An abnormal terminal identification method, device and readable storage medium

Abstract

The application provides an abnormal terminal identification method and device and a readable storage medium. Traffic data of a terminal to be identified is obtained. A service process corresponding to the traffic data is determined according to process classification of the traffic data. A service characteristic index value corresponding to the terminal to be identified in the service process is obtained according to a label of the terminal to be identified. An abnormal analysis of a message transmission interval is performed according to the traffic data and the service characteristic index value, and an abnormal state identification result of the terminal to be identified is obtained. The application can quickly and accurately find abnormal terminals, provide timely troubleshooting and network optimization for network operators, has a wide application prospect in network communication, can improve network performance and user experience, and reduce operation cost and maintenance workload.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to an abnormal terminal identification method, apparatus and readable storage medium. Background Technology

[0002] With the rapid development and widespread application of 5G communication technology, more and more devices are connecting to 5G networks, bringing higher bandwidth, lower latency, and a wider range of application scenarios. However, at the same time, due to the increase in the number of devices and their increased complexity, 5G networks also face more challenges, such as an increase in abnormal terminals.

[0003] In 5G networks, abnormal terminals may exhibit issues such as unstable connections, high transmission error rates, and frequent disconnections. These abnormal terminals may be caused by hardware failures, software errors, network interference, or malicious attacks. For network operators and service providers, timely detection and identification of abnormal terminals is crucial in order to take appropriate measures to remediate problems and improve network performance and user experience.

[0004] Therefore, how to quickly and accurately detect abnormal terminals has become a problem that needs to be solved. Summary of the Invention

[0005] The technical problem to be solved by this application is to provide an abnormal terminal identification method, apparatus and readable storage medium to address the above-mentioned shortcomings of the prior art.

[0006] In a first aspect, this application provides a method for identifying abnormal terminals, the method comprising:

[0007] S1. Obtain traffic data of the terminal to be identified;

[0008] S2. Classify the processes based on the traffic data and determine the business processes corresponding to the traffic data;

[0009] S3. Based on the identifier of the terminal to be identified, obtain the business characteristic index value corresponding to the terminal to be identified in the business process. The business characteristic index value represents the time interval index value of the terminal to be identified sending and receiving different types of business messages.

[0010] S4. Based on the traffic data and the business characteristic index values, perform anomaly analysis on the message sending and receiving intervals to obtain the abnormal state identification result of the terminal to be identified.

[0011] In some embodiments, in S2, the categories of the business processes include registration / deregistration processes, business request processes, and switching processes.

[0012] In some embodiments, S3 includes the types of business characteristics such as registration interval, business request interval, and switching interval.

[0013] In some embodiments, S4 includes:

[0014] S41. Classify messages based on the traffic data to obtain message classification results;

[0015] S42. Determine the time interval for the terminal to be identified to send and receive messages of the same type based on the message classification results;

[0016] S43. Count the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value;

[0017] S44. If the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold, then it is determined that the terminal to be identified has become abnormal.

[0018] In some embodiments, S43, the number of times the time interval between the sending and receiving of the same type of message by the terminal to be identified is less than the corresponding time interval index value is counted using the following formula:

[0019]

[0020] Wherein, P represents the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value, i represents the label of the terminal to be identified, j represents the type of service feature, k represents the time interval sequence number between sending and receiving the same type of message by the terminal to be identified, T(i,j,k) represents the k-th time interval between sending and receiving the j-th type of service feature message by the i-th terminal to be identified, and F(i,j) represents the time interval index value between sending and receiving the j-th type of service feature message by the i-th terminal to be identified.

[0021] In some embodiments, S44, the number of times the time interval between the sending and receiving of the same type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold, including:

[0022] The number of times the time interval between sending and receiving a single type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold.

[0023] Alternatively, the total number of times the time interval between sending and receiving all types of messages by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold.

[0024] In some embodiments, in S3, the business characteristic index value corresponding to the terminal to be identified in the business process is determined based on the historical business data of the terminal to be identified.

