An abnormal user detection method and device, electronic equipment and storage medium

Abstract

This application provides an abnormal user detection method, apparatus, electronic device, and storage medium, relating to the field of network communication, for identifying abnormal users in different network elements and improving the operational efficiency of operators. The method includes: obtaining the identifiers of users who have subscribed to a first network and the identifiers of users who have subscribed to a second network; determining the identifiers of target users who have subscribed to both the first and second networks based on the identifiers of the users who have subscribed to the first network and the identifiers of the users who have subscribed to the second network; querying the target user's subscription information in the first and second network elements respectively based on the target user's identifier to obtain query results; and identifying abnormal users among the target users based on the query results.

Description

Technical Field

[0001] This application relates to the field of network communication, and in particular to an abnormal user detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] In 4G and 5G network systems, users' subscription information is stored in databases of different network systems. Operators need to maintain users' subscription information in 4G and 5G network systems separately. However, in actual maintenance, due to the large number of users, operational errors are easy to occur, resulting in users' subscription information existing in different network systems at the same time, which leads to a poor user experience and user complaints.

[0003] For abnormal users whose subscription information exists in different network systems simultaneously, it is usually not possible to directly obtain a list of abnormal users. Instead, upon receiving a user complaint and analyzing the reason for the complaint, the network management system logs into the backend to verify and determine whether the user is indeed an abnormal user existing in different network systems. It can be seen that in the traditional approach, operators are in a passive position and cannot directly determine whether a user is an abnormal user in different network systems, resulting in low operational efficiency. Summary of the Invention

[0004] This application provides an abnormal user detection method, apparatus, electronic device, and storage medium for identifying abnormal users in different network systems and improving the operational efficiency of operators.

[0005] In a first aspect, this application provides an abnormal user detection method, comprising: obtaining the identifiers of users who have signed contracts with a first network and the identifiers of users who have signed contracts with a second network; wherein the first network and the second network are different; determining the identifiers of target users who have signed contracts with both the first network and the second network based on the identifiers of the users who have signed contracts with the first network and the second network; querying the target user's contract information in the first network element and the second network element respectively based on the target user's identifier to obtain query results; the first network element is a network element in the first network used to store user information; the second network element is a network element in the second network used to store user information; and determining abnormal users among the target users based on the query results; abnormal users refer to users who exist simultaneously in the first network and the second network.

[0006] The technical solution provided in this application can bring at least the following beneficial effects: First, it obtains the identifiers of users who have signed contracts with the first network and the identifiers of users who have signed contracts with the second network. Then, it determines the identifiers of target users who have signed contracts with both the first and second networks. Next, based on the identifiers of the target users, it queries the contract information of the target users in the first and second network elements respectively to obtain the query results. Finally, it determines the abnormal users among the target users based on the query results. It can be seen that the method provided in this application embodiment can filter out abnormal users who exist in both the first and second networks based on user identifiers and user contract information stored in different network elements, which can improve the operator's operational efficiency. In addition, after filtering out abnormal users, the contract information of abnormal users can be modified and rolled back in a timely manner, avoiding users from filing complaints with the operator due to abnormal internet access status, improving the user experience and reducing the complaint rate, and promoting the effective implementation of the core network digital transformation.

[0007] In one possible implementation, the identifier of the target user who has signed up with both the first and second networks is determined based on the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network. This includes taking the intersection of the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network to obtain the identifier of the target user.

[0008] In another possible implementation, based on the target user's identifier, the target user's contractual information is queried in the first network element and the second network element respectively to obtain query results. This includes: using the target user's identifier as a search term, querying the target user's contractual information in the first network element to obtain a first query result; the first query result includes a query success identifier or a query failure identifier; the query success identifier indicates that the target user's contractual information can be found; the query failure identifier indicates that the target user's contractual information cannot be found; using the target user's identifier as a search term, querying the target user's contractual information in the second network element to obtain a second query result; the second query result includes a query success identifier or a query failure identifier.

[0009] In another possible implementation, based on the query results, abnormal users among the target users are identified, including: identifying a first user whose first query result includes a query success identifier, and a second user whose second query result includes a query success identifier; and performing an intersection operation on the identifiers of the first user and the second user to obtain the identifiers of the abnormal users.

[0010] In another possible implementation, the method further includes: determining the status of the abnormal user in the first network element and the second network element respectively based on the abnormal user's subscription information; the status includes: existence status or porting out status.

[0011] In another possible implementation, the user's identifier includes: mobile subscriber international ISDN / PSTN number (MSISDN) and / or international mobile subscriber identification number (IMSI).

[0012] Secondly, this application provides a detection device, comprising: an identifier acquisition module, configured to acquire identifiers of users who have signed up with a first network and identifiers of users who have signed up with a second network; wherein the first network and the second network are different; a determination module, configured to determine, based on the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network, the identifiers of target users who have signed up with both the first network and the second network; a query module, configured to query the target user's subscription information in the first network element and the second network element respectively, based on the target user's identifier, and obtain query results; the first network element is a network element in the first network used for storing user information; the second network element is a network element in the second network used for storing user information; the determination module is further configured to determine abnormal users among the target users based on the query results; abnormal users refer to users who exist simultaneously in the first network and the second network.

[0013] In one possible implementation, the aforementioned determining module is specifically used to perform intersection processing on the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network to obtain the identifier of the target user.

[0014] In one possible implementation, the query module is specifically used to query the target user's contract information in a first network element using the target user's identifier as the search term, and obtain a first query result; the first query result includes a query success identifier or a query failure identifier; the query success identifier indicates that the target user's contract information can be found; the query failure identifier indicates that the target user's contract information cannot be found; and using the target user's identifier as the search term, query the target user's contract information in a second network element, and obtain a second query result; the second query result includes a query success identifier or a query failure identifier.

