoring platform 103, so that security monitoring platform 103 can issue an early warning based on the IoT card risk level for relevant personnel to handle.

[0060] Figure 2 Flowchart of the IoT card risk level processing method provided in this application embodiment Figure 1 The execution entity in this embodiment can be Figure 2 The server 101 in the illustrated embodiment is not specifically limited in this embodiment. Figure 3As shown, the method includes:

[0061] S201: Collect IoT card data, which includes feature data corresponding to multiple features.

[0062] Specifically, IoT SIM card data can be collected by acquiring a large amount of IoT SIM card sample data from various IoT platforms via API (Application Programming Interface). This sample data includes IoT internet access logs, real-time base station location information, signaling data, government and enterprise data, and business data. After acquiring a large amount of sample data from various IoT platforms, it is stored in a structured format using a two-dimensional table. Principal component analysis is then used to map the sample data from 5-dimensional features to 3-dimensional features, reconstructing 3-dimensional features. Real-time base station location, real-time call detail record (CDR) usage, and real-time traffic information are selected as feature data, and these 3-dimensional feature data are simultaneously saved into a Hive table.

[0063] Hive tables are a data warehouse tool used for data extraction, transformation, and loading. Hive data warehouse tools can map structured data files to a database table and provide data query functions.

[0064] S202: Preprocess the feature data corresponding to multiple features to obtain the preprocessed feature data corresponding to multiple features.

[0065] The preprocessing task is to filter out feature data that does not meet the requirements. There are four main types of feature data that do not meet the requirements:

[0066] The first category is erroneous data. This type of data arises because IoT platforms at various levels are not robust enough, and input is written directly to the backend database without proper evaluation. Examples include numerical data being output as full-width numeric characters, strings containing an extra carriage return, incorrect date formats, and dates exceeding the data bounds. The second category is missing data. This type of data may be caused by the temporary unavailability of IoT card sample data, or by human error resulting in data not being recorded, being omitted, or being lost. The third category is duplicate data. Duplicate data is only considered a repeated value when all data in two records are equal. This type of data may be caused by duplicate storage. The fourth category is noisy data. This category mainly includes erroneous data, false data, and discrete data that significantly impacts the data analysis results.

[0067] Specifically, if erroneous data is detected in the feature data, the average of the two observations before and after the erroneous data is used to replace the erroneous data; if missing data is detected in the feature data, the median of the feature is used to fill the missing data; if duplicate data is detected in the feature data, the duplicate data is directly deleted; if noisy data is detected in the feature data, a clustering algorithm is used to aggregate similar features together and remove outliers.

[0068] S203: Based on the feature data corresponding to the multiple preprocessed features, the entropy weight method is used to calculate the entropy weight of each feature.

[0069] Specifically, S203 includes Sa to Sd:

[0070] Sa: Perform dimensionless processing on the feature data corresponding to each preprocessed feature to obtain the standardized feature data corresponding to each feature;

[0071] The main purpose of the dimensionless processing is to unify the IoT card feature data of different magnitudes into the same magnitude, so that the IoT card feature data follows a standard normal distribution.

[0072] Specifically, normalization can be used to descale the feature data corresponding to each preprocessed feature, scaling the data to the range of 0 to 1 without changing the distribution shape of the feature data.

[0073] For example, suppose we are given m features: X1, X2, X3, ..., X m X i ={x1,x2,x3,…,x n} where n is the number of IoT cards, and each feature contains n feature data. Assume the values ​​after dedimensionalization of each feature are Y1, Y2, Y3, ..., Y... m ,So

[0074] When this feature data is greater than 0, Y ij =X ij -min(X i ) / max(X i )-min(X i );

[0075] When this feature data is less than 0, Y ij =max(X i )-X ij / max(X i )-min(X i ),

[0076] Where i = 1, 2, 3, ..., m, j = 1, 2, 3, ..., n. Xij Y represents the value of the j-th feature data within the i-th feature; ij Let represent the normalized value of the j-th feature data within the i-th feature. min(X) i ) represents the value of the smallest feature data among the i-th features; max(X) i ) represents the value of the largest feature data in the i-th feature.

[0077] Sb: Based on each standardized feature data, obtain the difference coefficient of each standardized feature data.