[0025] Secondly, this application provides an abnormal terminal identification device, the device comprising:

[0026] The data acquisition module is configured to acquire traffic data of the terminal to be identified;

[0027] The process classification module is configured to classify processes based on the traffic data and determine the business processes corresponding to the traffic data.

[0028] The indicator acquisition module is configured to acquire the business characteristic indicator value corresponding to the terminal to be identified in the business process based on the identification number of the terminal to be identified. The business characteristic indicator value represents the time interval indicator value of the terminal to be identified sending and receiving different types of business messages.

[0029] The anomaly analysis module is configured to perform anomaly analysis on message sending and receiving intervals based on the traffic data and the business characteristic indicator values, and obtain the anomaly status identification result of the terminal to be identified.

[0030] Thirdly, this application provides an abnormal terminal identification device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the abnormal terminal identification method described in the first aspect above.

[0031] Fourthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the abnormal terminal identification method described in the first aspect.

[0032] The abnormal terminal identification method, apparatus, and readable storage medium provided in this application specifically involve: acquiring traffic data of the terminal to be identified; classifying the traffic data into processes to determine the corresponding business processes; acquiring the business characteristic index value corresponding to the terminal in the business process based on the terminal's identifier, wherein the business characteristic index value represents the time interval index value for the terminal to send and receive different types of business messages; and performing anomaly analysis of the message sending and receiving intervals based on the traffic data and the business characteristic index value to obtain the abnormal state identification result of the terminal to be identified. This application can quickly and accurately detect abnormal terminals, providing network operators with timely troubleshooting and network optimization. This application has broad application prospects in network communication, improving network performance and user experience while reducing operating costs and maintenance workload. Attached Figure Description

[0033] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0034] Figure 1 This is a schematic diagram illustrating an application scenario of the abnormal terminal identification method provided in the embodiments of this application;

[0035] Figure 2 A flowchart illustrating an abnormal terminal identification method provided in this application embodiment;

[0036] Figure 3 This is a schematic diagram of the structure of an abnormal terminal identification device provided in an embodiment of this application;

[0037] Figure 4 This is a schematic diagram of another abnormal terminal identification device provided in an embodiment of this application.

[0038] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0039] To enable those skilled in the art to better understand the technical solution of this application, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0040] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining this application and are not intended to limit this application.

[0041] It is understood that, without conflict, the various embodiments and features in the embodiments of this application can be combined with each other.

[0042] It is understood that, for ease of description, only the parts relevant to this application are shown in the accompanying drawings, while parts unrelated to this application are not shown in the drawings.

[0043] It is understood that each unit or module involved in the embodiments of this application may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0044] It is understood that the terms "first," "second," etc., used in the embodiments of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0045] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this application may occur in a different order than those marked in the accompanying drawings.

[0046] It is understood that the flowcharts and block diagrams of this application illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this application. Each block in a flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagrams and flowcharts may be implemented using a hardware-based system to implement the specified function, or using a combination of hardware and computer instructions.

[0047] It is understood that the units and modules involved in the embodiments of this application can be implemented by software or by hardware. For example, the units and modules can be located in the processor.

[0048] In 5G networks, abnormal terminals may exhibit problems such as unstable connections, high transmission error rates, and frequent disconnections. These abnormal terminals may be caused by hardware failures, software errors, network interference, or malicious attacks. When a terminal is maliciously controlled or malfunctions, it will inevitably exhibit abnormal behavior that differs from normal service. This abnormal behavior is specifically reflected in the traffic data sent and received by the terminal. Based on this, this application proposes an abnormal terminal identification method that can quickly and accurately detect abnormal terminals, thereby facilitating operators' handling and ensuring network performance and user experience.

[0049] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0050] This application provides a method for identifying abnormal terminals. The working process of this method can be implemented by electronic devices, such as servers, computers, handheld smart terminals, etc. For ease of explanation, the method execution subject in each embodiment of this application is described as a server.

[0051] Figure 1 This is a schematic diagram illustrating the application scenario of the abnormal terminal identification method in the embodiments of this application, such as... Figure 1 As shown, after the terminal establishes a network connection with the base station, it can send and receive data. The server can identify abnormal terminals based on the data transmission and reception between the terminal and the base station.