[0015] In another possible implementation, the aforementioned determining module is further used to determine the target users, including a first user whose first query result includes a query success identifier and a second user whose second query result includes a query success identifier; and to perform an intersection operation on the identifiers of the first user and the second user to obtain the identifier of the abnormal user.

[0016] In another possible implementation, the aforementioned determining module is further used to determine the status of the abnormal user in the first network element and the second network element respectively based on the abnormal user's subscription information; the status includes: existence status or porting out status.

[0017] In another possible implementation, the user's identification includes: Mobile Subscriber Number (MSISDN) and / or International Mobile Subscriber Identity (IMSI).

[0018] Thirdly, this application provides an electronic device, including: a processor and a memory; the processor is coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the abnormal user detection method provided in the first aspect and any possible implementation thereof.

[0019] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions that, when executed on a computer, cause the computer to perform the abnormal user detection method provided in the first aspect and any possible implementation thereof.

[0020] For a detailed description of the second to fourth aspects and their various implementations in this application, please refer to the detailed description in the first aspect and its various implementations; and for a detailed description of the beneficial effects of the second to fourth aspects and their various implementations, please refer to the beneficial effect analysis in the first aspect and its various implementations, which will not be repeated here.

[0021] These or other aspects of this application will become more readily apparent in the following description. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of an abnormal user detection system provided in an embodiment of this application;

[0023] Figure 2 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0024] Figure 3 A flowchart illustrating an abnormal user detection method provided in this application embodiment;

[0025] Figure 4 A schematic diagram illustrating an abnormal user detection method provided in an embodiment of this application;

[0026] Figure 5 A schematic diagram illustrating another abnormal user detection method provided in an embodiment of this application;

[0027] Figure 6 A schematic diagram of a carried tag provided in an embodiment of this application;

[0028] Figure 7 A schematic diagram illustrating another abnormal user detection method provided in an embodiment of this application;

[0029] Figure 8 A flowchart illustrating another abnormal user detection method provided in this application embodiment;

[0030] Figure 9 A schematic diagram illustrating another abnormal user detection method provided in an embodiment of this application;

[0031] Figure 10 A schematic diagram illustrating another abnormal user detection method provided in an embodiment of this application;

[0032] Figure 11 A flowchart illustrating another abnormal user detection method provided in this application embodiment;

[0033] Figure 12 A schematic diagram illustrating another abnormal user detection method provided in an embodiment of this application;

[0034] Figure 13 A schematic diagram of a detection device provided in an embodiment of this application;

[0035] Figure 14 This is a schematic diagram of another detection device provided in an embodiment of this application. Detailed Implementation

[0036] The following is a detailed description, with reference to the accompanying drawings, of an abnormal user detection method, apparatus, electronic device, and storage medium provided in this application.

[0037] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0038] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0039] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0040] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0041] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0042] As described in the background section, for abnormal users whose contract information exists in different network systems simultaneously, it is usually not possible to directly obtain a list of abnormal users. Instead, upon receiving a user's complaint and analyzing the reason for the complaint, the system logs into the network management system in the background to verify and determine whether the user is an abnormal user existing in different network systems. It can be seen that the traditional method cannot directly determine whether a user is an abnormal user in different network systems. Instead, it requires receiving user complaints, analyzing the reasons for each complaint, and verifying whether each user is an abnormal user in different network systems. This method is inefficient and the analysis results are not predictive.

[0043] To address the aforementioned technical problems, this application provides an abnormal user detection method. The method involves: first, obtaining the identifiers of users who have subscribed to a first network and users who have subscribed to a second network; then, identifying the identifiers of target users who have subscribed to both the first and second networks; next, querying the target user's subscription information in both the first and second network elements based on the target user's identifier to obtain query results; and finally, identifying abnormal users among the target users based on the query results. It can be seen that the method provided in this application can filter out abnormal users who exist simultaneously in both the first and second networks based on user identifiers and subscription information stored in different network elements, thereby improving the operator's operational efficiency. Furthermore, after filtering out abnormal users, their subscription information can be modified and rolled back in a timely manner, preventing users from filing complaints with the operator due to abnormal internet access status, improving user experience, reducing complaint rates, and effectively promoting the implementation of core network digital transformation.

[0044] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0045] like Figure 1As shown, this application provides an abnormal user detection system, which includes: a first network element 100, a second network element 200, a server 300, and an electronic device 400. The first network element 100 and the server 300 are communicatively connected; the second network element 200 and the server 300 are also communicatively connected; the server 300 and the electronic device 400 can be connected wirelessly. For example, the server 300 and the electronic device 400 can be connected via a wireless local area network. The first network element 100 and the second network element 200 are respectively communicatively connected to the electronic device 400. Both the first network element 100 and the second network element 200 are used to store and manage user information.

[0046] In some embodiments, the first network element 100 is specifically used to store the subscription information of users in the first network; the second network element 200 is specifically used to store the subscription information of users in the second network. Optionally, the user's subscription information includes the user's identifier, user's number information, user category, user's Internet access signaling data, and user's service processing status, etc. The user's identifier is used to uniquely identify the user. In some embodiments, the user's identifier includes: MSISDN and / or IMSI.

[0047] The first network and the second network are not the same. For example, the first network can be a 4G network and the second network can be a 5G network; or, the first network can be a 3G network and the second network can be a 5G network.

[0048] For example, if the first network is a 4G network, the first network element 100 can be a Home Subscriber Server (HSS) network element. If the second network is a 5G network, the second network element 200 can be a Unified Data Management (UDM) network element.

