Abnormal user determination method, apparatus, device, and storage medium

Abstract

The application discloses an abnormal user determination method and device, equipment and storage medium, relates to the technical field of communication, and is used for improving the efficiency of determining abnormal users. The method comprises the following steps: acquiring the communication identifiers of a plurality of first off-carried users from the database of a user management network element; acquiring the communication identifiers of a plurality of second off-carried users from the database of an NPMSC network element; screening at least one first off-carried user existing in the user management network element in real time and off-carried from the plurality of first off-carried users to obtain a first user list; screening at least one second off-carried user existing in the NPMSC network element in real time from the plurality of second off-carried users and acquiring a target parameter of each second off-carried user to obtain a second user list; and determining an abnormal user from the at least one first off-carried user and the at least one second off-carried user based on the first user list, the second user list and the target parameter of each second off-carried user.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, device and storage medium for identifying abnormal users. Background Technology

[0002] With the development of communication networks, operators can send user subscription data stored in the Home Subscriber Server (HSS) or Unified Data Management (UDM) network elements to the Number Portability Mobile Switching Center (NPMSC) network element to provide number portability services to users. However, in actual operation and maintenance, incorrect billing instructions and user switching operations during porting in and out can cause errors in the user subscription data located in the HSS, UDM, or NPMSC network elements, resulting in abnormal porting status for users and preventing them from using the services provided by the operator. Currently, when receiving user complaints, it is necessary to manually analyze the reasons for the complaints and log in to the network management system in the background to check and determine whether the user has an abnormal porting status.

[0003] The methods described above, which rely on manually analyzing and verifying user complaints to determine whether a user's status is abnormal during the porting process, are inefficient. Furthermore, analyzing and verifying whether a single user is abnormal during the porting process lacks systematicity and predictability. Therefore, the efficiency in identifying abnormal users is poor. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for identifying abnormal users, which solves the problem of low efficiency in manually analyzing and verifying user complaints to determine whether a user is an abnormal user in a carry-out state, thereby improving the efficiency of identifying abnormal users.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a method for identifying abnormal users is provided. The method includes: retrieving communication identifiers of multiple first porting-out users from the database of the user management network element corresponding to the target operator; these porting-out users are users of the target operator who have transferred to other operators; retrieving communication identifiers of multiple second porting-out users from the database of the Number Carrying Mobile Switching Center (NPMSC) network element corresponding to the target operator; the NPMSC network element database stores all porting-out users corresponding to the target operator; based on the communication identifiers of the multiple first porting-out users, selecting at least one first porting-out user that exists in the user management network element in real time and has ported out from the multiple first porting-out users to obtain a first user list; based on the multiple... The communication identifier of a second ported-out user is used to filter out at least one second ported-out user that exists in the NPMSC network element in real time from multiple second ported-out users, and the target parameters of each second ported-out user in the at least one second ported-out user are obtained to obtain a second user list; based on the first user list, the second user list, and the target parameters of each second ported-out user included in the second user list, abnormal users are determined from at least one first ported-out user and at least one second ported-out user. An abnormal user is a user that exists in both the first user list and the second user list and whose target parameters are empty, or an abnormal user is a user that exists in the first user list but does not exist in the second user list.

[0007] In one possible implementation, the communication identifiers of multiple first porting-out users are obtained from the database of the user management network element corresponding to the target operator. This includes: obtaining the basic information of all users from the database of the user management network element, and determining whether the basic information of each user includes a porting-out identifier, which is used to indicate that the user is switching from the target operator to another operator; filtering out multiple first porting-out users whose basic information includes a porting-out identifier from all users, and determining the communication identifiers of the multiple first porting-out users.

[0008] In one possible implementation, based on the communication identifiers of multiple first-carry-out users, at least one first-carry-out user that exists in real time in the user management network element and has been carried out is selected from the multiple first-carry-out users to obtain a first user list. This includes: generating a first script instruction based on the communication identifier of each of the multiple first-carry-out users; inputting the first script instruction into the user management network element to run and obtain a first running result; and selecting at least one first-carry-out user from the multiple first-carry-out users based on the first running result to obtain a first user list.

[0009] In one possible implementation, based on the communication identifiers of multiple second-carry-out users, at least one second-carry-out user that exists in the NPMSC network element in real time is selected from the multiple second-carry-out users, and the target parameters of each of the at least one second-carry-out user are obtained to obtain a second user list. This includes: generating a second script instruction based on the communication identifier of each of the multiple second-carry-out users; inputting the second script instruction into the NPMSC network element to run and obtain a second running result; selecting at least one second-carry-out user from the multiple second-carry-out users based on the second running result; and obtaining the target parameters of each of the at least one second-carry-out user to obtain a second user list.

[0010] In one possible implementation, the user management network element is either a Home Subscriber Server (HSS) network element or a Unified Data Management (UDM) network element. The HSS network element is used to manage 2G users, 3G users, and 4G users, while the UDM network element is used to manage 2G users, 3G users, 4G users, and 5G users.

[0011] Secondly, an abnormal user identification device is provided, comprising: an acquisition unit, a processing unit, and a identification unit; the acquisition unit is used to acquire communication identifiers of multiple first porting-out users from the database of the user management network element corresponding to the target operator, wherein the porting-out users are users of the target operator who have transferred to other operators; the acquisition unit is also used to acquire communication identifiers of multiple second porting-out users from the database of the number carrying mobile switching center (NPMSC) network element corresponding to the target operator, wherein the NPMSC network element database stores all porting-out users corresponding to the target operator; the processing unit is used to, based on the communication identifiers of the multiple first porting-out users, select at least one first porting-out user that exists in the user management network element in real time and has been ported out from the multiple first porting-out users, thereby obtaining The first user list; the processing unit is further configured to filter out at least one second user that exists in the NPMSC network element in real time from the multiple second users based on the communication identifiers of the multiple second users; the acquisition unit is further configured to acquire the target parameters of each of the at least one second user to obtain a second user list; the determination unit is configured to determine abnormal users from at least one first user and at least one second user based on the first user list, the second user list, and the target parameters of each second user included in the second user list, wherein the abnormal user is a user that exists in both the first user list and the second user list and whose target parameters are empty, or an abnormal user is a user that exists in the first user list but does not exist in the second user list.

