Abnormal iot card sale detection method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of communication, and provides an abnormal Internet of Things card sale detection method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring the sale data of the Internet of Things card corresponding to at least one sale account every preset period, and extracting feature data from the sale data. The feature data comprises the following: the number of newly registered cards, the number of regions, the number of cards for mobile devices, and the number of cards for non-directional APN (Access Point Name). For each sale account, an evaluation index is calculated based on the feature data, and the evaluation index and the feature data are processed by using a predefined algorithm to obtain an abnormal score. It is judged whether the feature data and the abnormal score meet a preset condition. If yes, the sale account is determined as an abnormal Internet of Things card sale account. In this way, the online sale behavior of the Internet of Things card corresponding to the sale account can be identified through the sale data and the algorithm, the accuracy of detecting abnormal Internet of Things card sales is improved, and the influence on the website use performance is reduced.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting abnormal IoT card sales. Background Technology

[0002] IoT SIM cards are user identification modules (SIM cards) used by telecom operators in IoT services. They provide mobile communication access services to IoT users based on IoT private networks and are widely used in industries such as power, finance, and transportation. IoT SIM cards are not allowed to be sold directly to individuals and must be sold to companies. However, some companies purchase IoT SIM cards but do not use them for the purposes specified in the sales contract. Instead, they sell the cards to individuals. Therefore, it is necessary to detect abnormal sales of IoT SIM cards.

[0003] In existing technologies, web crawling technology can be used to obtain advertising information from various websites, and then keywords in the advertising information can be extracted and matched to determine whether there is any abnormal sale of IoT cards.

[0004] However, due to the wide variety of websites and the fact that some sales information is displayed as images on web pages, it is difficult to identify all advertising information and extract keywords for matching, resulting in low detection accuracy and affecting website performance. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and storage medium for detecting abnormal IoT card sales. It addresses the problem that when using web crawler technology to identify advertising information on websites and determine if abnormal IoT card sales exist, the detection accuracy is low, impacting website performance. By using sales data and algorithms to identify online sales behavior corresponding to IoT cards under sales accounts, the method improves the accuracy of detecting abnormal IoT card sales and reduces the impact on website performance.

[0006] Firstly, this application provides a method for detecting abnormal IoT card sales, the method comprising:

[0007] Every preset period, sales data of IoT cards corresponding to at least one sales account are obtained, and feature data is extracted from the sales data; the feature data includes: the number of newly registered cards, the number of regions, the number of cards used by mobile devices, and the number of cards with non-directional access points (APNs);

[0008] For each sales account, an evaluation index is calculated based on the feature data, and a predefined algorithm is used to process the evaluation index and the feature data to obtain an anomaly score.

[0009] Determine whether the feature data and the anomaly score meet preset conditions;

[0010] If so, then the sales account is determined to be the sales account of the abnormal IoT card.

[0011] Optionally, the sales data includes the card number used for real-name authentication, the real-name authentication time, the communication record information corresponding to the IoT card, the International Mobile Equipment Identity (IMEI) of the IoT card, and the APN name of the IoT card; feature data is extracted from the sales data, including:

[0012] The number of newly registered cards is counted by counting the real-name authenticated card numbers. Based on the real-name authentication time corresponding to the real-name authentication, the region of real-name authentication is searched in the communication record information, and the number of regions of real-name authentication is counted.

[0013] Based on the International Mobile Equipment Identity (IMEI), the device type is searched from a predefined device library, and based on the device type, the IoT card for use by the mobile device is determined, and the number of cards for use by the mobile device is counted.

[0014] Based on the APN name, the APN type is searched from the predefined attribute library, and the IoT cards with non-directional APNs are determined based on the APN type. The number of cards with non-directional APNs is then counted.

[0015] Optionally, the evaluation index is calculated based on the feature data, including:

[0016] The ratio of the number of regions to the number of newly registered cards is calculated to obtain a first indicator, which is used to indicate that the newly registered cards are distributed in different regions for users to use.

[0017] The ratio of the number of cards used by the mobile device to the number of newly registered cards is calculated to obtain a second indicator. The second indicator is used to indicate that the proportion of newly registered cards used in mobile devices is higher than a first preset value.

[0018] The ratio of the number of cards with non-directed APNs to the number of newly registered cards is calculated to obtain a third indicator, which is used to indicate that the proportion of newly registered cards accessing the public network is higher than a second preset value.

[0019] Optionally, the evaluation metrics and feature data are processed using a predefined algorithm to obtain anomaly scores, including:

[0020] The number of newly registered cards, the number of cards used by mobile devices, and the number of cards with non-directed APNs are respectively subjected to extreme value normalization processing to obtain the fourth, fifth, and sixth indicators.

[0021] The number of regions is normalized to obtain the seventh index;

[0022] An anomaly score is obtained by processing the first, second, third, fourth, fifth, sixth, and seventh indicators using a predefined algorithm.

[0023] Optionally, a predefined algorithm is used to process the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator to obtain an anomaly score, including:

[0024] Obtain the business sales requirements corresponding to the sales account, and determine the proportional coefficients corresponding to the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator based on the business sales requirements;

[0025] The proportion of each indicator is calculated based on the proportional coefficient, and the proportions are summed to obtain the anomaly score.