[0052] Figure 2 This is a schematic diagram of the abnormal terminal identification method provided in the embodiments of this application, as shown below. Figure 2 As shown, this application provides a method for identifying abnormal terminals, the method comprising:

[0053] S1. Obtain traffic data of the terminal to be identified;

[0054] Among them, traffic data refers to the signaling traffic data of the terminal to be identified in the mobile communication network, such as the communication traffic data between the terminal and the base station. The server can identify abnormal terminals by analyzing the signaling traffic data.

[0055] Optionally, since a base station has communication connections with more than one terminal, the traffic data obtained by the server is the traffic data of multiple terminals communicating with the base station. In this case, the server may also perform a terminal classification step on the traffic data. Specifically, the server can determine which terminal device the traffic data corresponds to based on information such as terminal identity / identification code contained in the signaling traffic data.

[0056] S2. Classify the processes based on the traffic data and determine the business processes corresponding to the traffic data;

[0057] For traffic data from the same terminal, the server can classify it into processes, determine the business process type corresponding to the traffic data, and thus distinguish different process messages initiated by the same terminal.

[0058] Optionally, in this step, the business process categories include registration / deregistration process, business request process, and switching process, wherein:

[0059] (1) The registration / deregistration process mainly analyzes the registration and deregistration messages initiated from the terminal side, such as Registration Request and Deregistration Request.

[0060] (2) In the business request process, the main analysis focuses on business requests and release information initiated from the terminal side, such as Service Request, PDU SessionEstablishment Request, and PDU Session Release Request.

[0061] (3) The handover process mainly analyzes handover request information initiated by the base station, such as Handover Request (handover request message).

[0062] S3. Based on the identifier of the terminal to be identified, obtain the business characteristic index value corresponding to the terminal to be identified in the business process. The business characteristic index value represents the time interval index value of the terminal to be identified sending and receiving different types of business messages.

[0063] After determining the business process type corresponding to the traffic data, the server obtains the business characteristic index value corresponding to the terminal to be identified in the business process.

[0064] Optionally, in this step, the types of business characteristics include registration interval, business request interval, and switching interval.

[0065] Correspondingly, the business characteristic index values ​​represent the time interval values ​​for the terminal to be identified to send and receive different types of business messages. For example, the time interval for the terminal to send and receive registration messages to carry out the registration / deregistration process (which can also be understood as the registration frequency), the time interval for the terminal to send and receive request messages to carry out the business request process (which can also be understood as the business request frequency), and the time interval for the terminal to send and receive switching messages to carry out the switching process (which can also be understood as the switching frequency).

[0066] Optionally, in this step, the business characteristic index value corresponding to the terminal to be identified in the business process is determined based on the historical business data of the terminal to be identified.

[0067] For example, the following behavioral information can be obtained by analyzing historical service data from different terminals:

[0068] (1) Terminal 1, with a fixed location, only needs to connect to the network to report data once every 12 hours at least;

[0069] (2) Terminal 2 has a smaller activity range, does not frequently turn on and off, and does not often use Internet access services;

[0070] (3) Terminal 3 has a large range of activity and does not frequently turn on and off. After connecting to the network, it will remain stable for a period of time. It frequently makes requests for services such as internet access and video viewing through mobile terminals, and its location changes greatly when taking the subway / bus.

[0071] Based on the above behavioral information, the service characteristic indicator values ​​for the three terminals can be set as shown in Table 1 below:

[0072] Terminal 1 12 hours 12 hours infinity Terminal 2 24 hours 1 hour 10 hours Terminal 3 24 hours 5 minutes 5 minutes

[0073] Table 1

[0074] As shown in Table 1 above, for terminal 1, based on the business characteristics of this type of user, it needs to connect to the network to report data at least once every 12 hours. Since the location is fixed, its registration interval can be set to 12 hours; the business request interval can be set to 12 hours; since the location is fixed, there will be no switching, and the switching interval can be set to infinitely large.

[0075] For terminal 2, which has a smaller activity range, does not frequently turn on and off, and does not often use internet services, its registration interval can be set to 24 hours; the service request interval can be set to 1 hour; and the switching interval can be set to 10 hours.