[0012] In one possible implementation, the acquisition unit is further configured to acquire basic information of all users from the database of the user management network element; the determination unit is further configured to determine whether the basic information of each user in the total number of users includes a porting-out identifier, which is used to indicate that the user is switching from the target operator to another operator; the processing unit is further configured to filter out multiple first porting-out users whose basic information includes a porting-out identifier from the total number of users; and the determination unit is further configured to determine the communication identifier of the multiple first porting-out users.

[0013] In one possible implementation, the processing unit is further configured to generate a first script instruction based on the communication identifier of each of the multiple first outgoing users; the processing unit is further configured to input the first script instruction into the user management network element to run and obtain a first running result, and based on the first running result, select at least one first outgoing user from the multiple first outgoing users to obtain a first user list.

[0014] In one possible implementation, the processing unit is further configured to generate a second script instruction based on the communication identifier of each of the multiple second outgoing users; the processing unit is further configured to input the second script instruction into the NPMSC network element to run and obtain a second running result, and to select at least one second outgoing user from the multiple second outgoing users based on the second running result; the acquisition unit is further configured to acquire the target parameters of each of the at least one second outgoing user to obtain a second user list.

[0015] In one possible implementation, the user management network element is either a Home Subscriber Server (HSS) network element or a Unified Data Management (UDM) network element. The HSS network element is used to manage 2G users, 3G users, and 4G users, while the UDM network element is used to manage 2G users, 3G users, 4G users, and 5G users.

[0016] Thirdly, an electronic device includes: a processor and a memory; wherein the memory is used to store one or more programs, the one or more programs including computer-executable instructions, and when the electronic device is running, the processor executes the computer-executable instructions stored in the memory to cause the electronic device to perform an abnormal user determination method as described in the first aspect.

[0017] Fourthly, a computer-readable storage medium is provided for storing one or more programs, the one or more programs including instructions that, when executed by a computer, cause the computer to perform an abnormal user determination method as described in the first aspect.

[0018] This application provides a method, apparatus, device, and storage medium for identifying abnormal users, applied in scenarios involving the identification of abnormal users. When it is necessary to identify abnormal users corresponding to a target operator, communication identifiers of multiple first ported-out users can be obtained from the database of the user management network element corresponding to the target operator, and communication identifiers of multiple second ported-out users can be obtained from the database of the NPMSC network element corresponding to the target operator, which stores all ported-out users. Further, based on the communication identifiers of the multiple first ported-out users, at least one first ported-out user that exists in real-time in the user management network element and has been ported out can be selected from the multiple first ported-out users to obtain a first user list. Similarly, based on the communication identifiers of the multiple second ported-out users, at least one second ported-out user that exists in real-time in the NPMSC network element can be selected from the multiple second ported-out users, and target parameters for each of the at least one second ported-out user can be obtained to obtain a second user list. Through the above method, based on the ported-out users that exist in real-time in the management network element and the NPMSC network element, it is possible to accurately determine whether the historical ported-out users included in the database are abnormal, and to filter out a list of potentially abnormal users. Furthermore, by determining whether a user exists in the first user list and / or the second user list, and whether the target parameter of each second user in the second user list is empty, it is determined whether the user is an abnormal user. This solves the problem of low efficiency in determining whether a user is an abnormal user in the outgoing state, and improves the efficiency of identifying abnormal users. Attached Figure Description

[0019] Figure 1 A schematic diagram of the structure of an abnormal user determination system provided for an embodiment of this application;

[0020] Figure 2 A flowchart illustrating an abnormal user identification method provided for embodiments of this application. Figure 1 ;

[0021] Figure 3 A user classification illustration provided for embodiments of this application Figure 1 ;

[0022] Figure 4 A user classification illustration provided for embodiments of this application Figure 2 ;

[0023] Figure 5 A flowchart illustrating an abnormal user identification method provided for embodiments of this application. Figure 2 ;

[0024] Figure 6 A flowchart illustrating an abnormal user identification method provided for embodiments of this application. Figure 3 ;

[0025] Figure 7 A flowchart illustrating an abnormal user identification method provided for embodiments of this application. Figure 4 ;

[0026] Figure 8 A flowchart illustrating user screening and live network auditing provided for embodiments of this application;

[0027] Figure 9 A schematic diagram of the structure of an abnormal user determination device provided for an embodiment of this application;

[0028] Figure 10 This is a schematic diagram of an electronic device structure provided for an embodiment of this application. Detailed Implementation

[0029] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0030] In the description of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" and "multiple" refer to two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0031] With the development of communication networks, in current 4G systems, user subscription data can be stored in the BE database of the Home Subscriber Server (HSS) network element. In 5G systems, user subscription data can be stored in the Unified Data Repository (UDR) of the Unified Data Management (UDM) network element. When a user switches operators, the current operator stores the user's subscription data in the Number Portability Mobile Switching Center (NPMSC) network element for subsequent management of the switched user.

[0032] During the actual operation and maintenance of users by operators, if billing instructions are incorrect or problems occur during user porting-in and porting-out contract switching operations, it can lead to errors in user contract data located on HSS, UDM, or NPMSC network elements. This results in abnormal porting-out status for users, preventing them from using the services provided by the operator. Therefore, identifying and correcting users with abnormal porting-out status is crucial. Currently, it is not possible to automatically filter users with abnormal porting-out status. Instead, upon receiving user complaints, the reasons for the complaints should be manually analyzed, and the network management system should be logged into in the backend to verify and determine whether each user has an abnormal porting-out status.

[0033] The methods described above, which involve manually analyzing and verifying user complaints one by one to determine whether a user's status is abnormal during the porting process, are inefficient. Furthermore, the analysis results of verifying whether a single user is abnormal during the porting process lack systematicity and predictability.