[0078] Here, the difference coefficient of each standardized feature data refers to the proportion p of the feature data of the j-th IoT card under the i-th feature. ij The calculation formula is as follows:

[0079]

[0080] Where i = 1, 2, 3, ..., m. ij This represents the value of the standardized feature data of the j-th IoT card under the i-th feature.

[0081] Sc: The information entropy of each feature is obtained based on the difference coefficient of each standardized feature data.

[0082] For example, the information entropy E of the i-th feature i The calculation formula is as follows:

[0083]

[0084] Where n is the number of IoT cards. i = 1, 2, 3, ..., m.

[0085] Sd: Calculate the entropy weight of each feature based on the information entropy of each feature.

[0086] Specifically, the weight ω of each feature entropy value i The calculation formula is as follows:

[0087] ω i =(1-E i ) / (n-∑E i )

[0088] Where n is the number of IoT cards. i = 1, 2, 3, ..., m.

[0089] S204: Obtain the IoT card risk coefficient based on the entropy weight of each feature.

[0090] Specifically, S204 includes Se to Sf:

[0091] Se: Multiply the entropy weight of each feature by the preprocessed feature data corresponding to each feature to obtain the weight of each feature of the IoT card.

[0092] Sf: The risk coefficient of the IoT card is obtained by summing the weights of each feature of the IoT card.

[0093] Specifically, the risk coefficient f of IoT cards j The calculation formula is as follows:

[0094]

[0095] Where j = 1, 2, 3, ..., n.

[0096] S205: Obtain the risk level of the IoT card based on the IoT card risk coefficient.

[0097] Specifically, if the risk coefficient of an IoT card follows a normal distribution, then the risk level of the IoT card is classified, and the average value μ and variance σ of the risk coefficient of the IoT card are calculated. 2 The calculation formula is as follows:

[0098]

[0099]

[0100] Where n is the number of IoT cards.

[0101] Specifically, if the risk coefficient f of the IoT card j Satisfying μ-σ <f j If the value is less than μ+σ, then the risk level of the IoT card is determined to be low risk.

[0102] If the risk coefficient of the IoT card is f j Satisfying μ-2σ <f j If the risk level is less than μ+2σ, then the IoT card is classified as medium risk.

[0103] If the risk coefficient of the IoT card is f j Satisfy f j <μ-2σ or f j If the value is greater than μ+2σ, then the risk level of the IoT card is determined to be high risk.

[0104] S206: Send the risk level of the IoT card to the security monitoring platform so that the security monitoring platform can issue an early warning based on the risk level of the IoT card for relevant personnel to handle.

[0105] Specifically, the server sends the risk level of the IoT card to the security monitoring platform. The security monitoring platform sends a warning to the device where the IoT card is located if it is at medium risk, and cancels or blocks the IoT card if it is at high risk.

[0106] The IoT card risk level processing method provided in this embodiment calculates the weight value of each feature of the IoT card using the entropy weight method. It then calculates the risk coefficient of each IoT card using the weight value of each feature and the feature data of each IoT card. Based on the risk coefficient of each IoT card, the risk level of each IoT card is divided. By using the risk level of the IoT card for risk warning, the influence of subjective factors can be reduced, and accurate risk monitoring of IoT cards can be achieved.

[0107] Figure 2 Flowchart of the IoT card risk level processing method provided in this application embodiment Figure 2 In the embodiments of this application, in Figure 3 Based on the provided embodiments, S204 onwards provides a detailed explanation of the specific implementation method for determining whether the risk coefficient of the IoT card satisfies a normal distribution. The execution entity in this embodiment can be... Figure 4 The server 101 in the illustrated embodiment is not particularly limited in this embodiment.

[0108] like Figure 4 As shown, the method includes:

[0109] S201: Collect IoT card data, which includes feature data corresponding to multiple features.

[0110] S202: Preprocess the feature data corresponding to multiple features to obtain the preprocessed feature data corresponding to multiple features.

[0111] S203: Based on the feature data corresponding to the multiple preprocessed features, the entropy weight method is used to calculate the entropy weight of each feature.

[0112] S204: Obtain the IoT card risk coefficient based on the entropy weight of each feature.

[0113] S401: Perform the KS test on the risk coefficient of the IoT card to obtain the p_value.

[0114] The KS test is a non-parametric test commonly used to determine whether a sample conforms to a pre-given distribution, or whether the probability distributions of two samples are different. In other words, it checks whether it is reliable to claim that an observed sample follows a certain distribution.