[0076] For terminal 3, which has a large activity range and does not frequently turn on and off, it will remain stable for a period of time after connecting to the network. It frequently makes requests for services such as internet access and video streaming through the mobile terminal, and its location changes frequently, such as taking the subway / bus. Therefore, its registration interval can be set to 24 hours; the service request interval can be set to 5 minutes; and the switching interval can be set to 5 minutes.

[0077] It is understood that the above business characteristic indicator values ​​are only illustrative examples, and the specific values ​​can be adjusted according to the actual situation.

[0078] S4. Based on the traffic data and the business characteristic index values, perform anomaly analysis on the message sending and receiving intervals to obtain the abnormal state identification result of the terminal to be identified.

[0079] After obtaining the business characteristic index value corresponding to the terminal to be identified in the business process, the server performs anomaly analysis on the message sending and receiving interval based on the traffic data and the business characteristic index value. Specifically, it analyzes whether the interval between the terminal sending the same type of message is lower than the business characteristic index value, thereby obtaining the abnormal state identification result of the terminal to be identified.

[0080] Optionally, for terminals that are determined to be abnormal, appropriate measures can be taken, such as:

[0081] (1) Troubleshooting and Repair: Once the network operator detects an abnormal terminal, it can attempt to resolve the problem and restore the device to normal operation, including checking device connectivity, restarting the device, and updating firmware or software. If the problem cannot be resolved remotely, the network operator can dispatch technicians to the site for repair or replacement of the device.

[0082] (2) Optimize network configuration and resource allocation: Network operators can optimize network configuration and resources to improve the performance and stability of the entire network. For example, they can reallocate bandwidth, optimize signal coverage, and adjust network parameters to better meet the needs of abnormal terminals.

[0083] (3) Monitoring and Analysis: Network operators can use monitoring systems to monitor the status of devices and connections in the network in real time, collect and analyze data on abnormal terminals, such as connection quality, transmission rate, and error rate. By analyzing this data, problematic devices can be identified and corresponding measures can be taken.

[0084] (4) Remote management and control: Network operators can manage abnormal terminals through remote management and control systems, such as remotely accessing devices to perform configuration changes, software updates, troubleshooting, etc., in order to improve the performance and stability of the devices.

[0085] (5) User education and support: Network operators can provide relevant education and support to users to help them identify and resolve abnormal terminal problems. For example, they can provide user manuals, online help documents, technical support hotlines, etc., to help users perform simple troubleshooting or device settings.

[0086] (6) Security measures and defense strategies: For abnormal terminals that may involve network security, network operators can take security measures and defense strategies, including monitoring abnormal network traffic, intercepting malicious attacks, and updating network security policies, in order to protect the security of the network and users.

[0087] This application proposes an abnormal terminal identification method that can quickly and accurately detect abnormal terminals, providing network operators with timely troubleshooting and network optimization. This application has broad application prospects in network communication, and can improve network performance and user experience while reducing operating costs and maintenance workload.

[0088] In some embodiments, S4 performs anomaly analysis on message sending and receiving intervals based on the traffic data and the service characteristic indicator values ​​to obtain the abnormal state identification result of the terminal to be identified, including:

[0089] S41. Classify messages based on the traffic data to obtain message classification results;

[0090] S42. Determine the time interval for the terminal to be identified to send and receive messages of the same type based on the message classification results;

[0091] For example, the time interval between the first and second occurrences of a Registration Request message; the time interval between the h-th and h+1th occurrences of a Service Request message; and the time interval between the r-th and r+1th occurrences of a Handover Request message.

[0092] S43. Count the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value;

[0093] Optionally, in this step, the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value is counted using the following formula:

[0094]

[0095] Wherein, P represents the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value, i represents the label of the terminal to be identified, j represents the type of service feature, k represents the time interval sequence number between sending and receiving the same type of message by the terminal to be identified, T(i,j,k) represents the k-th time interval between sending and receiving the j-th type of service feature message by the i-th terminal to be identified, and F(i,j) represents the time interval index value between sending and receiving the j-th type of service feature message by the i-th terminal to be identified.