[0049] Optionally, the first network element 100 can be one or more. For example, when the first network is a 4G network, the first network element 100 can be all HSS network elements within the target area. Here, the target area refers to the city or province where the user is located, etc. This application embodiment does not limit the geographical scope of the target area.

[0050] Optionally, the second network element 200 can be one or more. For example, if the second network is a 5G network, the second network element 200 can be all UDM network elements in the target area.

[0051] Server 300 is used to acquire and store user subscription information across different networks.

[0052] In some embodiments, server 300 is specifically used to periodically obtain and store the subscription information of users in the first network from the first network element 100, and periodically obtain and store the subscription information of users in the second network from the second network element 200.

[0053] For example, server 300 can be a single server, or it can be a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster.

[0054] Electronic device 400 is used to detect abnormal users.

[0055] Here, an abnormal user refers to a user who exists simultaneously in different networks. For example, an abnormal user can be a user who exists simultaneously in a first network and a second network.

[0056] In some embodiments, the electronic device 400 is specifically used to obtain the subscription information of users in the first network from the server 300 and extract the identifiers of users who have signed up with the first network from the subscription information; obtain the subscription information of users in the second network and extract the identifiers of users who have signed up with the second network from the subscription information; then, based on the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network, determine the identifier of the target user who has signed up with both the first and second networks; then, query the subscription information of the target user based on the identifier of the target user to obtain the query results; and finally, determine the abnormal user based on the query results.

[0057] For example, electronic device 400 may be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, etc. This application embodiment does not impose special limitations on the specific form of electronic device 400. Electronic device 400 can interact with users through one or more methods such as keyboard, touchpad, touch screen, remote control, voice interaction, or handwriting device.

[0058] like Figure 2 As shown, the electronic device 400 in this embodiment can be a desktop computer. The electronic device 400 provided in this embodiment will be specifically described below using a desktop computer as an example. The electronic device 400 may include a bus 410, a processor 420, a memory 430, a user input module 440, a display module 450, a communication interface 460, and other similar and / or suitable components.

[0059] Bus 410 may be a circuit that interconnects the aforementioned components and transmits communication (e.g., control messages) between them.

[0060] The processor 420 can receive commands from the other components (such as memory 430, user input module 440, display module 450, communication interface 460, etc.) via bus 410, interpret the received commands, and perform calculations or data processing according to the interpreted commands.

[0061] The memory 430 can store commands or data received from the processor 420 or other components (such as the user input module 440, the display module 450, the communication interface 460, etc.) or commands or data generated by the processor 420 or other components.

[0062] User input module 440 can receive commands or data input by the user via input-output means (e.g., sensors, keyboard, touch screen, etc.), and can transmit the received commands or data to processor 420 or memory 430 via bus 410. Display module 450 can display videos, images, data, etc. to the user.

[0063] The display module 450 can display various information received from the aforementioned components (such as multimedia data and text data).

[0064] The communication interface 460 can control short-range communication connections with another electronic device.

[0065] It should be understood that, for example Figure 2 The desktop computer shown is merely one example of the aforementioned electronic device 400 and does not constitute a specific limitation on the electronic device 400. In other embodiments, the electronic device 400 may have a larger... Figure 2 The more or fewer components shown can be combined into two or more components, or they can have different component configurations.

[0066] The following is a detailed description of an abnormal user detection method provided in an embodiment of this application.

[0067] It should be noted that the following embodiments use a 4G network as the first network, a 5G network as the second network, an HSS network element as the first network element, and a UDM network element as the second network element for illustration.

[0068] The method provided in the embodiments of this application can be derived from... Figure 1 The electronic device 400 shown performs this action. Specifically, as... Figure 3 As shown, the method includes the following steps:

[0069] S101. Obtain the contract information of users who have signed contracts with the first network and the contract information of users who have signed contracts with the second network.

[0070] As one possible implementation, each network includes at least one network side, with different network sides carrying different types of communication services. For example, the first network includes a core network and an IP Multimedia Subsystem (IMS) network. The core network mainly includes network-related services, while the IMS network mainly includes multimedia services such as voice and high-definition video. When a user subscribes to the first network, the network side they subscribe to will differ depending on the type of communication service they choose. The second network can also include a core network and an IMS network. When a user subscribes to the second network, the network they subscribe to will also differ depending on the type of communication service they choose.

[0071] In some embodiments, the first network element has multiple databases that store subscription information of users who have signed contracts with different network sides in the first network. For example, database A in the first network element stores subscription information between users and the core network in the first network; database B in the first network element stores subscription information between users and the IMS network in the first network. The second network element also has multiple databases that store subscription information of users who have signed contracts with different network sides in the second network. For example, database C in the second network element stores subscription information between users and the core network in the second network; database D in the second network element stores subscription information between users and the IMS network in the second network.

[0072] For example, such as Figure 4 As shown, when a user subscribes to 4G services, if the type of communication service is network-based, the user signs a contract with the core network of the 4G network, obtains the user's contract information on the core network of the 4G network, and stores it in database A of the HSS network element; if the type of communication service is multimedia-based, the user signs a contract with the IMS network in the 4G network, obtains the user's IMS contract information on the 4G network, and stores it in database B of the HSS network element.

[0073] The subscription information in the core network differs slightly from that in the IMS network. For example, the core network subscription information includes the user's IMSI, MSISDN, and the communication services subscribed to; while the IMS network subscription information includes the user's IMSI, MSISDN, IMS private user identity, and IP multimedia public identity.

[0074] In some embodiments, the server periodically retrieves and backs up the user's subscription information from the database of each network element, and electronic devices can download the user's subscription information by communicating with the server.

[0075] Understandably, each network element stores the subscription information of users who have signed up with the corresponding network. However, directly downloading this backup information from the network element would consume network element resources and put pressure on the network element. Therefore, the server periodically backs up the user subscription information from the network element. If the operator needs to use the user subscription information, they can download it from the server using an electronic device.