[0034] This application provides a method for identifying abnormal users. When it is necessary to identify abnormal users corresponding to a target operator, the method can obtain the communication identifiers of multiple first ported-out users from the database of the user management network element corresponding to the target operator, and the communication identifiers of multiple second ported-out users from the database of the NPMSC network element corresponding to the target operator that stores all ported-out users. Further, based on the communication identifiers of the multiple first ported-out users, at least one first ported-out user that exists in the user management network element in real time and has been ported out can be selected from the multiple first ported-out users to obtain a first user list. Similarly, based on the communication identifiers of the multiple second ported-out users, at least one second ported-out user that exists in the NPMSC network element in real time can be selected from the multiple second ported-out users, and the target parameters of each of the at least one second ported-out user can be obtained to obtain a second user list. Through the above method, based on the ported-out users that exist in the management network element and the NPMSC network element in real time, it is possible to accurately determine whether the historical ported-out users included in the database are abnormal, and to filter out a list of potentially abnormal users. Then, by judging whether a user exists in the first user list and / or the second user list, and whether the target parameters of each second ported-out user included in the second user list are empty, it is determined whether the user is an abnormal user. This solves the problem of low efficiency in determining whether a user is an abnormal user in the carry-out state, and improves the efficiency of identifying abnormal users.

[0035] The abnormal user identification method provided in this application embodiment can be applied to an abnormal user identification system. Figure 1 A schematic diagram of the abnormal user identification system is shown. Figure 1 As shown, the abnormal user identification system 10 includes: electronic device 11, user management network element 12, and number portability mobile switching center network element 13.

[0036] Specifically, electronic device 11 is used to obtain communication identifiers of multiple first porting-out users from the database of user management network element 12 corresponding to the target operator, obtain communication identifiers of multiple second porting-out users from the database of number carrying mobile switching center network element 13 corresponding to the target operator, filter out at least one first porting-out user that exists in real time in user management network element 12 and has been ported out based on the communication identifiers of multiple first porting-out users to obtain a first user list, filter out at least one second porting-out user that exists in real time in number carrying mobile switching center network element 13 based on the communication identifiers of multiple second porting-out users, obtain target parameters of each second porting-out user among the at least one second porting-out user to obtain a second user list, and determine abnormal users from at least one first porting-out user and at least one second porting-out user based on the target parameters of each second porting-out user included in the first user list, the second user list and the second user list.

[0037] User management network element 12 is used to send multiple communication identifiers of first ported-out users to electronic device 11; number portability mobile switching center network element 13 is used to send multiple communication identifiers of second ported-out users to electronic device 11, so as to identify abnormal users through electronic device 11, user management network element 12 and number portability mobile switching center network element 13.

[0038] The following describes a method for determining abnormal users provided by an embodiment of this application, with reference to the accompanying drawings. For example... Figure 2 As shown in the embodiment of this application, an abnormal user identification method is provided and applied to an electronic device. The method includes steps S201-S205:

[0039] S201. Obtain the communication identifiers of multiple first-carryout users from the database of the user management network element corresponding to the target operator.

[0040] Among them, users who are ported out are users of the target operator who are switching to other operators. The user management network element is either the HSS network element or the UDM network element. The HSS network element is used to manage 2G users, 3G users, and 4G users, while the UDM network element is used to manage 2G users, 3G users, 4G users, and 5G users.

[0041] It is understandable that electronic devices can obtain the communication identifiers of multiple first-carryout users from the database of the user management network element corresponding to the target operator.

[0042] Optionally, the subscription information of all users in the HSS or UDM network element can be obtained from the network element backup data in the database of the HSS or UDM network element. Based on the subscription information of all users in the HSS or UDM network element, multiple first-port-out users can be selected from all users included in the HSS or UDM network element, and the communication identifier of each first-port-out user can be obtained. The communication identifier can be a mobile subscriber integrated services digital number (MSISDN or ISDN).

[0043] It should be noted that one HSS network element or one UDM network element corresponds to one backup database. The backup database includes the user's subscription information, which is the user's basic information generated when the user signs up on the core network side.

[0044] S202. Obtain the communication identifiers of multiple second-carryout users from the database of the NPMSC network element corresponding to the target operator.

[0045] The database of the NPMSC network element stores all the ported-out users corresponding to the target operator.

[0046] It is understandable that electronic devices can obtain the communication identifiers of multiple second-transferring users from the database of all transferred users of the target operator's NPMSC network element.

[0047] Optionally, the communication identifiers of all ported-out users (i.e., multiple second ported-out users) can be obtained from the network element backup data in the database of the NPMSC network element.

[0048] It should be noted that one MSC network element corresponds to one backup database. The backup database includes the user's subscription information, which is the basic user information generated when the user signs up on the core network side.

[0049] S203. Based on the communication identifiers of multiple first-carry-out users, select at least one first-carry-out user that exists in real time in the user management network element and has been carried out from the multiple first-carry-out users to obtain the first user list.

[0050] It is understandable that electronic devices can select at least one first user that exists in real time in the user management network element and has been brought out from multiple first users based on the communication identifiers of multiple first users, and obtain a list of first users.

[0051] Optionally, based on the communication identifiers of multiple first-porting users, a live network audit can be performed on the network element management of the HSS or UDM network element corresponding to each first-porting user, so as to classify the multiple first-porting users in the HSS or UDM network element into three categories of users. For example... Figure 3 As shown, a user classification illustration is presented. Figure 1 Multiple first-transfer users in an HSS or UDM network element can be categorized into users who exist in the HSS or UDM network element in real time and have been transferred out (i.e., at least one first-transfer user), users who exist in the HSS or UDM network element in real time but have not been transferred out, and users who do not exist in the HSS or UDM network element in real time. Further, from these multiple first-transfer users, at least one first-transfer user who exists in the HSS or UDM network element in real time and has been transferred out is selected to obtain a first-user list.

[0052] S204. Based on the communication identifiers of multiple second-carry-out users, select at least one second-carry-out user that exists in the NPMSC network element in real time from the multiple second-carry-out users, and obtain the target parameters of each second-carry-out user among the at least one second-carry-out user to obtain a list of second users.