[0096] Optionally, i can be an integer in the range [1, n], where n is the total number of terminals. For example, i = 1 corresponds to terminal 1, i = 2 corresponds to terminal 2, i = 3 corresponds to terminal 3, and so on.

[0097] Optionally, j can be an integer in the range [1, 3]. j = 1 corresponds to the registration process, j = 2 corresponds to the business request process, and j = 3 corresponds to the switching process.

[0098] Optionally, k can be an integer in the range [1, ∞]. When k = 1, it is the first time interval; when k = 2, it is the second time interval; when k = 3, it is the third time interval, and so on.

[0099] For example, T(1,1,1) represents the first time interval between the first terminal to be identified sending and receiving registration process business messages, that is, the time interval between the first and second sending and receiving of the Registration Request message by terminal 1.

[0100] For example, T(4,3,5) represents the fifth time interval between the 4th terminal to be identified sending and receiving handover process service messages, that is, the time interval between the fifth and sixth times that terminal 4 sends and receives the Handover Request message.

[0101] S44. If the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold, then it is determined that the terminal to be identified has become abnormal.

[0102] Optionally, in this step, the number of times the time interval between the sending and receiving of the same type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold, including: the number of times the time interval between the sending and receiving of a single type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold; or, the total number of times the time interval between the sending and receiving of all types of messages by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold.

[0103] Specifically, for the number of times the sending and receiving time interval of messages of different business types is less than the corresponding time interval indicator value, the server can count them separately according to the business type, in which case, a separate threshold can be set for each type; or the server can count them together, in which case, a total threshold can be set for the total number of times.

[0104] For example, if the threshold numbers for the registration / unregistration process, the business request process, and the switching process are set to S1, S2, and S3 respectively, then the terminal can be considered to have malfunctioned when it meets at least one of the following conditions:

[0105] (1) The number of times the time interval between the terminal sending and receiving the same registration / deregistration process message is less than the corresponding time interval index value is P1 greater than or equal to S1, that is, P1≥S1;

[0106] (2) The number of times P2 is greater than or equal to S2 when the time interval between the terminal sending and receiving the same service request process message is less than the corresponding time interval index value, i.e., P2≥S2.

[0107] (3) The number of times the time interval between the terminal sending and receiving the same handover process message is less than the corresponding time interval index value, P3 is greater than or equal to S3, that is, P3≥S3.

[0108] For example, if the total number of times the registration / deregistration process, business request process, and switching process are set to a threshold of S4, then when the sum of the number of times the time interval between the terminal sending and receiving the same registration / deregistration process message is less than the corresponding time interval index value, the number of times the time interval between the terminal sending and receiving the same business request process message is less than the corresponding time interval index value, and the number of times the time interval between the terminal sending and receiving the same switching process message is less than the corresponding time interval index value is greater than or equal to S4, that is, P1+P2+P3≥S4, the terminal can be considered to have malfunctioned.

[0109] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0110] Figure 3 This is a schematic diagram of the abnormal terminal identification device provided in the embodiments of this application, such as... Figure 3 As shown, this application provides an abnormal terminal identification device, the device comprising:

[0111] The data acquisition module 11 is configured to acquire traffic data of the terminal to be identified;

[0112] The process classification module 12 is configured to classify processes based on the traffic data and determine the business processes corresponding to the traffic data.

[0113] The indicator acquisition module 13 is configured to acquire the business characteristic indicator value corresponding to the terminal to be identified in the business process according to the label of the terminal to be identified. The business characteristic indicator value represents the time interval indicator value of the terminal to be identified sending and receiving different types of business messages.

[0114] The anomaly analysis module 14 is configured to perform anomaly analysis on the message sending and receiving intervals based on the traffic data and the business characteristic index values, and obtain the anomaly status identification result of the terminal to be identified.

[0115] This application proposes an abnormal terminal identification device that can quickly and accurately detect abnormal terminals, providing network operators with timely troubleshooting and network optimization. This application has broad application prospects in network communication, and can improve network performance and user experience, while reducing operating costs and maintenance workload.