[0076] S102. Obtain the identifiers of users who have signed contracts with the first network and the identifiers of users who have signed contracts with the second network.

[0077] As one possible implementation, the user's subscription information stores the user's identifier, which includes: MSISDN and / or IMSI.

[0078] In some embodiments, such as Figure 5 As shown, the HSS network element's database stores subscription information for users who have subscribed to the core network and IMS network in the 4G network. The server can periodically back up the core network subscription information and IMS subscription information of users in the 4G network from the HSS network element's database, respectively. Electronic devices obtain user subscription information from the server and extract the user's MSISDN from the user's subscription information to further generate a list of user MSISDNs. The UDM network element's database stores subscription information for users who have subscribed to the core network and IMS network in the 5G network. The server can periodically back up the core network subscription information and IMS subscription information of users in the 5G network from the UDM network element's database, respectively. Electronic devices obtain user subscription information from the server and extract the user's MSISDN from the user's subscription information to further generate a list of user MSISDNs.

[0079] In some embodiments, a user's MSISDN may carry multiple tags. For example, such as... Figure 6 As shown, a user's MSISDN can include: home network element label, home city label, and ported-in user label.

[0080] For example, electronic devices retrieve the user's MSISDN list from the server and configure the home network element label for the user's MSISDN based on the different network elements where the user's subscription information is stored.

[0081] For example, electronic devices classify users by their home city based on the MSISDN identifier segment information allocated to the city by the operator, and configure a home city label for the user's MSISDN.

[0082] Among them, users whose city of origin cannot be classified according to the MSISDN identifier segment information allocated to their city by this operator are considered ported-in users from other operators.

[0083] For example, for ported-in users, the electronic device matches the MSISDN of such users with the number segment information in the existing network, and adds the city of origin label and ported-in user label to the MSISDN of the ported-in user.

[0084] It is understandable that obtaining the identifiers of users who have signed contracts with the first network stored in the first network element and the identifiers of users who have signed contracts with the second network stored in the second network element can uniquely identify a user through the user's identifier, so that in step S103, the identifier of the target user who has signed contracts with both the first and second networks can be determined based on the user's identifier.

[0085] S103. Based on the identifiers of users who have signed contracts with the first network and the identifiers of users who have signed contracts with the second network, determine the identifiers of target users who have signed contracts with both the first and second networks.

[0086] The target users are those who have signed contracts with both the first and second networks; that is, the target users can be one or more users.

[0087] In some embodiments, step S103 can be implemented as follows: taking the intersection of the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network to obtain the identifier of the target user.

[0088] As one possible implementation, both the first and second networks include a core network and an IMS network. The network on which the user subscribes differs depending on the type of communication service they have signed up for. Therefore, the electronic device's process of intersecting the identifiers of users who have subscribed to the first network and the identifiers of users who have subscribed to the second network includes: intersecting the identifiers of users in both the first and second networks who have subscribed to the core network to obtain a list of target user identifiers in the core network; and intersecting the identifiers of users in both the first and second networks who have subscribed to the IMS network to obtain a list of target user identifiers in the IMS network.

[0089] For example, such as Figure 7 As shown, the electronic device takes the intersection of the MSISDN lists of users who have signed up with the core network in the 4G network and the 5G network to obtain the MSISDN list of the target user in the core network; the electronic device takes the intersection of the MSISDN lists of users who have signed up with the IMS network in the 4G network and the 5G network to obtain the MSISDN list of the target user in the IMS network.

[0090] In some embodiments, the list of identifiers for the target user is shown in Table 1 below. The information in the table includes: the target user's identifier MSISDN, the target user's home network element label, and the home city label.

[0091] Table 1 Target User Identifier List

[0092] MSISDN HSS UDM City of origin 156156xxxxx SD_LY_HSS01BE01_HW SD_SD_JN_UDM801BE01_HW Linyi 123123xxxxx SD_LY_HSS03BE01_HW SD_SD_JN_UDM800BE01_HW Weihai 124362xxxxx SD_LY_HSS04BE01_HW SD_SD_JN_UDM802BE01_HW sunshine

[0093] It is understandable that by first obtaining the user's backed-up subscription information from the server through electronic devices, and then performing an intersection operation on the user's identifier on the electronic device to obtain the target user's identifier, the identifiers of target users who have signed up with both the first and second networks can be initially screened out. Further screening based on the target user's identifier can then yield accurate results.

[0094] S104. Based on the target user's identifier, query the target user's contract information in the first network element and the second network element respectively to obtain the query results.

[0095] In some embodiments, the electronic device sends query instructions (wherein the query instructions include the identifier of the target user) to the first network element and the second network element respectively, so that the first network element and the second network element query the target user's subscription information in the corresponding database according to the target user's identifier, obtain the query results, and return the query results to the electronic device.

[0096] In some embodiments, the query command for the core network can be: LST SUB:ISDN="861328700xxxx", DET AIL="FALSE". The query command for the IMS network can be: LST IMSSUB:ISDN="861328700xxxx". Each target user's MSISDN corresponds to one query command.

[0097] The query results for the core network include: IMSI, MSISDN, Card Type, Network Access Mode (NAM), User Type (CATEGORY), Communication Service, Bearer Service, Blocking Status, etc.; the query results for the IMS network include: IMSI, MSISDN, IMS Multimedia Private Identity (IMPI), Voice Over LTE (VoLTE) User Identity, Billing Template, Capability Set, etc.

[0098] In some embodiments, such as Figure 8 As shown, step S104 above can be implemented as follows:

[0099] S1041. Using the target user's identifier as the search term, query the target user's contract information in the first network element to obtain the first query result.