[0053] It is understandable that electronic devices can select at least one second user that exists in the NPMSC network element in real time from multiple second users based on the communication identifiers of multiple second users, and obtain the target parameters of each of the at least one second user to obtain a list of second users.

[0054] Optionally, based on the communication identifiers of multiple second-transferring users, a live network audit can be performed on the network element management of the NPMSC network element corresponding to each of the multiple second-transferring users, so as to classify the multiple second-transferring users in the NPMSC network element into three categories of users. For example... Figure 4 As shown, a user classification illustration is presented. Figure 2 Multiple second-port-out users in an NPMSC network element can be categorized into users who exist in the NPMSC network element in real-time and whose target parameter is not empty, users who exist in the NPMSC network element in real-time and whose target parameter is empty, and users who do not exist in the NPMSC network element in real-time. Further, from these multiple second-port-out users, users who exist in the NPMSC network element in real-time and whose target parameter is not empty, and users who exist in the NPMSC network element in real-time and whose target parameter is empty, are selected as at least one second-port-out user, resulting in a second user list. The target parameter can be the home location register number (HLRNUM).

[0055] S205. Based on the first user list, the second user list, and the target parameters of each second outgoing user included in the second user list, determine the abnormal user from at least one first outgoing user and at least one second outgoing user.

[0056] Among them, abnormal users are users who exist in both the first user list and the second user list and whose target parameter is empty, or abnormal users are users who exist in the first user list but do not exist in the second user list.

[0057] It is understood that the electronic device can determine, based on the first user list, the second user list, and the target parameters of each second user carried out in the second user list, from at least one first user and at least one second user carried out, users who exist in both the first user list and the second user list and whose target parameters are empty, or users who exist in the first user list but do not exist in the second user list, as abnormal users.

[0058] Optionally, multiple first-port-out users and multiple second-port-out users can be divided into nine user categories based on the three user categories corresponding to multiple first-port-out users in the HSS or UDM network element and the three user categories corresponding to multiple second-port-out users in the NPMSC network element. Specifically, the first user category consists of users who exist in the HSS or UDM network element in real time and are ported out while also existing in the NPMSC network element in real time, and whose target parameters are not empty; the second user category consists of users who exist in the HSS or UDM network element in real time but are not ported out, while also existing in the NPMSC network element in real time, and whose target parameters are not empty; the third user category consists of users who do not exist in the HSS or UDM network element in real time but are present in the NPMSC network element in real time, and whose target parameters are not empty; the fourth user category consists of users who exist in the HSS or UDM network element in real time and are ported out, while also existing in the NPMSC network element in real time, and whose target parameters are empty.

[0059] The fifth category of users consists of users who exist in the HSS or UDM network element in real time and are not ported out, and who also exist in the NPMSC network element in real time, with empty target parameters; the sixth category of users consists of users who do not exist in the HSS or UDM network element in real time, but who also exist in the NPMSC network element in real time, with empty target parameters; the seventh category of users consists of users who exist in the HSS or UDM network element in real time and are ported out, but who also do not exist in the NPMSC network element in real time; the eighth category of users consists of users who exist in the HSS or UDM network element in real time and are not ported out, but who also do not exist in the NPMSC network element in real time; the ninth category of users consists of users who do not exist in the HSS or UDM network element in real time, but who also do not exist in the NPMSC network element in real time.

[0060] Optionally, it can be determined that the porting-out status of Category 1 users is normal, Category 8 users are currently not ported-out users and are in normal status, and Category 9 users can currently be deregistered users. Therefore, Category 1, Category 8, and Category 9 users are all in normal status and do not require abnormal repair operations. Category 3 and Category 6 users do not currently exist in the HSS or UDM network elements, indicating that the users have been deregistered. However, these two categories of users still exist in the NPMSC network element, so their user information in the NPMSC network element can be directly deleted. Category 2 and Category 5 users... Since none of the above are ported-out users, the second and fifth types of users should not exist in the NPMSC network element at present, and their user information can be directly deleted from the NPMSC network element. The fourth type of user is currently a ported-out user and exists in the NPMSC network element used to store ported-out users, but the user's target parameter is empty. Therefore, the fourth type of user is an abnormal user and needs to be handled by the front-end operator. The seventh type of user is currently a ported-out user, but does not exist in the NPMSC network element used to store ported-out users. Therefore, the seventh type of user is an abnormal user and needs to be handled by the front-end operator.

[0061] In one possible implementation, if it is determined that a historically ported-out user of the target operator still exists in the user management network element and is a ported-out user, and also exists in the NPMSC network element used to store ported-out users, but the HLRNUM of this ported-out user is empty, then other users cannot communicate normally with this ported-out user through the HLRNUM, and this ported-out user can be identified as an abnormal user. Conversely, if it is determined that a historically ported-out user of the target operator still exists in the user management network element and is a ported-out user, but does not exist in the NPMSC network element used to store ported-out users, then this ported-out user cannot normally achieve number portability through the NPMSC network element, and this ported-out user can be identified as an abnormal user.

[0062] In a design, such as Figure 5 As shown in the embodiment of this application, an abnormal user identification method is provided. The method in step S201 above specifically includes S301-S302:

[0063] S301. Obtain the basic information of all users from the database of the user management network element, and determine whether the basic information of each user includes a porting-out identifier.

[0064] The porting-out identifier is used to indicate to users that they are switching from a target operator to another operator.

[0065] It is understandable that the basic information of all users can be obtained from the database of the user management network element, and it can be determined whether the basic information of each user includes a porting-out identifier that indicates the user to switch from the target operator to another operator.

[0066] Optionally, the basic information (i.e., the user's subscription information) of all users can be obtained from the UDM network element or HSS network element, and it can be determined whether the basic information of each user includes a porting-out identifier. When CAT=MNP in the user's basic information, it means that the user includes a porting-out identifier; when CAT=COMMON in the user's basic information, it means that the user does not include a porting-out identifier.