[0115] Specifically, determine whether the risk coefficient of the IoT card follows (μ, σ) 2 Given a normal distribution, write down the hypothesis:

[0116] H0: Risk coefficient of IoT card X~N(μ,σ) 2 )

[0117] H1: The risk coefficient of IoT cards does not follow the distribution shown above.

[0118] The risk levels of IoT cards are sorted in ascending order, according to a table. That is, the rejection region of H0 Where n is the number of IoT cards, and D is calculated using the following formula:

[0119] d k1 =|F n (x k )-F0(x k )|

[0120] d k2 =|F n (x k )-F0(x k-1 )|

[0121] δ k =max(d k1 ,d k2 )

[0122] D = max(δ) k )

[0123] Among them, F n F0(x) = N / n, where N is the cumulative number of times. The existing function in Excel, =NORM.DIST(x,μ,σ,TRUE), is used to calculate F0(x), where x is the risk coefficient of the IoT card.

[0124] S402: If the p_value is greater than the preset significance level of 0.05, then the IoT card risk coefficient is determined to meet the normal distribution; if the p_value is not greater than the preset significance level of 0.05, then the IoT card risk coefficient is determined to not meet the normal distribution, and a new entropy value weight is selected.

[0125] Specifically, if p value >0.05, that is The risk coefficient of the IoT card is determined to follow a normal distribution. If p_value < 0.05, that is... If the risk coefficient of the IoT card does not meet the normal distribution, a new entropy value weight is selected.

[0126] Specifically, this includes Sg-Sh:

[0127] Sg: Calculate the skewness coefficient based on the risk coefficient of the IoT card.

[0128] Specifically, the formula for calculating the skewness coefficient SK is as follows:

[0129]

[0130]

[0131] Where n is the number of IoT cards, and x is the risk coefficient of the IoT cards. denoted as the average risk coefficient of the sample IoT cards, and s is the standard deviation of the risk coefficient of the IoT cards.

[0132] Sh: If the skewness coefficient is greater than 1 or less than -1, it is determined to be a highly skewed distribution, and the logarithm of the entropy weight of each feature is taken to the base 10 as the new entropy weight.

[0133] Specifically, the new entropy weight ω i for

[0134] ω i =log 10 ((1-E i ) / (n-∑E i ))

[0135] If the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the natural logarithm of the entropy weight of each feature is taken as the new entropy weight.

[0136] Specifically, the new entropy weight ω i for

[0137] ω i =ln((1-E) i ) / (n-∑E i ))

[0138] If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the entropy weight of each feature is used as the new entropy weight.

[0139] Specifically, the new entropy weight ω i for

[0140]

[0141] S205: Obtain the risk level of the IoT card based on the IoT card risk coefficient.

[0142] S206: Send the risk level of the IoT card to the security monitoring platform so that the security monitoring platform can issue an early warning based on the risk level of the IoT card for relevant personnel to handle.

[0143] The IoT card risk level processing method provided in this embodiment calculates the p-value by performing a KS test on the IoT card risk coefficient, and determines whether the IoT card risk coefficient meets a normal distribution, thereby determining whether the calculated IoT card risk coefficient is valid. By adjusting the entropy weight, non-normally distributed data is processed, thereby ensuring the validity of the IoT card risk coefficient.

[0144] Figure 5 This is a schematic diagram of the IoT card risk level processing device provided in an embodiment of this application. Figure 5 As shown, the IoT card risk level processing device includes: a data acquisition module 401, a data preprocessing module 402, an entropy weight calculation module 403, a risk coefficient calculation module 404, a risk level processing module 405, and a risk output module 406.

[0145] Data acquisition module 401 is used to acquire feature data corresponding to multiple features of IoT cards;

[0146] The data preprocessing module 402 is used to preprocess the feature data corresponding to multiple features to obtain the preprocessed feature data corresponding to multiple features.

[0147] The entropy weight calculation module 403 is used to calculate the entropy weight of each feature based on the feature data corresponding to multiple preprocessed features using the entropy weight method.

[0148] The risk coefficient calculation module 404 is used to obtain the IoT card risk coefficient based on the entropy weight of each feature.

[0149] The risk level processing module 405 is used to obtain the risk level of the IoT card based on the IoT card risk coefficient.