[0100] In some embodiments, step S1041 above can be implemented as follows:

[0101] Step a1: The electronic device sends a first query instruction to the first network element; wherein the first query instruction includes the identifier of the target user.

[0102] Step a2: In response to the first query instruction, the first network element queries the target user's subscription information in the corresponding database based on the target user's identifier, and obtains the first query result.

[0103] Step a3: The first network element returns the first query result to the electronic device.

[0104] The first query result includes a query success indicator or a query failure indicator; the query success indicator indicates that the target user's contract information can be found; the query failure indicator indicates that the target user's contract information cannot be found.

[0105] It is understandable that, depending on the type of communication service subscribed by the target user belonging to each network element, the network to which the target user has signed up will also be different. Therefore, when querying the target user's subscription information in each network element using the target user's identifier as the search term, the query must be performed separately on each network side. For example, such as... Figure 9 As shown, if the home network element label carried in the MSISDN of target user A and target user B is an HSS network element, then both target user A and target user B belong to the HSS network element, and both target user A and target user B have subscribed to the 4G network. Optionally, the first query instruction may include: a query instruction for the core network and a query instruction for the IMS network. When querying abnormal users in the core network, the core network query instruction is used to query the core network of target user A and target user B's MSISDN in the 4G network to obtain the first query result of the core network; when querying abnormal users in the IMS network, the IMS network query instruction is used to query the IMS network of target user A and target user B's MSISDN in the 4G network to obtain the first query result of the IMS network.

[0106] For example, when querying abnormal users in the core network of a 4G network, the above method can be implemented as follows:

[0107] Step b1: The electronic device sends a query command for the core network to the HSS network element.

[0108] The query command from the core network includes the identifier of the target user. For example, if the target user includes user A and user B, the identifier of the target user includes the identifier of user A and the identifier of user B.

[0109] In some embodiments, the query instruction for the core network may also include a network type identifier. For example, when querying for abnormal users in the core network, the network type identifier is the identifier of the core network.

[0110] For example, the query command for the core network could be: LST SUB:ISDN="861328700xxxx",DETAIL=FALSE. Here, 861328700xxxx is the identifier of the target user, and SUB is the identifier of the abnormal user being queried in the core network.

[0111] Step b2: In response to the query command from the core network, the HSS network element queries the subscription information of users A and B in the database storing the subscription information of the core network based on the identifiers of users A and B, and obtains the first query result of the core network.

[0112] Step b3: The HSS network element returns the first query result of the core network to the electronic device.

[0113] For example, when querying abnormal users in the IMS network within a 4G network, the above method can be implemented as follows:

[0114] Step c1: The electronic device sends a query command for the IMS network to the HSS network element.

[0115] The query command from the IMS network includes the identifier of the target user. For example, if the target user includes user A and user B, the identifier of the target user includes the identifier of user A and the identifier of user B.

[0116] In some embodiments, the query instruction for an IMS network also includes a network type identifier. For example, when querying for abnormal users in an IMS network, the network type identifier is the identifier of the IMS network.

[0117] For example, the query command for the IMS network can be: LST IMSSUB:ISDN="861328700xxxx". Here, 861328700xxxx is the identifier of the target user, and IMSSUB is the identifier of the abnormal user being queried in the IMS network.

[0118] Step c2: In response to the query command from the IMS network, the HSS network element queries the subscription information of users A and B in the database storing IMS network subscription information based on the identifiers of users A and B, and obtains the first query result of the IMS network.

[0119] Step c3: The HSS network element returns the first query result of the IMS network to the electronic device.

[0120] Based on the above technical solution, this application embodiment can further verify whether the target user's contract information exists in the first network element by using the target user's identifier as the search term for retrieval, thereby improving the accuracy of identifying abnormal users.

[0121] S1042. Using the target user's identifier as the search term, query the target user's contract information in the second network element to obtain the second query result; the second query result includes a query success identifier or a query failure identifier.

[0122] In some embodiments, such as Figure 10 As shown, if the home network element label carried in the MSISDN of target user C and target user D is a UDM network element, then both target user C and target user D belong to the UDM network element, and both target user C and target user D have subscribed to the 5G network. Optionally, the second query instruction may include: a query instruction for the core network and a query instruction for the IMS network. When querying abnormal users in the core network, the query instruction for the core network is used to query the core network of target user C and target user D in the 5G network to obtain the second query result for the core network; when querying abnormal users in the IMS network, the query instruction for the IMS network is used to query the IMS network of target user C and target user D in the 5G network to obtain the second query result for the IMS network.

[0123] For example, when querying abnormal users in the core network of a 5G network, the above method can be implemented as follows:

[0124] Step d1: The electronic device sends a query command for the core network to the UDM network element.

[0125] Step d2: In response to the query command from the core network, the UDM network element queries the subscription information of users C and D in the database storing the subscription information of the core network based on the identifiers of users C and D, and obtains the second query result of the core network.

[0126] Step d3: The UDM network element returns the second query result of the core network to the electronic device.

[0127] For example, when querying abnormal users in the IMS network within a 5G network, the above method can be implemented as follows:

[0128] Step e1: The electronic device sends a query command for the IMS network to the UDM network element.

[0129] Step e2: In response to the query command from the IMS network, the UDM network element queries the subscription information of users C and D in the database storing IMS network subscription information based on the identifiers of users C and D, and obtains the second query result of the IMS network.

[0130] Step e3: The UDM network element returns the second query result of the IMS network to the electronic device.

[0131] Based on the above technical solution, this application embodiment can further verify whether the target user's contract information exists in the second network element by using the target user's identifier as the search term, thereby improving the accuracy of identifying abnormal users.