[0067] S302. Filter out multiple first-carryout users whose basic information includes a carryout identifier from all users, and determine the communication identifier of multiple first-carryout users.

[0068] It is understandable that multiple first-porting users with porting identifiers can be selected from all users, and the communication identifiers of these multiple first-porting users can be determined.

[0069] For example, in a UDM network element, the basic information of the user including the porting-out identifier (i.e., the first porting-out user) can be: IMSI = 46001******; MSISDN = 86155******; DEFCAL L = TS11; CURRENTNAM = BOTH; CAT = MNP; TBS = TS11&TS12&TS21; ODBOC = BAOC; ODBROAM = ODBROHC; VLRLIST = 1; VLR = 86******; MSC = 86******; SMDP = MSC; CONTROL = SUB; WPA = 0; ARD = 255&255&NO; SUBRES = ALLPLMN; UPL_TIME = 166******; FNR_FLAG = NO; MCSISTATE = YES; UPLCSLCK = NO; UPLCSLCK = NO; VOLTE_TAG = NO T_DEFINED; HLR_INDEX=101; PS_MSISDNLESS_SUPPORTED=FALSE; CS_MSISDNLESS_SUPPORTED=FALSE; CSRATTYPE=NO_NO_NO_NO_NO; PSRATTYPE=NO_NO_NO_NO_NO; ICI=NO; STE=NO; VMCC-FLA G=NO; DND=NO; LONG_FTN_SUPPORTED=NO; SUB_CREATE_TIME=******; MSPURGEDATMSC=0; NGSLOCK=NO.

[0070] In the UDM network element, the basic information of the user excluding the ported-out identifier can be: IMSI=46001******; MSISDN=86155******; DEFCALL=TS11; CURRENT NAM=BOTH; CAT=COMMON; TBS=TS11&TS12******; MSC=86******; SMDP=MSC; CW=CW-TS10-ACT; TSCSISTATE=YES; CONTROL=SUB; WPA=0; GS=HOLD&CLIP; CLIPOC=NO; TCSI=1; ARD=NONE&NONE&NO; SUBRES=ALLPLMN; UPL_TIME=166******; PURGE_TIME_ATMS C=******; VOLTESTATE=1_1_1_0_0_1; UNRI=NO; UNRR=100; URRP_MME=REACHABLE; URRP_SGSN=NOT_REACHABLE; FNR_FLAG=NO; MCSISTATE=YES; UPLCSLCK=NO; UPLPSLCK=NO; VOLTE_TAG=TR UE.

[0071] In a design, such as Figure 6 As shown in the embodiment of this application, an abnormal user identification method is provided. The method in step S203 above specifically includes S401-S402:

[0072] S401. Generate a first script instruction based on the communication identifier of each of the multiple first outgoing users.

[0073] It is understandable that a first script instruction can be generated based on the communication identifier of each of the multiple first outgoing users.

[0074] Optionally, network management audit instructions (i.e., first script instructions) for HSS network elements or UDM network elements can be generated based on the MSISDN of each of the multiple first-transferring users.

[0075] For example, if the MSISDN of any of the multiple first-port-out users can be 86185******, then the network management audit command of the HSS network element or UDM network element corresponding to the first-port-out user can be: LSTSUB:ISDN="86185******".

[0076] S402. Input the first script instruction into the user management network element to run and obtain the first running result. Based on the first running result, select at least one first user from multiple first users to obtain the first user list.

[0077] It is understandable that the first script instruction can be input into the user management network element to run and obtain the first running result. Based on the first running result, at least one first user can be selected from multiple first users to obtain the first user list.

[0078] Optionally, the first script instruction corresponding to each of the multiple first-port-out users can be input into the network management system of the HSS or UDM network element and run. If a first running result is obtained, the first-port-out user exists in the HSS or UDM network element in real time; if no first running result is obtained, the first-port-out user does not exist in the HSS or UDM network element in real time. Furthermore, if GATEGORY in the obtained first running result is equal to COMMON, the first-port-out user is ported out in real time; if GATEGORY in the obtained first running result is not equal to COMMON, the first-port-out user is not ported out in real time. Further, based on the first running result, at least one first-port-out user that exists in the HSS or UDM network element in real time and has been ported out is selected from the multiple first-port-out users to obtain a first user list.

[0079] Optionally, the first running result may include: International Mobile Subscriber Identity (IMSI), MSISDN, card type, network access mode, user type, telecommunications service, bearer service, and blocking status.

[0080] For example, the first script command corresponding to the first outgoing user with MSISDN 86185******, when run in the corresponding network element management system on the HSS network element, can yield the following first running result: %%LST SUB: ISDN="86185******", DETALL=FALSE; %%RETCODE=0SUCCESS0001:Operation is successfulHLRSN=IMSI=46001******MSISDN=86185******Card Type=USIM NAM=BOTH GATEGORY=COMMON "SABLOCK" "Basic Service"Telephony(TS11)Emergency call(TS12)ShortMessage MT_PP(TS21)Short Message MO_PP(TS22)General-DataCDS(BS30)DefaultCall=Telephony(TS11)"SS Data"BAOC=PROV BOICEXHC=PROV CLIP=PROV CW=PROV HOL D = PROV.

[0081] In a design, such as Figure 7 As shown, in the abnormal user identification method provided in this application embodiment, the method in step S204 above specifically includes S501-S502:

[0082] S501. Generate a second script instruction based on the communication identifier of each of the multiple second outgoing users.

[0083] It is understandable that a second script instruction is generated based on the communication identifier of each of the multiple second outgoing users.

[0084] Optionally, network management audit instructions (i.e., second script instructions) for NPMSC network elements can be generated based on the MSISDN of each of the multiple second-transferring users.

[0085] For example, if the MSISDN of any of the multiple second-transfer users can be 86131******, then the network management audit command of the NPMSC network element corresponding to the second-transfer user can be: LSTNPDONORSUB:ISDN="86131******".