[0026] Optionally, determining whether the feature data and the anomaly score meet preset conditions includes:

[0027] Obtain a first preset threshold corresponding to each feature data and a second preset threshold corresponding to the abnormal score, and determine whether the feature data and the abnormal score meet preset conditions. The preset conditions are that each feature data is greater than the corresponding first preset threshold and the abnormal score is greater than the corresponding second preset threshold.

[0028] Optionally, the method further includes:

[0029] Obtain the account information corresponding to the sales account of the abnormal IoT card, generate an alarm based on the account information, and send the alarm to the terminal device corresponding to the operation and maintenance personnel for early warning, so that the operation and maintenance personnel can take security measures for the sales account.

[0030] Secondly, this application also provides an abnormal IoT card detection device, the device comprising:

[0031] The data collection and statistics module is used to acquire sales data of IoT cards corresponding to at least one sales account at preset intervals, and extract feature data from the sales data; the feature data includes: the number of newly registered cards, the number of regions, the number of cards used by mobile devices, and the number of cards with non-directional access points (APNs);

[0032] The algorithm module is used to calculate evaluation indicators for each sales account based on the feature data, and to process the evaluation indicators and feature data using a predefined algorithm to obtain anomaly scores.

[0033] The filtering module is used to determine whether the feature data and the anomaly score meet preset conditions;

[0034] The result output module is used to determine that the sales account is an abnormal IoT card sales account when the feature data and the anomaly score meet preset conditions.

[0035] Thirdly, this application also provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0036] The memory stores computer-executed instructions;

[0037] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0038] Fourthly, this application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0039] In summary, this application provides a method, apparatus, electronic device, and storage medium for detecting abnormal IoT card sales. It can acquire sales data of IoT cards corresponding to at least one sales account at preset intervals and extract feature data from the sales data. Furthermore, for each sales account, an evaluation index is calculated based on the feature data, and a predefined algorithm is used to process the evaluation index and feature data to obtain an anomaly score. Then, it is determined whether the feature data and anomaly score meet preset conditions. If so, the sales account is identified as a sales account for abnormal IoT cards. The feature data includes: the number of newly registered cards, the number of regions, the number of cards used for mobile devices, and the number of cards with non-directional access points (APNs). This feature data can be used to accurately reflect whether IoT card sales are abnormal. Thus, by extracting feature data from sales data and using algorithms to identify the online sales behavior corresponding to IoT cards under a sales account, the accuracy of detecting abnormal IoT card sales can be improved, and the impact on website performance can be reduced. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0041] Figure 1This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0042] Figure 2 A flowchart illustrating an abnormal IoT card sales detection method provided in this application embodiment;

[0043] Figure 3 A flowchart illustrating a specific method for detecting abnormal IoT card sales, provided as an embodiment of this application;

[0044] Figure 4 This is a schematic diagram of the structure of an abnormal IoT card sales detection device provided in an embodiment of this application;

[0045] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0046] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0047] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0048] To facilitate a clear description of the technical solutions in the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with essentially the same function and purpose. For example, "first device" and "second device" are merely used to distinguish different devices and do not limit their order of execution. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply that they are different.

[0049] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0050] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, and necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0052] In practical applications, IoT cards are not allowed to be sold directly to individuals; they must be sold to companies. This means that IoT cards should be used in business-to-business (B2B) or business-to-business-to-consumer (B2B2C) models. Furthermore, companies purchasing the cards should use them with the corresponding devices. However, there is a risk that companies may purchase IoT cards but not use them for the purposes stipulated in the sales contract, instead selling them online to individuals. Therefore, it is necessary to detect such abnormal online sales and send the detection results to relevant personnel for handling.

[0053] The embodiments of this application will now be described in conjunction with the accompanying drawings. Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. The abnormal IoT card sales detection method provided in this application can be applied to, for example... Figure 1The application scenario shown includes: a smart bracelet 101, smart glasses 102, a smartphone 103, a processing platform 104, and a terminal device 105 for maintenance personnel. Specifically, the processing platform 104 can collect sales data related to IoT cards corresponding to a certain sales account over a period of time, and then determine the registration and usage information from different devices based on the sales data, such as the registration time, registration location, and access point name (APN) of the smart bracelet 101, smart glasses 102, and smartphone 103. This information is then processed to identify whether the sales account is an abnormal online sales account. If so, the information of the sales account is fed back to the terminal device 105 of the maintenance personnel for display, so that the maintenance personnel can take action on the sales account.

[0054] Understandably, in the short term, cards issued by the same company to individuals through normal channels are generally concentrated in a few cities and should be used on devices. However, online sales are random, and the use of IoT cards is scattered across various cities. Furthermore, cards sold online to individuals are usually inserted into smartphones rather than used on devices and need to be able to access various websites. Therefore, by obtaining the sales data of IoT cards sold to smartphones corresponding to the sales account, it is possible to determine whether the sales account is an abnormal IoT card sales account.

[0055] The aforementioned terminal devices can be either wireless or wired. A wireless terminal can be a device that provides voice and / or other service data connectivity to a user, a handheld device with wireless connectivity, or other processing devices connected to a wireless modem. The wireless terminal can communicate with one or more core network devices via a Radio Access Network (RAN). The wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) or a computer with a mobile terminal, for example, a portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile device, which exchanges voice and / or data with the RAN. Furthermore, a wireless terminal can also be a Personal Communication Service (PCS) phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), or other similar devices. A wireless terminal can also be referred to as a system, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, access terminal, user terminal, user agent, user device, or user equipment; no specific terminology is used here. Optionally, the aforementioned terminal devices can also be smartphones, tablets, or other similar devices.