[0132] S105. Based on the query results, identify abnormal users among the target users; abnormal users refer to users who exist in both the first network and the second network simultaneously.

[0133] In some embodiments, if the target user's subscription information is found in the first network element, the first query result returned by the first network element includes: keywords indicating successful query and the target user's subscription information. If the target user's subscription information is not found in the first network element, the first query result returned by the first network element includes: keywords indicating failed query.

[0134] Optionally, the subscription information of the target user mentioned above includes: the target user's type CATEGORY, which identifies the target user's current status in the network. For example, when CATEGORY = COMMON, it indicates that the target user is currently in a normal network state; when CATEGORY = MNP, it indicates that the target user is currently in a ported-out state in the network.

[0135] For example, using the query command: LST SUB:ISDN="861328700xxxx",DETAIL=FALSE, when querying the subscription information of the target user "861328700xxxx" in the core network on the first network element, if the subscription information of the target user "861328700xxxx" in the core network exists in the first network element, the first query result will include the keyword "success" indicating that the query for the target user "861328700xxxx" was successful, and the type CATEGORY of the target user "861328700xxxx".

[0136] For example, using the query command: LST SUB:ISDN="861328700xxxx",DETAIL=FALSE, when querying the subscription information of the target user "861328700xxxx" in the core network on the first network element, if the subscription information of the target user "861328700xxxx" in the core network does not exist in the first network element, the first query result will include the keyword "error" indicating that the query for the target user "861328700xxxx" failed.

[0137] Meanwhile, when the target user "861328700xxxx" has a type CATEGORY=COMMON, it indicates that the target user is a normal user on the network element, and the tag of the existing user of the first network element is added to the MSISDN of the target user "861328700xxxx"; when CATEGORY=MNP, it indicates that the target user "861328700xxxx" is in a ported-out state in the first network element, and the tag of the ported-out user of the first network element is added to the MSISDN of the target user.

[0138] Among them, the ported-out status indicates that although the target user can find the subscription information in the network element, the target user may no longer be using the network in the network element.

[0139] In another possible implementation, the query command `LST IMSSUB:ISDN="861328700xxxx"` is used to query the IMS network subscription information of the target user "861328700xxxx" on the first network element. If the first network element contains the target user "861328700xxxx's" IMS network subscription information, the first query result will include the keyword "success" indicating a successful query for the target user "861328700xxxx", but will not include the keyword "CATEGORY". Therefore, the successful query result for the IMS network does not include keywords indicating whether the target user is in a ported-out state.

[0140] When using the query command: LST IMSSUB:ISDN="861328700xxxx" to query the IMS network subscription information of the target user "861328700xxxx" on the first network element, if the target user "861328700xxxx" does not have the IMS network subscription information in the first network element, the first query result will include the keyword "error" indicating that the query for the target user "861328700xxxx" failed.

[0141] In some embodiments, such as Figure 11 As shown, step S105 above can be implemented as follows:

[0142] S1051. In determining the target user, the first query result includes a first user with a query success identifier, and the second query result includes a second user with a query success identifier.

[0143] Optionally, when querying abnormal users in the core network of a 4G network, the aforementioned first user includes users who have subscribed to the core network within the 4G network. Similarly, when querying abnormal users in the IMS network of a 4G network, the aforementioned first user includes users who have subscribed to the IMS network within the 4G network.

[0144] Optionally, when querying abnormal users in the core network of a 5G network, the aforementioned second user includes users who have subscribed to the core network in the 5G network. When querying abnormal users in the IMS network of a 5G network, the aforementioned second user includes users who have subscribed to the IMS network in the 4G network.

[0145] It is understandable that when performing the intersection operation between the identifier of the first user (including the query success indicator) in the first query result and the identifier of the second user (including the query success indicator) in the second query result, the intersection operation must be performed on different network sides.

[0146] Based on the above technical solution, if the query results of the target user contain keywords indicating successful query, it means that the target user's subscription information is still stored in the corresponding network element. When other network elements also store the target user's subscription information, errors will occur during the user's network usage, causing the user to be unable to use the network normally. This application embodiment can better identify abnormal users by determining which users in the target user whose query results include the successful query identifier.

[0147] S1052. Perform an intersection operation on the identifiers of the first user and the second user to obtain the identifier of the abnormal user.

[0148] As one possible implementation, the intersection of the identifiers of the first user and the second user who signed up on different networks is taken to obtain the identifiers of abnormal users on different networks.

[0149] For example, when querying abnormal users in the core network, the above method can be implemented as follows:

[0150] Step f1: The electronic device obtains the identifier of the first user of the core network from the first query result.

[0151] Step f2: The electronic device obtains the identifier of the second user of the core network from the second query result.

[0152] Step f3: The electronic device takes the intersection of the identifier of the first user in the core network and the identifier of the second user in the core network to obtain the identifier of the abnormal user in the core network.

[0153] Step f4: Identify abnormal users in the core network based on their identifiers.

[0154] For example, when querying abnormal users in the IMS network, the above method can be implemented as follows:

[0155] Step g1: The electronic device obtains the identifier of the first user of the IMS network from the first query result.

[0156] Step g2: The electronic device obtains the identifier of the second user of the IMS network from the second query result.

[0157] Step g3: The electronic device takes the intersection of the identifier of the first user in the IMS network and the identifier of the second user in the IMS network to obtain the identifier of the abnormal user in the IMS network.

[0158] Step g4: Identify abnormal users in the IMS network based on their identifiers.

[0159] For example, such as Figure 12 As shown, the intersection of the MSISDN of the first user in the core network and the MSISDN of the second user in the core network yields the list of MSISDNs of abnormal users in the core network; the intersection of the MSISDN of the first user in the IMS network and the MSISDN of the second user in the IMS network yields the list of MSISDNs of abnormal users in the IMS network.