[0086] S502. Input the second script instruction into the NPMSC network element to run and obtain the second running result. Based on the second running result, select at least one second user from multiple second users who have been brought out, and obtain the target parameters of each of the at least one second user who has been brought out, to obtain the second user list.

[0087] It is understandable that the second script instructions can be input into the NPMSC network element to run and obtain the second running result. Based on the second running result, at least one second user can be selected from multiple second users, and the target parameters of each second user can be obtained to obtain the second user list.

[0088] Optionally, the second script command corresponding to each of the multiple second-carry-out users can be input into the network element management system corresponding to the NPMSC network element for execution. If a second execution result is obtained, the second-carry-out user exists in the NPMSC network element in real time; if no first execution result is obtained, the second-carry-out user does not exist in the NPMSC network element in real time. Furthermore, if HLRNUM in the obtained second execution result is equal to a string of numbers, the target parameter of the second-carry-out user is not empty; if HLRNUM in the obtained second execution result is empty, the target parameter of the second-carry-out user is empty. Further, based on the second execution result, at least one second-carry-out user that exists in the NPMSC network element in real time is selected from the multiple second-carry-out users to obtain a second user list.

[0089] Optionally, the second result may include: IMSI, MSISDN, RN code, HLRNUM.

[0090] For example, the second script instruction corresponding to the second outgoing user with MSISDN 86131******, when run in the corresponding network element management system on the NPMSC network element, can yield the following second running result: %%LST NPDONORSUB:ISDN="86131******";%%RETCODE=0SUCCESS0001:Operation is successful IMSI=46001******ISDN=86131******RA=12HLRNUM=86156******.

[0091] One possible implementation is, such as Figure 8The diagram illustrates a user screening and live network audit process. It retrieves subscription information for 2G, 3G, and 4G users from HSS network element backup data, extracts user data from this information, and obtains the MSISDN of users with a ported-out user identifier. Further, using the MSISDN of these users, audit instructions for the HSS network element management system are written, and live network audits are performed on the HSS network element management system to obtain the HSS network element audit results. Based on these audit results, users are then classified to identify the ported-out users currently existing in the HSS network element.

[0092] The subscription information of 2G, 3G, 4G and 5G users can be obtained from the backup data of UDM network elements. User data can be extracted from the subscription information of 2G, 3G, 4G and 5G users to obtain the MSISDN of users with the porting-out user identifier. Furthermore, through the MSISDN of users with the porting-out user identifier, the audit instructions of UDM network element management are written, and the UDM network element management is audited on the live network to obtain the UDM network element audit results. Then, based on the UDM network element audit results, users are classified to obtain the porting-out users currently existing in the UDM network element.

[0093] Information on all ported-out users can be obtained from the NPMSC network element backup data, and user data can be extracted from the information of all ported-out users to obtain the MSISDN of all ported-out users. Furthermore, based on the MSISDN of all ported-out users, audit instructions for the NPMSC network element management system can be written, and the NPMSC network element management system can be audited on the live network to obtain the NPMSC network element audit results. Then, based on the NPMSC network element audit results, users can be classified to obtain the users currently existing in the NPMSC network element.

[0094] This application provides a method for identifying abnormal users. This method involves initial screening of users in network element backup data, performing network audits, obtaining audit results, conducting secondary verification, and performing network repairs. This achieves simple and efficient automatic identification of users with abnormal porting-out status, while avoiding users with porting-out flags on HSS or UDM network elements and non-porting-out users existing in NPMSC network elements. This solves the problem of user status errors caused when maintaining porting-out users in the current network. Specifically, it can filter the backup data of all mobile users in the HSS or UDM and all mobile porting-out users in the MSC network element from the backup data of the HSS, UDM, and MSC network elements. It then extracts the MSISDN of users with porting-out flags in the HSS or UDM network elements and the MSISDN of all users in the MSC network element. Further analysis is performed on the data extracted from the HSS or UDM network elements, and users extracted from the HSS or UDM network elements are tagged with whether they have been ported out. Then, by executing scripts on the live network, batch verification of live network elements is performed on users with porting-out identifiers on HSS or UDM network elements and all users existing on MSC network elements (i.e., automated live network audit). Data analysis and verification are then performed using keywords from the live network verification results (i.e., audit results) (i.e., secondary verification) to determine different user types and identify users with abnormal porting-out status in the live network. Finally, users with abnormal porting-out status in the live network are repaired in the live network.

[0095] This application can identify different types of porting-out anomalies and repair them accordingly, ensuring the accuracy and reliability of the screening and repair results. By regularly screening users with abnormal porting-out statuses and performing rollback or modification operations on these users, the user experience can be greatly improved and the complaint rate reduced. This application can also screen network element backup data, conduct live network audits on the selected data, and use the audit results for secondary verification, thereby minimizing pressure on the live network and ensuring the accuracy of the selected user results. This application can effectively reduce user complaint rates while improving operational efficiency, making it an effective way to promote the implementation of core network digital transformation.

[0096] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0097] This application embodiment can divide an abnormal user determination method into functional modules based on the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0098] Figure 9 This is a schematic diagram of an abnormal user identification device provided in an embodiment of this application. Figure 9 As shown, an abnormal user determination device 40 is used to improve the efficiency of determining abnormal users, for example, for performing... Figure 2 The present invention discloses a method for identifying abnormal users. The abnormal user identification device 40 includes: an acquisition unit 401, a processing unit 402, and a determination unit 403;

[0099] The acquisition unit 401 is used to acquire the communication identifiers of multiple first porting-out users from the database of the user management network element corresponding to the target operator. The porting-out users are users of the target operator who have switched to other operators.

[0100] The acquisition unit 401 is also used to acquire the communication identifiers of multiple second porting-out users from the database of the NPMSC network element corresponding to the target operator. The database of the NPMSC network element stores all porting-out users corresponding to the target operator.

[0101] Processing unit 402 is used to filter out at least one first user that exists in real time in the user management network element and has been brought out from multiple first users based on the communication identifiers of multiple first users, and obtain a first user list;

[0102] Processing unit 402 is also used to filter out at least one second carry-out user that exists in the NPMSC network element in real time from multiple second carry-out users based on the communication identifiers of multiple second carry-out users;

[0103] The acquisition unit 401 is also used to acquire the target parameters of each of the at least one second carrier users to obtain a list of second users.