[0056] One possible implementation is to use web crawling technology to obtain advertising information from various websites, and then extract keywords from the advertising information for matching to determine whether there is any abnormal sale of IoT cards.

[0057] However, due to the wide variety of websites, it is easy to miss some advertising information when collecting it. Some sales information is displayed on the webpage in the form of images, making it difficult to identify all advertising information and extract keywords for matching. The accuracy of detection is low, and using web crawler technology to crawl a large amount of website information may affect the performance of the website.

[0058] To address the aforementioned issues and analyze application scenarios, this application provides a method for detecting abnormal IoT SIM card sales. The method involves designing four characteristic data points and a scoring mechanism. These characteristic data points are determined by users based on extensive experimental analysis of the differences in usage behavior between online sales and cards acquired through normal channels. This data reflects whether IoT SIM card sales behavior is abnormal and can effectively identify whether a sales account is an abnormal online sales account. Specifically, by acquiring the corresponding sales data under the sales account, characteristic data can be identified within the sales data. Furthermore, using the extracted characteristic data and evaluation indicators obtained through statistical methods, and based on the designed scoring mechanism, anomaly scoring is achieved for all sales accounts. This anomaly score reflects the degree of risk associated with selling IoT SIM cards. Therefore, based on the anomaly score and characteristic data, sales accounts for abnormal IoT SIM card sales can be identified, improving the accuracy of detecting abnormal IoT SIM card sales and reducing the impact on website performance.

[0059] The technical solutions of this application will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0060] Figure 2 This is a flowchart illustrating an abnormal IoT card sales detection method provided in an embodiment of this application, as shown below. Figure 2 As shown, the abnormal IoT card sales detection method includes the following steps:

[0061] S201. Every preset period, acquire sales data of IoT cards corresponding to at least one sales account, and extract feature data from the sales data; the feature data includes: the number of newly registered cards, the number of regions, the number of cards used by mobile devices, and the number of cards of non-directional access point APN.

[0062] In this embodiment of the application, the preset period can refer to the time period set for collecting a sufficient amount of sales data to identify abnormal IoT card sales behavior. The preset period can be determined according to the actual situation and can also be modified manually. This embodiment of the application does not make specific limitations on this. For example, the preset period can be set to 7 days.

[0063] In this step, the feature data extracted from the sales data includes: the number of newly registered cards, the number of regions, the number of cards used for mobile devices, and the number of cards for non-directed access points (APNs). Since IoT cards must be registered with a real name before they can be used, and registration requires the user's own action, the number of newly registered cards represents the number of IoT cards recently registered and used by new users. The higher the number, the more IoT cards recently added and used under the sales account. The number of regions refers to the number of regions where the newly registered cards are distributed. The higher the number of regions, the more dispersed the actual usage locations of the newly registered cards are, which better matches the characteristics of online sales of IoT cards to individuals.

[0064] The number of cards used on mobile devices can refer to the number of newly registered cards used on mobile devices such as smartphones. Since IoT cards should be used on enterprise hardware, and IoT cards sold online to individuals are primarily used on smartphones, obtaining the number of cards used on mobile devices reflects whether IoT cards are sold online to individuals for use on mobile devices. The number of cards using non-directed access points (APNs) can refer to the number of newly registered cards using non-directed APNs. Since using a non-directed APN allows access to any website, it matches the usage characteristics of IoT cards sold online to individuals. The higher the number of cards using non-directed access points (APNs), the higher the proportion of newly registered cards accessing the public network, which better matches the characteristics of IoT cards sold online to individuals.

[0065] S202. For each sales account, calculate the evaluation index based on the feature data, and use a predefined algorithm to process the evaluation index and the feature data to obtain an anomaly score.

[0066] In this embodiment of the application, the predefined algorithm may refer to an algorithm set for calculating the score of a sales account suspected of being an abnormal online sales account. The predefined algorithm may be an addition algorithm, a weighted summation algorithm, or a proportional coefficient summation method, etc. This embodiment of the application does not make specific limitations on this. The predefined algorithm is used to calculate the comprehensive score of the abnormal sales account. The higher the comprehensive score, the greater the probability that the sales account is an abnormal IoT card sales account.

[0067] In this step, for each sales account, an evaluation index is calculated based on the feature data. That is, a derivative index corresponding to the sales account is calculated based on the feature data. The derivative index is the proportion of the feature data to the number of newly registered cards, which is used to reflect the absolute degree to which the sales account is determined to be an abnormal IoT card. Further, the evaluation index and the feature data are processed using a predefined algorithm to obtain an anomaly score. That is, the comprehensive score corresponding to the derivative index and the feature data is calculated using a predefined algorithm, which is used to reflect the possibility of abnormal sales.

[0068] S203. Determine whether the feature data and the anomaly score meet the preset conditions.

[0069] In this embodiment of the application, the preset condition may refer to the judgment condition used to determine that the numerical values ​​corresponding to the feature data and the abnormal score are unreasonable, thereby indicating that there is an abnormal sales behavior. The preset condition may be that each feature data is greater than the corresponding preset threshold and the abnormal score is greater than the corresponding preset threshold, or that each feature data is located in a preset range and the abnormal score is also located in a preset range, or that each feature data and the abnormal score correspond to a specific value, etc. This embodiment of the application does not specifically limit the preset condition.