[0160] Understandably, when the number of users is large, errors are easily made in the actual maintenance and storage process of the first and second network elements; for example, a user's subscription information with the first network might be stored in a list of the user's subscription information with the second network. On the other hand, if a user switches networks, their subscription information may be stored in both network elements simultaneously, causing inconvenience. For example, if a user switches from a 4G network to a 5G network, their subscription information may exist in both the HSS and UDM network element databases, preventing normal network access.

[0161] Based on the above technical solution, this application embodiment can further verify users who exist in both the first network and the second network by performing an intersection operation on the identifiers of the first user and the second user, thus ensuring the accuracy of the results.

[0162] S106. Based on the abnormal user's subscription information, determine the abnormal user's status in the first network element and the second network element respectively; the status includes: existence status or porting out status.

[0163] Among them, "existence status" means that the abnormal user can still find the subscription information in the network element and is currently still using the network normally in that network element; "port-out status" means that the abnormal user can still find the subscription information in the network element, but is no longer using the network in that network element.

[0164] As one possible implementation, in steps S102 and S105 above, different tags are added to the user's MSISDN respectively; by integrating the tags carried by the abnormal user's MSISDN, the status of the abnormal user in the first network element and the second network element can be obtained.

[0165] As shown in Table 2 below, the tags carried by the MSISDN of the integrated abnormal users include: home network element tag, home city tag, ported-out user tag, and existing user tag.

[0166] Table 2 Abnormal User Tag Table

[0167]

[0168] Based on the above technical solution, the embodiments of this application can determine the status of abnormal users in the first network element and the second network element, and then perform rollback, modification and other operations on the abnormal users in the network elements according to the status of the abnormal users. This can adjust the abnormal network situation of users in a timely manner before users complain, improve the user experience and reduce the user complaint rate.

[0169] The technical solution provided in this application can bring at least the following beneficial effects: First, the intersection of the identifiers of users who have signed contracts with the first network and the identifiers of users who have signed contracts with the second network is processed. Then, the identifiers of target users who have signed contracts with both the first and second networks are determined. Next, the contract information of the target users is queried based on the identifiers of the target users. Finally, abnormal users among the target users are obtained. The method provided in this application takes the identifiers of users who have signed contracts with different network systems as the starting point to filter out abnormal users who exist in both the first and second networks. This can improve the operator's operational efficiency, enhance the user experience, reduce the complaint rate, and promote the effective implementation of the core network digital transformation.

[0170] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0171] This application embodiment can divide the detection device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0172] like Figure 13 The diagram shown is a structural schematic of a detection device provided in an embodiment of this application. This detection device can be used to perform actions such as... Figure 3 The abnormal user detection method shown is described. The detection device 500 includes: an identifier acquisition module 501, a determination module 502, and a query module 503.

[0173] The identifier acquisition module 501 is used to acquire the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network; wherein the first network and the second network are different.

[0174] The determination module 502 is used to determine the identifier of the target user who has signed up with both the first network and the second network, based on the identifier of the user who has signed up with the first network and the identifier of the user who has signed up with the second network.

[0175] The query module 503 is used to query the target user's subscription information in the first network element and the second network element respectively based on the target user's identifier, and obtain the query results; the first network element is the network element in the first network used to store user information; the second network element is the network element in the second network used to store user information.

[0176] The determination module 502 is also used to determine abnormal users among the target users based on the query results; abnormal users refer to users who exist in both the first network and the second network.

[0177] In some embodiments, the determining module 502 is specifically used to perform intersection processing on the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network to obtain the identifier of the target user.

[0178] In some embodiments, the query module 503 is specifically used to query the target user's contract information in a first network element using the target user's identifier as the search term, and obtain a first query result; the first query result includes a query success identifier or a query failure identifier; the query success identifier is used to indicate that the target user's contract information can be found; the query failure identifier is used to indicate that the target user's contract information cannot be found; and to query the target user's contract information in a second network element using the target user's identifier as the search term, and obtain a second query result; the second query result includes a query success identifier or a query failure identifier.

[0179] In some embodiments, the determining module 502 is further configured to determine the target users, including a first user whose first query result includes a query success identifier and a second user whose second query result includes a query success identifier; and to perform an intersection operation on the identifiers of the first user and the second user to obtain the identifier of the abnormal user.

[0180] In some embodiments, the determining module 502 is further configured to determine the status of the abnormal user in the first network element and the second network element respectively based on the abnormal user's subscription information; the status includes: presence status or porting out status.

[0181] In some embodiments, the user's identifier includes: MSISDN and / or IMSI.

[0182] In implementing the functions of the integrated modules described above using hardware, this embodiment of the invention provides another possible structural diagram of the detection device involved in the above embodiments. For example... Figure 14 As shown, the detection device 600 includes: a memory 601, a processor 602, a communication interface 603, and a bus 604.

[0183] The memory 601 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0184] Processor 602 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 602 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 602 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0185] In one possible implementation, the memory 601 can exist independently of the processor 602. The memory 601 can be connected to the processor 602 via a bus 604 and is used to store instructions or program code. When the processor 602 calls and executes the instructions or program code stored in the memory 601, it can implement the abnormal user detection method provided in this embodiment of the invention.

[0186] In another possible implementation, the memory 601 can also be integrated with the processor 602.

[0187] Communication interface 603 is used to connect to other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0188] Bus 604 can be an extended industry standard architecture (EISA) bus, etc. Bus 604 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 14 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0189] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the detection device can be divided into different functional modules to complete all or part of the functions described above.