[0104] The determining unit 403 is used to determine abnormal users from at least one first user and at least one second user based on the first user list, the second user list, and the target parameters of each second user carried out in the second user list. The abnormal user is a user that exists in both the first user list and the second user list and whose target parameters are empty, or an abnormal user that exists in the first user list but does not exist in the second user list.

[0105] In one possible implementation, the acquisition unit 401 is further configured to acquire basic information of all users from the database of the user management network element; the determination unit 403 is further configured to determine whether the basic information of each user in the total number of users includes a porting-out identifier, which is used to indicate that the user is switching from the target operator to another operator; the processing unit 402 is further configured to filter out multiple first porting-out users whose basic information includes a porting-out identifier from the total number of users; and the determination unit 403 is further configured to determine the communication identifier of the multiple first porting-out users.

[0106] In one possible implementation, the processing unit 402 is further configured to generate a first script instruction based on the communication identifier of each of the multiple first outgoing users; the processing unit 402 is further configured to input the first script instruction into the user management network element to run and obtain a first running result, and based on the first running result, select at least one first outgoing user from the multiple first outgoing users to obtain a first user list.

[0107] In one possible implementation, the processing unit 402 is further configured to generate a second script instruction based on the communication identifier of each of the multiple second outgoing users; the processing unit 402 is further configured to input the second script instruction into the NPMSC network element to run and obtain a second running result, and to select at least one second outgoing user from the multiple second outgoing users based on the second running result; the acquisition unit 401 is further configured to acquire the target parameters of each of the at least one second outgoing user to obtain a second user list.

[0108] In one possible implementation, the user management network element is either an HSS network element or a UDM network element. The HSS network element is used to manage 2G users, 3G users, and 4G users, while the UDM network element is used to manage 2G users, 3G users, 4G users, and 5G users.

[0109] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 10 As shown, an electronic device 60 is used to improve the efficiency of identifying abnormal users, for example, for performing... Figure 2 This illustrates a method for identifying abnormal users. The electronic device 60 includes a processor 601, a memory 602, and a bus 603. The processor 601 and the memory 602 are connected via the bus 603.

[0110] Processor 601 is the control center of the communication device. It can be a single processor or a collective term for multiple processing elements. For example, processor 601 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0111] As one embodiment, processor 601 may include one or more CPUs, for example Figure 10 CPU 0 and CPU 1 are shown in the diagram.

[0112] The memory 602 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0113] As one possible implementation, the memory 602 can exist independently of the processor 601. The memory 602 can be connected to the processor 601 via a bus 603 and is used to store instructions or program code. When the processor 601 calls and executes the instructions or program code stored in the memory 602, it can implement an abnormal user determination method provided in the embodiments of this application.

[0114] In another possible implementation, the memory 602 can also be integrated with the processor 601.

[0115] Bus 603 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 10 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0116] It should be pointed out that, Figure 10 The structure shown does not constitute a limitation on the electronic device 60. Except... Figure 10 In addition to the components shown, the electronic device 60 may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0117] As an example, combined Figure 9 The functions implemented by the acquisition unit 401, processing unit 402, and determination unit 403 in the abnormal user determination device 40 are the same as those of the acquisition unit 401, processing unit 402, and determination unit 403. Figure 10 The processor 601 in it has the same function.

[0118] Optional, such as Figure 10 As shown, the electronic device 60 provided in this application embodiment may further include a communication interface 604.

[0119] Communication interface 604 is used to connect with other devices via a communication network. This communication network can be Ethernet, a wireless access network, a wireless local area network (WLAN), etc. Communication interface 604 may include a receiving unit for receiving data and a transmitting unit for transmitting data.

[0120] In one design, the communication interface in the electronic device provided in this application embodiment can also be integrated into the processor.

[0121] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0122] This application also provides a computer-readable storage medium storing instructions. When a computer executes these instructions, the computer performs each step of the method flow shown in the above-described method embodiments.

[0123] Embodiments of this application provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform an abnormal user determination method as described in the above method embodiments.

[0124] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, or any other form of computer-readable storage medium in the art.

[0125] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside within an application-specific integrated circuit (ASIC).

[0126] In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0127] Since the electronic devices, computer-readable storage media, and computer program products in the embodiments of this application can be applied to the above methods, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0128] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. An abnormal user determining method, characterized by, The method comprises: obtaining, from a database of a user management network element corresponding to a target operator, communication identifiers of a plurality of first ported users, the ported users being users of the target operator who have transferred to users of other operators; obtaining, from a database of a number portability mobile switching center (NPMSC) network element corresponding to the target operator, communication identifiers of a plurality of second ported users, the database of the NPMSC network element storing all ported users corresponding to the target operator; based on the communication identifiers of the plurality of first ported users, screening at least one first ported user from the plurality of first ported users that exists in the user management network element in real time and is ported, to obtain a first user list; based on the communication identifiers of the plurality of second ported users, screening at least one second ported user from the plurality of second ported users that exists in the NPMSC network element in real time, and obtaining a target parameter of each second ported user in the at least one second ported user, to obtain a second user list; based on the first user list, the second user list, and the target parameter of each second ported user included in the second user list, determining an abnormal user from the at least one first ported user and the at least one second ported user, the abnormal user being a user that exists in both the first user list and the second user list and has an empty target parameter, or the abnormal user being a user that exists in the first user list but does not exist in the second user list.