[0116] Regarding the limitations on the abnormal terminal identification device, please refer to the limitations on the abnormal terminal identification method in the above embodiments of this application, which will not be repeated here.

[0117] Figure 4 Another schematic diagram of the abnormal terminal identification device provided in the embodiments of this application is shown below. Figure 4 As shown, in some embodiments, this application provides an abnormal terminal identification device, including a memory 22 and a processor 21. The memory stores a computer program, and the processor is configured to run the computer program to execute the abnormal terminal identification method in the above embodiments of this application.

[0118] The memory is connected to the processor. The memory can be flash memory, read-only memory or other types of memory. The processor can be a central processing unit or a microcontroller.

[0119] In some embodiments, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the abnormal terminal identification method in the above embodiments of this application.

[0120] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0121] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of this application, and this application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this application, and these modifications and improvements are also considered to be within the scope of protection of this application.

Claims

1. A method for identifying abnormal terminals, characterized in that, The method includes: S1. Obtain traffic data of the terminal to be identified; S2. Classify the processes based on the traffic data and determine the business processes corresponding to the traffic data; S3. Based on the identifier of the terminal to be identified, obtain the business characteristic index value corresponding to the terminal to be identified in the business process. The business characteristic index value represents the time interval index value of the terminal to be identified sending and receiving various types of business messages. S4. Based on the traffic data and the business characteristic index values, perform anomaly analysis on message sending and receiving intervals to obtain the abnormal state identification result of the terminal to be identified; S4 includes: S41. Classify messages based on the traffic data to obtain message classification results; S42. Determine the time interval for the terminal to be identified to send and receive messages of the same type based on the message classification results; S43. Count the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value; S44. If the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold, then it is determined that the terminal to be identified has become abnormal.

2. The abnormal terminal identification method according to claim 1, characterized in that, In S2, the categories of the business processes include registration / deregistration process, business request process, and switching process.

3. The abnormal terminal identification method according to claim 2, characterized in that, In S3, the types of business characteristics include registration interval, business request interval, and switching interval.

4. The abnormal terminal identification method according to claim 1, characterized in that, In S43, the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value is counted using the following formula: Where P represents the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value, i represents the label of the terminal to be identified, j represents the type of service feature, and k represents the sequence number of the time interval between sending and receiving the same type of message by the terminal to be identified. This represents the k-th time interval for the i-th terminal to be identified to send and receive service characteristic messages of the j-th type. This represents the time interval index value for the i-th terminal to be identified to send and receive the j-th type of service characteristic message.

5. The abnormal terminal identification method according to claim 1, characterized in that, In S44, the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold, including: The number of times the time interval between sending and receiving a single type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold. Alternatively, the total number of times the time interval between sending and receiving all types of messages by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold.

6. The abnormal terminal identification method according to any one of claims 1-5, characterized in that, In S3, the business characteristic index value corresponding to the terminal to be identified in the business process is determined based on the historical business data of the terminal to be identified.

7. An abnormal terminal identification device, characterized in that, The device includes: The data acquisition module is configured to acquire traffic data of the terminal to be identified; The process classification module is configured to classify processes based on the traffic data and determine the business processes corresponding to the traffic data. The indicator acquisition module is configured to acquire the business characteristic indicator value corresponding to the terminal to be identified in the business process based on the label of the terminal to be identified. The business characteristic indicator value represents the time interval indicator value of the terminal to be identified sending and receiving various business messages. The anomaly analysis module is configured to perform anomaly analysis on message sending and receiving intervals based on the traffic data and the business characteristic indicator values, and obtain the anomaly status identification result of the terminal to be identified. The anomaly analysis module is specifically configured as follows: The messages are classified based on the traffic data to obtain the message classification results; The time interval for the terminal to be identified to send and receive the same type of message is determined based on the message classification results; The number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value is counted. If the number of times the time interval between sending and receiving the same type of message by the terminal to be identified is less than the corresponding time interval index value reaches a preset threshold, then the terminal to be identified is determined to be abnormal.

8. An abnormal terminal identification device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to implement the abnormal terminal identification method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the abnormal terminal identification method as described in any one of claims 1-6.

Images