[0190] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the aforementioned computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The aforementioned computer-readable storage medium can also be an external storage device of the aforementioned detection device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the aforementioned detection device. Further, the aforementioned computer-readable storage medium can include both internal storage units of the aforementioned detection device and external storage devices. The aforementioned computer-readable storage medium is used to store the aforementioned computer program and other programs and data required by the aforementioned detection device. The aforementioned computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0191] This application also provides a computer program product comprising a computer program that, when run on a computer, causes the computer to execute any of the abnormal user detection methods provided in the above embodiments.

[0192] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0193] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0194] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An abnormal user detection method, characterized in that, include: Obtain the identifiers of users who have signed up with a first network and users who have signed up with a second network; wherein the first network and the second network are different; the first network is a fourth-generation mobile communication 4G network and the second network is a fifth-generation mobile communication 5G network; Based on the identifiers of users who have signed contracts with the first network and the identifiers of users who have signed contracts with the second network, the identifiers of target users who have signed contracts with both the first network and the second network are determined; Based on the identifier of the target user, the subscription information of the target user is queried in the first network element and the second network element respectively to obtain the query results; the first network element is the network element in the first network used to store user information; the first network element is the Home Subscriber Server (HSS) network element; the second network element is the network element in the second network used to store user information; the second network element is the Unified Data Management (UDM) network element; the subscription information of the target user includes the type of the target user, which is used to identify the status of the target user in the current network; Based on the query results, abnormal users among the target users are identified; the abnormal users refer to users who exist simultaneously in the first network and the second network. Based on the subscription information of the abnormal user, the status of the abnormal user in the first network element and the second network element are determined respectively; the status includes: existence status or porting out status; the existence status means that the abnormal user can find the subscription information in the network element and is still using the network normally in the network element; the porting out status means that the abnormal user can find the subscription information in the network element, but is no longer using the network in the network element. Based on the status of the abnormal user, the abnormal user is rolled back and modified in the network element.

2. The method according to claim 1, characterized in that, The step of determining the identifier of a target user who has signed up with both the first network and the second network based on the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network includes: The identifier of the target user is obtained by taking the intersection of the identifiers of the users who have signed up with the first network and the identifiers of the users who have signed up with the second network.

3. The method according to claim 1, characterized in that, The step of querying the target user's subscription information in the first network element and the second network element respectively, based on the target user's identifier, to obtain the query results includes: Using the target user's identifier as a search term, the target user's contractual information is queried in the first network element to obtain a first query result; the first query result includes a query success identifier or a query failure identifier; the query success identifier indicates that the target user's contractual information can be found; the query failure identifier indicates that the target user's contractual information cannot be found. Using the target user's identifier as a search term, the target user's contract information is queried in the second network element to obtain a second query result; the second query result includes the query success identifier or the query failure identifier.

4. The method according to claim 1, characterized in that, The step of identifying abnormal users among the target users based on the query results includes: Among the target users, the first query result includes a first user with a query success identifier, and the second query result includes a second user with the query success identifier; The identifier of the abnormal user is obtained by performing an intersection operation on the identifiers of the first user and the second user.

5. The method according to claim 1, characterized in that, The user's identifier includes: Mobile Subscriber Number (MSISDN) and / or International Mobile Subscriber Identity (IMSI).

6. A detection device, characterized in that, include: The identifier acquisition module is used to acquire the identifiers of users who have signed up with the first network and the identifiers of users who have signed up with the second network; wherein the first network and the second network are different; the first network is a 4G network and the second network is a 5G network; The determination module is used to determine the identifier of a target user who has signed up with both the first network and the second network, based on the identifier of the user who has signed up with the first network and the identifier of the user who has signed up with the second network. The query module is used to query the target user's subscription information in a first network element and a second network element respectively, based on the target user's identifier, and obtain query results; the first network element is a network element in the first network used to store user information; the first network element is an HSS network element; the second network element is a network element in the second network used to store user information; the second network element is a UDM network element; the target user's subscription information includes the target user's type, used to identify the target user's status in the current network; The determination module is further configured to determine abnormal users among the target users based on the query results; the abnormal users refer to users who exist simultaneously in the first network and the second network; The determining module is further configured to determine the status of the abnormal user in the first network element and the second network element respectively based on the abnormal user's subscription information; and to roll back and modify the abnormal user in the network element according to the abnormal user's status; the status includes: existence status or porting-out status; the existence status means that the abnormal user can find the subscription information in the network element and is still using the network normally in the network element; the porting-out status means that the abnormal user can find the subscription information in the network element, but is no longer using the network in the network element.

7. The apparatus according to claim 6, characterized in that, The determining module is specifically used to perform intersection processing on the identifiers of the users who have signed contracts with the first network and the identifiers of the users who have signed contracts with the second network to obtain the identifier of the target user; The query module is specifically used to query the target user's contract information in the first network element using the target user's identifier as the search term, and obtain a first query result; the first query result includes a query success identifier or a query failure identifier. The query success indicator is used to indicate that the target user's contract information can be retrieved. The query failure flag is used to indicate that the target user's contract information could not be found. Using the target user's identifier as a search term, the target user's contract information is queried in the second network element to obtain a second query result; the second query result includes the query success identifier or the query failure identifier. The determining module is further configured to determine, among the target users, a first user whose first query result includes the query success identifier, and a second user whose second query result includes the query success identifier; The identifier of the abnormal user is obtained by performing an intersection operation on the identifiers of the first user and the second user. The user's identifiers include: Mobile Subscriber Number (MSISDN) and / or International Mobile Subscriber Identity (IMSI).

8. An electronic device, characterized in that, The electronic device includes a processor and a memory; the processor is coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the abnormal user detection method as described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the abnormal user detection method according to any one of claims 1 to 5.

Images