[0150] The risk output module 406 is used to send the risk level of the IoT card to the security monitoring platform, so that the security monitoring platform can issue an early warning based on the risk level of the IoT card for relevant personnel to handle.

[0151] In one possible implementation, the data preprocessing module 402 is specifically used to: detect feature data corresponding to multiple features; if erroneous data is detected in the feature data, the average of the two observations before and after the erroneous data is used to replace the erroneous data; if missing data is detected in the feature data, the median of the feature is used to fill the missing data; if duplicate data is detected in the feature data, the duplicate data is directly deleted; if noisy data is detected in the feature data, a clustering algorithm is used to aggregate similar features together and remove outliers.

[0152] In one possible implementation, the entropy weight calculation module 403 is specifically used to: perform dimensionless processing on the feature data corresponding to each preprocessed feature to obtain standardized feature data corresponding to each feature; obtain the difference coefficient of each standardized feature data based on each standardized feature data; obtain the information entropy of each feature based on the difference coefficient of each standardized feature data; and calculate the entropy weight of each feature based on the information entropy of each feature.

[0153] In one possible implementation, the risk coefficient calculation module 404 is specifically used to: multiply the entropy weight of each feature by the feature data corresponding to each preprocessed feature to obtain the weight of each feature of the IoT card; and sum the weights of each feature of the IoT card to obtain the risk coefficient of the IoT card.

[0154] In one possible implementation, the IoT SIM card risk level processing device further includes a verification module, which is specifically used to: perform a KS test on the IoT SIM card risk coefficient to obtain a p_value. If the p_value is greater than a preset significance level, it is determined that the IoT SIM card risk coefficient meets a normal distribution; if the p_value does not meet the preset significance level, it is determined that the IoT SIM card risk coefficient does not meet a normal distribution, and a new entropy weight is selected.

[0155] In one possible implementation, the IoT card risk level processing device further includes a skewness coefficient calculation module. This module is specifically used to: calculate a skewness coefficient based on the IoT card risk coefficient. If the skewness coefficient is greater than 1 or less than -1, it is determined to be a highly skewed distribution, and the logarithm of each feature entropy value weight is taken as the new entropy value weight. If the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the natural logarithm of each feature entropy value weight is taken as the new entropy value weight. If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of each feature entropy value weight is taken as the new entropy value weight.

[0156] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0157] ​ This is a schematic diagram of the hardware structure of the server provided in an embodiment of this application. ​ As shown, the server 101 in this embodiment includes: a processor 1011 and a memory 1012; wherein

[0158] The processor 1011 is used to execute computer execution instructions stored in the memory to implement the various steps performed by the server in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments;

[0159] Memory 1012 is used to store computer-executed instructions.

[0160] Alternatively, the memory 1012 can be either standalone or integrated with the processor 1011.

[0161] When the memory 1012 is configured independently, the server also includes a bus 1013 for connecting the memory 1012 and the processor 1011.

[0162] This application embodiment also provides a computer storage medium storing computer execution instructions. When the processor executes the computer execution instructions, the IoT card risk level processing method described above is implemented.

[0163] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements the IoT card risk level processing method described above.

[0164] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0165] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0166] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0167] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0168] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0169] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0170] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0171] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0172] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0173] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for handling the risk level of an Internet of Things (IoT) card, characterized in that, Applied to servers, including: Collect IoT card data, wherein the collected IoT card data includes feature data corresponding to multiple features; The feature data corresponding to the multiple features are preprocessed to obtain the preprocessed feature data corresponding to the multiple features. Based on the feature data corresponding to the preprocessed multiple features, the entropy weight of each feature is calculated using the entropy weight method. The risk coefficient of the IoT card is obtained based on the entropy weight of each feature. The risk level of the IoT card is obtained based on the IoT card risk coefficient. The risk level of the IoT card is sent to the security monitoring platform so that the security monitoring platform can issue an early warning based on the risk level of the IoT card for relevant personnel to handle. After obtaining the IoT card risk coefficient based on the entropy weight of each feature, the process further includes: The risk coefficient of the IoT card is subjected to the KS test to obtain the p_value. Calculate the skewness coefficient based on the IoT card risk coefficient; If the p_value is greater than the preset significance level, then the risk coefficient of the IoT card is determined to follow a normal distribution. If the p_value does not meet the requirement of being greater than the preset significance level, and if the skewness coefficient is greater than 1 or less than -1, then it is determined to be a highly skewed distribution, and the logarithm of the entropy weight of each feature is taken to the base 10 as the new entropy weight. If the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the natural logarithm of the entropy weight of each feature is taken as the new entropy weight. If the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the entropy weight of each feature is used as the new entropy weight.