[0070] Optionally, after calculating the anomaly score using the algorithm, the anomaly scores corresponding to different sales accounts can be sorted in descending order to filter out the sales accounts with the highest scores. Then, by determining whether each feature data corresponding to the sales account is greater than the corresponding preset threshold and whether the anomaly score is greater than the corresponding preset threshold, the sales account of the abnormal IoT card can be identified. The higher the anomaly score, the higher the risk of abnormal sales of IoT cards. This can simplify the steps and improve processing efficiency.

[0071] S204. If so, then the sales account is determined to be the sales account of the abnormal IoT card.

[0072] Optionally, if it is determined that the feature data and the abnormal score do not meet the preset conditions, it means that the sales account does not meet the characteristics of randomly selling IoT cards to individuals online, because if the number of newly registered cards is too small, or if the newly registered IoT cards in use within the preset period are concentrated in one area, then it does not meet the characteristics of online sales.

[0073] Therefore, this application provides a method for detecting abnormal IoT card sales. It involves acquiring sales data of IoT cards corresponding to at least one sales account at preset intervals and extracting feature data from the sales data. Further, for each sales account, an evaluation index is calculated based on the feature data, and a predefined algorithm is used to process the evaluation index and feature data to obtain an anomaly score. Then, it is determined whether the feature data and the anomaly score meet preset conditions. If so, the sales account is identified as a sales account for abnormal IoT cards. The extracted feature data can be used to accurately reflect whether IoT card sales are abnormal. Thus, by extracting feature data from sales data and using algorithms to identify the online sales behavior corresponding to IoT cards under a sales account, the accuracy of detecting abnormal IoT card sales can be improved, and the impact on website performance can be reduced.

[0074] Optionally, the sales data includes the card number used for real-name authentication, the real-name authentication time, the communication record information corresponding to the IoT card, the International Mobile Equipment Identity (IMEI) of the IoT card, and the APN name of the IoT card; feature data is extracted from the sales data, including:

[0075] The number of newly registered cards is counted by counting the real-name authenticated card numbers. Based on the real-name authentication time corresponding to the real-name authentication, the region of real-name authentication is searched in the communication record information, and the number of regions of real-name authentication is counted.

[0076] Based on the International Mobile Equipment Identity (IMEI), the device type is searched from a predefined device library, and based on the device type, the IoT card for use by the mobile device is determined, and the number of cards for use by the mobile device is counted.

[0077] Based on the APN name, the APN type is searched from the predefined attribute library, and the IoT cards with non-directional APNs are determined based on the APN type. The number of cards with non-directional APNs is then counted.

[0078] In this embodiment of the application, the communication record information may refer to call detail records (CDRs). Taking a smartphone as an example, the CDR includes the following information: serial number, user identifier, calling number, called number, start time, end time, call duration, call type, call area, rate, cost, discount, SMS service data, membership management data, wireless application protocol data, general packet radio service data, etc.

[0079] The predefined device library may refer to a database used to store the correspondence between International Mobile Equipment Identity (IMEI) and device type. Each IMEI corresponds to an independent mobile communication device such as a smartphone in a mobile phone network. The predefined attribute library refers to a database used to store the correspondence between APN type and APN name. The APN type is used to indicate whether the IoT card is a directed APN or a non-directed APN. The non-directed APN can access any website at will, while the directed APN is used to access a specific website.

[0080] In this step, data from the real-name registration system is collected, specifically by counting the card numbers that have been registered within a preset period to obtain the number of newly registered cards. Further, based on the card numbers of the newly registered IoT cards, the location information corresponding to each IoT card is found by associating the call detail records (CDRs) with the time of real-name registration. Specifically, the location area at the time of real-name registration is obtained through the location information in the CDRs, and the number of such areas is counted to obtain the number of areas where real-name registration was conducted. Correspondingly, the IoT card's IMEI can be matched against a predefined device library to obtain the corresponding device type, used to determine whether the IoT card is used on a mobile device, thus obtaining the number of cards used on mobile devices. Similarly, the IoT card's configured APN name can be matched against a predefined attribute library to obtain the corresponding APN type, used to determine whether the IoT card is a non-directed APN, thus obtaining the number of non-directed APN cards.

[0081] Therefore, the embodiments of this application use feature data to determine the sales account of abnormal IoT cards, which can effectively identify whether the sales account is an abnormal online sales account, and is in line with actual application conditions.

[0082] Optionally, the evaluation index is calculated based on the feature data, including:

[0083] The ratio of the number of regions to the number of newly registered cards is calculated to obtain a first indicator, which is used to indicate that the newly registered cards are distributed in different regions for users to use.

[0084] The ratio of the number of cards used by the mobile device to the number of newly registered cards is calculated to obtain a second indicator. The second indicator is used to indicate that the proportion of newly registered cards used in mobile devices is higher than a first preset value.

[0085] The ratio of the number of cards with non-directed APNs to the number of newly registered cards is calculated to obtain a third indicator, which is used to indicate that the proportion of newly registered cards accessing the public network is higher than a second preset value.