2. The method of claim 1, wherein, The method comprises: obtaining, from a database of a user management network element corresponding to a target operator, communication identifiers of a plurality of first ported users, the ported users being users of the target operator who have transferred to users of other operators; obtaining, from a database of a number portability mobile switching center (NPMSC) network element corresponding to the target operator, communication identifiers of a plurality of second ported users, the database of the NPMSC network element storing all ported users corresponding to the target operator; 3. The method according to claim 1 or 2, characterized in that, based on the communication identifiers of the plurality of first ported users, screening at least one first ported user from the plurality of first ported users that exists in the user management network element in real time and is ported, to obtain a first user list; based on the communication identifiers of the plurality of first ported users, screening at least one first ported user from the plurality of first ported users that exists in the user management network element in real time and is ported, to obtain a first user list; based on the communication identifiers of the plurality of second ported users, screening at least one second ported user from the plurality of second ported users that exists in the NPMSC network element in real time, and obtaining a target parameter of each second ported user in the at least one second ported user, to obtain a second user list; 4. The method according to claim 1 or 2, characterized in that, based on the first user list, the second user list, and the target parameter of each second ported user included in the second user list, determining an abnormal user from the at least one first ported user and the at least one second ported user, the abnormal user being a user that exists in both the first user list and the second user list and has an empty target parameter, or the abnormal user being a user that exists in the first user list but does not exist in the second user list. The method comprises: obtaining, from a database of a user management network element corresponding to a target operator, communication identifiers of a plurality of first ported users, the ported users being users of the target operator who have transferred to users of other operators; obtaining, from a database of a number portability mobile switching center (NPMSC) network element corresponding to the target operator, communication identifiers of a plurality of second ported users, the database of the NPMSC network element storing all ported users corresponding to the target operator; based on the communication identifiers of the plurality of first ported users, screening at least one first ported user from the plurality of first ported users that exists in the user management network element in real time and is ported, to obtain a first user list; based on the communication identifiers of the plurality of first ported users, screening at least one first ported user from the plurality of first ported users that exists in the user management network element in real time and is ported, to obtain a first user list; based on the communication identifiers of the plurality of second ported users, screening at least one second ported user from the plurality of second ported users that exists in the NPMSC network element in real time, and obtaining a target parameter of each second ported user in the at least one second ported user, to obtain a second user list; generate a second script instruction based on the communication identifier of each of the second off-net users; input the second script instruction into the NPMSC network element to obtain a second running result, filter the at least one second off-net user from the plurality of second off-net users based on the second running result, and obtain a target parameter of each of the at least one second off-net user to obtain the second user list.

5. The method according to claim 1 or 2, characterized in that, The user management network element is a home subscriber server (HSS) network element or a unified data management (UDM) network element, the HSS network element is used to manage second generation (2G) users, third generation (3G) users, fourth generation (4G) users, and the UDM network element is used to manage the 2G users, the 3G users, the 4G users, and fifth generation (5G) users.

6. An abnormal user determining apparatus characterized by comprising: The abnormal user determination apparatus comprises an obtaining unit, a processing unit, and a determination unit. The obtaining unit is configured to obtain communication identifiers of a plurality of first off-net users from a database of a user management network element corresponding to a target operator, the off-net users being users of the target operator who have transferred to other operators. The obtaining unit is further configured to obtain communication identifiers of a plurality of second off-net users from a database of a number portability mobile switching center (NPMSC) network element corresponding to the target operator, the database of the NPMSC network element storing all off-net users corresponding to the target operator. The processing unit is configured to filter at least one first off-net user from the plurality of first off-net users based on the communication identifiers of the plurality of first off-net users, the at least one first off-net user being a user that exists in the user management network element in real time and has transferred, to obtain a first user list. The processing unit is further configured to filter at least one second off-net user from the plurality of second off-net users based on the communication identifiers of the plurality of second off-net users, the at least one second off-net user being a user that exists in the NPMSC network element in real time. The obtaining unit is further configured to obtain a target parameter of each of the at least one second off-net user to obtain a second user list. The determination unit is configured to determine an abnormal user from the at least one first off-net user and the at least one second off-net user based on the first user list, the second user list, and the target parameter of each of the second off-net users included in the second user list, the abnormal user being a user that exists in both the first user list and the second user list and has an empty target parameter, or the abnormal user being a user that exists in the first user list but does not exist in the second user list.

7. The abnormal user determining apparatus according to claim 6, characterized by The obtaining unit is further configured to obtain basic information of all users from the database of the user management network element. The determination unit is further configured to determine whether the off-net identifier is included in the basic information of each of the users, the off-net identifier being used to indicate that a user has transferred from the target operator to other operators. The processing unit is further configured to filter the plurality of first carrying-out users including the carrying-out identifier from the total users. The determining unit is further configured to determine the communication identifier of the plurality of first carrying-out users.

8. The abnormal user determining apparatus according to claim 6 or 7, characterized by, The processing unit is further configured to generate a first script instruction based on the communication identifier of each of the plurality of first carrying-out users. The processing unit is further configured to input the first script instruction into the user management network element to obtain a first running result, and filter the at least one first carrying-out user from the plurality of first carrying-out users based on the first running result to obtain the first user list.

9. The abnormal user determining apparatus according to claim 6 or 7, characterized by, The processing unit is further configured to generate a second script instruction based on the communication identifier of each of the plurality of second carrying-out users. The processing unit is further configured to input the second script instruction into the NPMSC network element to obtain a second running result, and filter the at least one second carrying-out user from the plurality of second carrying-out users based on the second running result. The obtaining unit is further configured to obtain a target parameter of each of the at least one second carrying-out user to obtain the second user list.

10. The abnormal user determining apparatus according to claim 6 or 7, characterized by, The user management network element is a home subscriber server (HSS) network element or a unified data management (UDM) network element, the HSS network element is configured to manage second generation (2G) users, third generation (3G) users, fourth generation (4G) users, and the UDM network element is configured to manage the 2G users, the 3G users, the 4G users, and fifth generation (5G) users.

11. An electronic device, comprising: Comprising: A processor and a memory; wherein the memory is configured to store one or more programs including computer execution instructions, when the electronic device is running, the processor executes the computer execution instructions stored in the memory, so that the electronic device executes the abnormal user determination method in any one of claims 1-5.

12. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions for: The one or more programs include instructions that, when executed by a computer, cause the computer to perform an abnormal user determination method as claimed in any one of claims 1-5.

Images