2. The method according to claim 1, characterized in that, The step of calculating the entropy weight of each feature based on the feature data corresponding to the preprocessed multiple features using the entropy weight method includes: The dimensionless processing is performed on the feature data corresponding to each preprocessed feature to obtain the standardized feature data corresponding to each feature. Based on each standardized feature data, the difference coefficient of each standardized feature data is obtained; Based on the difference coefficient of each standardized feature data, the information entropy of each feature is obtained; Calculate the entropy weight of each feature based on its information entropy.

3. The method according to claim 1, characterized in that, The step of obtaining the IoT card risk coefficient based on the entropy weight of each feature includes: The entropy weight of each feature is multiplied by the feature data corresponding to each preprocessed feature to obtain the weight of each feature of the IoT card; The risk coefficient of the IoT card is obtained by summing the weights of each feature of the IoT card.

4. The method according to any one of claims 1 to 3, characterized in that, The step of preprocessing the feature data corresponding to the plurality of features to obtain preprocessed feature data corresponding to the plurality of features includes: Detect the feature data corresponding to the multiple features; If erroneous data is detected in the feature data, the average of the two observations before and after the erroneous data is used to replace the erroneous data. If missing data is detected in the feature data, the median of the feature is used to fill the missing data; If duplicate data is detected in the feature data, the duplicate data is deleted directly. If noisy data is detected in the feature data, a clustering algorithm is used to group similar features together and remove outliers.

5. An IoT card risk level processing device, characterized in that, include: The data acquisition module is used to collect feature data corresponding to multiple features of the IoT card; The data preprocessing module is used to preprocess the feature data corresponding to the multiple features to obtain the preprocessed feature data corresponding to the multiple features. The entropy weight calculation module is used to calculate the entropy weight of each feature based on the feature data corresponding to the preprocessed multiple features, using the entropy weight method. The risk coefficient calculation module is used to obtain the IoT card risk coefficient based on the entropy weight of each feature. The risk level processing module is used to obtain the risk level of the IoT card based on the risk coefficient of the IoT card; The risk output module is used to send the risk level of the IoT card to the security monitoring platform, so that the security monitoring platform can issue an early warning based on the risk level of the IoT card for relevant personnel to handle. The verification module is used to perform KS test on the risk coefficient of IoT cards to obtain the p_value. If the p_value is greater than the preset significance level, it is determined that the IoT card risk coefficient follows a normal distribution; if the p_value is not greater than the preset significance level, it is determined that the IoT card risk coefficient does not follow a normal distribution, and a new entropy value weight is selected. The skewness coefficient calculation module is used to: calculate the skewness coefficient based on the IoT card risk coefficient; if the skewness coefficient is greater than 1 or less than -1, it is determined to be a highly skewed distribution, and the logarithm of the entropy weight of each feature is taken as the new entropy weight; if the skewness coefficient is between 0.5 and 1 or between -1 and -0.5, it is determined to be a moderately skewed distribution, and the natural logarithm of the entropy weight of each feature is taken as the new entropy weight; if the skewness coefficient is between 0 and 0.5 or between -0.5 and 0, it is determined to be a slightly skewed distribution, and the square root of the entropy weight of each feature is taken as the new entropy weight.

6. The apparatus according to claim 5, characterized in that, The entropy weight calculation module is specifically used for: performing dimensionless processing on the feature data corresponding to each preprocessed feature to obtain standardized feature data corresponding to each feature; obtaining the difference coefficient of each standardized feature data based on each standardized feature data; obtaining the information entropy of each feature based on the difference coefficient of each standardized feature data; and calculating the entropy weight of each feature based on the information entropy of each feature.

7. A server, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the IoT card risk level processing method as described in any one of claims 1 to 4.

8. A computer storage medium, characterized in that, The computer storage medium stores computer execution instructions. When the processor executes the computer execution instructions, it implements the IoT card risk level processing method as described in any one of claims 1 to 4.

Images