[0086] In this step, the first indicator is an absolute indicator, calculated by the ratio of the number of regions to the number of newly registered SIM cards, reflecting the number of usage locations corresponding to the IoT cards in these regions; it is a relative indicator. The second indicator is also an absolute indicator, calculated by the ratio of the number of SIM cards used on mobile devices to the number of newly registered SIM cards, reflecting the proportion of IoT cards used on mobile devices to the total number of newly registered SIM cards; it is also a relative indicator. The third indicator is also an absolute indicator, calculated by the ratio of the number of SIM cards using non-directed APNs to the number of newly registered SIM cards, reflecting the proportion of SIM cards using non-directed APNs to the total number of newly registered SIM cards; it is also a relative indicator.

[0087] Therefore, this application embodiment uses feature data to calculate derived indicators, thereby increasing the basis for determining whether a sales account is an abnormal sales IoT card and improving the judgment performance.

[0088] Optionally, the evaluation metrics and feature data are processed using a predefined algorithm to obtain anomaly scores, including:

[0089] The number of newly registered cards, the number of cards used by mobile devices, and the number of cards with non-directed APNs are respectively subjected to extreme value normalization processing to obtain the fourth, fifth, and sixth indicators.

[0090] The number of regions is normalized to obtain the seventh index;

[0091] An anomaly score is obtained by processing the first, second, third, fourth, fifth, sixth, and seventh indicators using a predefined algorithm.

[0092] In this embodiment, it is necessary to remove dimensions from the number of newly registered SIM cards, the number of regions, the number of SIM cards used by mobile devices, and the number of SIM cards for non-directed access points (APNs). Since the number of newly registered SIM cards, the number of SIM cards used by mobile devices, and the number of SIM cards for non-directed APNs all correspond to the number of SIM cards, and the number of SIM cards under each sales account varies significantly, potentially reaching extreme maximum values, the aforementioned SIM card counts are optimized using a normalization algorithm. However, extreme value normalization algorithms are easily affected by maximum and minimum values. If the maximum value is large, the SIM card count after normalization will lack distinguishability. Therefore, a logarithmic normalization algorithm is used to optimize the aforementioned SIM card counts. The maximum value of the number of regions will not exceed the hundreds, so a normalization algorithm can be used to optimize the number of regions.

[0093] Specifically, the formula corresponding to the normalization algorithm is as follows:

[0094]

[0095] The formula for the logarithmic normalization algorithm is as follows:

[0096]

[0097] in, This indicates that different feature data correspond to the fourth, fifth, sixth, and seventh indicators. This represents the corresponding feature data. This represents the minimum value in the corresponding feature data. This represents the maximum value in the corresponding feature data; Taking the fourth indicator as an example, This indicates the number of newly registered cards associated with a specific sales account. This represents the minimum number of newly registered cards across all sales accounts. This represents the maximum number of newly registered cards across all sales accounts.

[0098] It should be noted that since the first, second, and third indicators correspond to ratio values, there is no need to use a normalization algorithm to process them.

[0099] Optionally, the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator are added together to obtain an abnormal score, which is used as the score value for suspected abnormal online sales corresponding to the sales account.

[0100] It is understood that the predefined algorithm can also be other custom algorithms, such as weighted summation algorithm, proportional summation algorithm, etc. This application embodiment does not specifically limit this, as long as it can achieve comprehensive scoring statistics. The above predefined algorithm uses addition, which is relatively simple and is only an example.

[0101] Therefore, the embodiments of this application use multiple indicators to calculate the abnormal score, which improves the accuracy of identifying abnormal sales, and thus can accurately identify whether the corresponding sales are abnormal online sales or cards obtained through normal channels.

[0102] Optionally, a predefined algorithm is used to process the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator to obtain an anomaly score, including:

[0103] Obtain the business sales requirements corresponding to the sales account, and determine the proportional coefficients corresponding to the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator based on the business sales requirements;

[0104] The proportion of each indicator is calculated based on the proportional coefficient, and the proportions are summed to obtain the anomaly score.

[0105] In this embodiment of the application, the business sales demand may refer to the sales demand corresponding to different sales accounts. It may be determined based on environmental factors such as the purchasing user's consumption level and sales volume, or it may be determined based on other custom factors such as time factors. This embodiment of the application does not make specific limitations on this.

[0106] For example, taking a first indicator of 10, a second indicator of 2, a third indicator of 3, a fourth indicator of 4, a fifth indicator of 4, a sixth indicator of 6, and a seventh indicator of 8 as an example, the business sales demand corresponding to a certain sales account can be obtained. Based on this business sales demand, the proportional coefficients corresponding to the first, second, third, fourth, fifth, sixth, and seventh indicators are determined to be 0.1, 0.2, 0.2, 0.5, 0.3, 0.7, and 0.5, respectively. Furthermore, the anomaly score is calculated as follows: .

[0107] It should be noted that the embodiments of this application do not specifically limit the values ​​and proportional coefficients of the first, second, third, fourth, fifth, sixth and seventh indicators; the above are merely illustrative examples.

[0108] Therefore, the method for calculating anomaly scores in this application embodiment can be applied to determine different business sales needs, thereby improving the flexibility of the application.

[0109] Optionally, determining whether the feature data and the anomaly score meet preset conditions includes:

[0110] Obtain a first preset threshold corresponding to each feature data and a second preset threshold corresponding to the abnormal score, and determine whether the feature data and the abnormal score meet preset conditions. The preset conditions are that each feature data is greater than the corresponding first preset threshold and the abnormal score is greater than the corresponding second preset threshold.

[0111] In this embodiment, the first preset threshold can refer to a threshold set to determine whether the feature data is within a reasonable range, and the second preset threshold can refer to a threshold set to determine whether the abnormal score is within a reasonable range. Exceeding the first and second preset thresholds indicates that the sales behavior of the corresponding sales account meets the characteristics of abnormal online sales. In this embodiment, the specific values ​​of the first preset threshold and the second preset threshold corresponding to each feature data and abnormal score are not specifically limited. For example, the threshold for the number of newly registered cards is 9, the threshold for the number of regions is 1, the threshold for the number of cards used by mobile devices is 3, the threshold for the number of cards of non-directed access point APN is 3, and the threshold for abnormal score is 2.5.

[0112] In this step, sales accounts can be screened based on feature data and abnormal scores to identify accounts with abnormal online sales. Specifically, a screening method combining two aspects is adopted: obtaining a first preset threshold corresponding to each feature data, and then filtering out sales accounts below the first preset threshold based on the first preset threshold corresponding to the four feature data; furthermore, obtaining a second preset threshold corresponding to the abnormal score, and filtering out sales accounts with scores below the second preset threshold based on the second preset threshold, thus obtaining sales users that meet the preset conditions, i.e., sales accounts of abnormal IoT cards.

[0113] It should be noted that if any feature data is lower than the first preset threshold, it will not be considered an abnormal online sales account.

[0114] Therefore, the embodiments of this application can determine whether a sales account is for an abnormal IoT card based on preset conditions, wherein each corresponding data needs to be greater than a set threshold, thereby improving the accuracy of determining abnormal sales.

[0115] Optionally, the method further includes:

[0116] Obtain the account information corresponding to the sales account of the abnormal IoT card, generate an alarm based on the account information, and send the alarm to the terminal device corresponding to the operation and maintenance personnel for early warning, so that the operation and maintenance personnel can take security measures for the sales account.

[0117] In this embodiment, account information may refer to the identity information corresponding to the sales account, such as store name, sales link, registration information, etc. This embodiment does not specifically limit this. The account information is used by maintenance personnel to verify and cancel the sales account. The alarm prompt may refer to the prompt information generated based on the account information to indicate that the sales account is an abnormal sales account. This embodiment does not specifically limit the content and sending form of the alarm prompt. For example, the alarm prompt may be sent to the terminal device corresponding to the maintenance personnel in the form of SMS and the content displayed is "Sales account 1 is a sales account of an abnormal IoT card".

[0118] In this step, the account information of the sales account for abnormally selling IoT cards is output to the security monitoring platform for early warning, so that relevant operation and maintenance personnel can query and take security measures. For example, security measures such as canceling the sales account or sending a warning message to the sales account to remind it to remove the product from the market can be taken. This application embodiment does not specifically limit the corresponding security measures, which can be determined according to different business scenarios.

[0119] Therefore, this application embodiment can generate alarm prompts based on the account information corresponding to the sales account of abnormal IoT cards to provide early warning, which facilitates maintenance personnel to handle the sales account of abnormal IoT cards in a timely manner and reduce losses.

[0120] In conjunction with the above embodiments, Figure 3 This is a flowchart illustrating a specific abnormal IoT card detection method provided in an embodiment of this application; as shown below. Figure 3 As shown, the abnormal IoT card detection method includes the following steps:

[0121] Step A: Collect relevant data, such as the cards that have undergone real-name authentication in the past 7 days and their real-name authentication time, the call details of these cards in the past 7 days, the IMEI of these cards, and the APN information configured for these cards. Further, perform statistics on the collected relevant data, that is, find the call details of the corresponding cards for the corresponding time by real-name authentication time and card number, obtain the real-name authentication city, and count the number of real-name authentication cities; match the device type in the device library (predefined device library) by the card's IMEI to count the number of cards used by mobile devices; match the APN type in the APN attribute library (predefined attribute library) by the card's APN name to count the number of cards with non-directed APNs, and then proceed to Step B.

[0122] Step B: Perform algorithmic processing on the statistical data, that is, use different normalization algorithms to normalize the four indicators (feature data), remove the dimensions, and calculate three derived indicators based on the feature data to obtain the relative value evaluation; further, add the four normalized indicators and the three derived indicators to obtain the comprehensive score (anomaly score), and then proceed to step C.

[0123] Step C: Obtain the thresholds for the four indicators and the threshold for the comprehensive score, for a total of five thresholds (preset thresholds). Use these five thresholds to filter the four indicators and the comprehensive score, that is, filter out sales accounts that exceed the five thresholds as suspected abnormal online sales accounts, and output the suspected abnormal online sales accounts to the security monitoring platform for display, early warning processing, and for relevant personnel to confirm and verify whether they are abnormal sales accounts and take appropriate action.

[0124] It should be noted that the above methods can be packaged into different software modules or devices, so that they can run automatically every day and automatically output the identified suspected online sales accounts, thereby improving the ease of use.

[0125] In the foregoing embodiments, the abnormal IoT card detection method provided by the embodiments of this application has been described. To implement the functions of the methods provided by the embodiments of this application, the electronic device acting as the execution subject may include hardware structures and / or software modules, implementing the above functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. Whether a particular function is executed in the form of hardware structures, software modules, or a combination of hardware structures and software modules depends on the specific application and design constraints of the technical solution.

[0126] For example, Figure 4 This is a schematic diagram of the structure of an abnormal IoT card detection device provided in an embodiment of this application, as shown below. Figure 4 As shown, the device includes: a data acquisition and statistics module 410, an algorithm module 420, a filtering module 430, and a result output module 440; wherein, the data acquisition and statistics module 410 is used to acquire sales data of IoT cards corresponding to at least one sales account at preset intervals, and extract feature data from the sales data; the feature data includes: the number of newly registered cards, the number of regions, the number of cards used by mobile devices, and the number of cards with non-directional access points (APNs);

[0127] The algorithm module 420 is used to calculate evaluation indicators for each sales account based on the feature data, and to process the evaluation indicators and the feature data using a predefined algorithm to obtain an anomaly score.

[0128] The filtering module 430 is used to determine whether the feature data and the anomaly score meet preset conditions;

[0129] The result output module 440 is used to determine that the sales account is the sales account of the abnormal IoT card when the feature data and the abnormal score meet the preset conditions.

[0130] Optionally, the sales data includes the card number used for real-name authentication, the real-name authentication time, the communication record information corresponding to the IoT card, the International Mobile Equipment Identity (IMEI) corresponding to the IoT card, and the APN name corresponding to the IoT card; the collection and statistics module 410 is specifically used for:

[0131] The number of newly registered cards is counted by counting the real-name authenticated card numbers. Based on the real-name authentication time corresponding to the real-name authentication, the region of real-name authentication is searched in the communication record information, and the number of regions of real-name authentication is counted.

[0132] Based on the International Mobile Equipment Identity (IMEI), the device type is searched from a predefined device library, and based on the device type, the IoT card for use by the mobile device is determined, and the number of cards for use by the mobile device is counted.

[0133] Based on the APN name, the APN type is searched from the predefined attribute library, and the IoT cards with non-directional APNs are determined based on the APN type. The number of cards with non-directional APNs is then counted.

[0134] Optionally, the algorithm module 420 includes a computing unit and a processing unit, wherein the computing unit is used for:

[0135] The ratio of the number of regions to the number of newly registered cards is calculated to obtain a first indicator, which is used to indicate that the newly registered cards are distributed in different regions for users to use.

[0136] The ratio of the number of cards used by the mobile device to the number of newly registered cards is calculated to obtain a second indicator. The second indicator is used to indicate that the proportion of newly registered cards used in mobile devices is higher than a first preset value.

[0137] The ratio of the number of cards with non-directed APNs to the number of newly registered cards is calculated to obtain a third indicator, which is used to indicate that the proportion of newly registered cards accessing the public network is higher than a second preset value.

[0138] Optionally, the processing unit is used for:

[0139] The number of newly registered cards, the number of cards used by mobile devices, and the number of cards with non-directed APNs are respectively subjected to extreme value normalization processing to obtain the fourth, fifth, and sixth indicators.

[0140] The number of regions is normalized to obtain the seventh index;

[0141] An anomaly score is obtained by processing the first, second, third, fourth, fifth, sixth, and seventh indicators using a predefined algorithm.

[0142] Optionally, the processing unit is specifically used for:

[0143] Obtain the business sales requirements corresponding to the sales account, and determine the proportional coefficients corresponding to the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator based on the business sales requirements;

[0144] The proportion of each indicator is calculated based on the proportional coefficient, and the proportions are summed to obtain the anomaly score.

[0145] Optionally, the filtering module 430 is specifically used for:

[0146] Obtain a first preset threshold corresponding to each feature data and a second preset threshold corresponding to the abnormal score, and determine whether the feature data and the abnormal score meet preset conditions. The preset conditions are that each feature data is greater than the corresponding first preset threshold and the abnormal score is greater than the corresponding second preset threshold.

[0147] Optionally, the device further includes a warning module, the warning module being used for:

[0148] Obtain the account information corresponding to the sales account of the abnormal IoT card, generate an alarm based on the account information, and send the alarm to the terminal device corresponding to the operation and maintenance personnel for early warning, so that the operation and maintenance personnel can take security measures for the sales account.

[0149] The specific implementation principle and effects of the abnormal IoT card sales detection device provided in this application embodiment can be found in the relevant descriptions and effects of the above embodiments, and will not be elaborated further here.

[0150] This application also provides a schematic diagram of the structure of an electronic device. Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 5 As shown, the electronic device may include: a processor 501 and a memory 502 communicatively connected to the processor; the memory 502 stores a computer program; the processor 501 executes the computer program stored in the memory 502, causing the processor 501 to perform the method described in any of the above embodiments.

[0151] The memory 502 and the processor 501 can be connected via bus 503.

[0152] This application also provides a computer-readable storage medium storing computer program execution instructions, which, when executed by a processor, are used to implement the methods described in any of the foregoing embodiments of this application.

[0153] This application also provides a chip for executing instructions, which is used to perform the methods described in any of the foregoing embodiments executed by an electronic device as described in any of the foregoing embodiments of this application.

[0154] This application also provides a computer program product, which includes a computer program that, when executed by a processor, can implement the methods described in any of the foregoing embodiments executed by an electronic device as described in any of the foregoing embodiments of this application.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0156] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0157] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0158] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0159] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0160] The memory may include high-speed random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0161] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0162] The aforementioned storage media can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage media can be any available medium accessible to general-purpose or special-purpose computers.

[0163] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in application-specific integrated circuits (ASICs). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0164] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for detecting abnormal IoT card sales, characterized in that, The method includes: Every preset period, sales data of IoT cards corresponding to at least one sales account are obtained, and feature data is extracted from the sales data; the feature data includes: the number of newly registered cards, the number of regions, the number of cards used by mobile devices, and the number of cards with non-directional access points (APNs); For each sales account, an evaluation index is calculated based on the feature data, and a predefined algorithm is used to process the evaluation index and the feature data to obtain an anomaly score. The evaluation index includes a first index, a second index, and a third index. The first index is the ratio of the number of regions to the number of newly registered SIM cards, the second index is the ratio of the number of SIM cards used by mobile devices to the number of newly registered SIM cards, and the third index is the ratio of the number of SIM cards with non-directed APNs to the number of newly registered SIM cards. Determine whether the feature data and the anomaly score meet preset conditions; If so, then the sales account is determined to be the sales account of the abnormal IoT card; The step of processing the evaluation indicators and feature data using a predefined algorithm to obtain anomaly scores includes: The number of newly registered cards, the number of cards used by mobile devices, and the number of cards with non-directed APNs are respectively subjected to extreme value normalization processing to obtain the fourth, fifth, and sixth indicators. The number of regions is normalized to obtain the seventh index; Obtain the business sales requirements corresponding to the sales account, and determine the proportional coefficients corresponding to the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator based on the business sales requirements; The proportion of each indicator is calculated based on the proportional coefficient, and the proportions are summed to obtain the anomaly score. The step of determining whether the feature data and the anomaly score meet preset conditions includes: Obtain a first preset threshold corresponding to each feature data and a second preset threshold corresponding to the abnormal score, and determine whether the feature data and the abnormal score meet preset conditions. The preset conditions are that each feature data is greater than the corresponding first preset threshold and the abnormal score is greater than the corresponding second preset threshold.

2. The method according to claim 1, characterized in that, The sales data includes the card number for real-name authentication, the real-name authentication time, the communication record information for the IoT card, the International Mobile Equipment Identity (IMEI) for the IoT card, and the APN name for the IoT card. Extracting feature data from the sales data includes: The number of newly registered cards is counted by counting the real-name authenticated card numbers. Based on the real-name authentication time corresponding to the real-name authentication, the region of real-name authentication is searched in the communication record information, and the number of regions of real-name authentication is counted. Based on the International Mobile Equipment Identity (IMEI), the device type is searched from a predefined device library, and based on the device type, the IoT card for use by the mobile device is determined, and the number of cards for use by the mobile device is counted. Based on the APN name, the APN type is searched from the predefined attribute library, and the IoT cards with non-directional APNs are determined based on the APN type. The number of cards with non-directional APNs is then counted.

3. The method according to claim 1, characterized in that, The first indicator is used to indicate that the newly added real-name cards are distributed in different regions for users to use; The second indicator is used to indicate that the proportion of newly registered cards used on mobile devices is higher than the first preset value; The third indicator is used to indicate that the proportion of newly added real-name cards accessing the public network is higher than the second preset value.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Obtain the account information corresponding to the sales account of the abnormal IoT card, generate an alarm based on the account information, and send the alarm to the terminal device corresponding to the operation and maintenance personnel for early warning, so that the operation and maintenance personnel can take security measures for the sales account.

5. An abnormal IoT card detection device, characterized in that, The device includes: The data collection and statistics module is used to acquire sales data of IoT cards corresponding to at least one sales account at preset intervals, and extract feature data from the sales data; the feature data includes: the number of newly registered cards, the number of regions, the number of cards used by mobile devices, and the number of cards with non-directional access points (APNs); The algorithm module is used to calculate evaluation indicators for each sales account based on the feature data, and to process the evaluation indicators and feature data using a predefined algorithm to obtain anomaly scores. The evaluation indicators include: a first indicator, a second indicator, and a third indicator; wherein, the first indicator is the ratio of the number of regions to the number of newly registered SIM cards, the second indicator is the ratio of the number of SIM cards used by mobile devices to the number of newly registered SIM cards, and the third indicator is the ratio of the number of SIM cards with non-directed APNs to the number of newly registered SIM cards. The filtering module is used to determine whether the feature data and the anomaly score meet preset conditions; The result output module is used to determine that the sales account is the sales account of the abnormal IoT card when the feature data and the abnormal score meet the preset conditions. The algorithm module includes a processing unit, which is used for: The number of newly registered cards, the number of cards used by mobile devices, and the number of cards with non-directed APNs are respectively subjected to extreme value normalization processing to obtain the fourth, fifth, and sixth indicators. The number of regions is normalized to obtain the seventh index; Obtain the business sales requirements corresponding to the sales account, and determine the proportional coefficients corresponding to the first indicator, the second indicator, the third indicator, the fourth indicator, the fifth indicator, the sixth indicator, and the seventh indicator based on the business sales requirements; The proportion of each indicator is calculated based on the proportional coefficient, and the proportions are summed to obtain the anomaly score. The filtering module is specifically used for: Obtain a first preset threshold corresponding to each feature data and a second preset threshold corresponding to the abnormal score, and determine whether the feature data and the abnormal score meet preset conditions. The preset conditions are that each feature data is greater than the corresponding first preset threshold and the abnormal score is greater than the corresponding second preset threshold.

6. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-4.

Images