Iot card risk identification method, system, device, medium and product

Abstract

The application discloses a kind of Internet of Things card risk identification method, system, equipment, medium and product, the use behavior data of Internet of Things card in setting time period is analyzed, the candidate Internet of Things card and its corresponding risk behavior that exist risk are obtained, the initial risk assessment of Internet of Things card is completed, then again from candidate Internet of Things card Screening out the target Internet of Things card that has been executed corresponding risk behavior dispatch check operation, extract the target feature vector of the use behavior data of target Internet of Things card, the target feature vector is input into the risk identification model corresponding to the risk behavior, to make risk identification detection model output risk identification result of risk behavior, complete the secondary risk assessment of Internet of Things card, through twice risk identification, can effectively improve the accuracy of Internet of Things card risk identification, reduce misjudgment risk, while being able to speed up the processing of real irregular behavior dispatch check.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to an Internet of Things card risk identification method, system, device, medium and product. BACKGROUND

[0002] The Internet of Things card is a special telephone card based on the Internet of Things special network, which provides voice, short message, traffic and other basic communication functions for the Internet of Things terminal, and realizes the communication connection between people, machines and things. With the gradual formation of the "big connection" industrial ecology, the scale development has also led to an increase in the illegal behavior of Internet of Things card users and an increase in the difficulty of control. How to efficiently control the illegal use of Internet of Things cards has become a key point in the current security control technology field. The existing technology usually periodically identifies abnormalities according to the behavior data of Internet of Things cards within a certain time range, for example, by day / week / month. For the periodic monitoring results of billions of Internet of Things cards, millions or tens of millions of abnormal card numbers trigger the early warning rules for each identification, and due to the complexity of Internet of Things application scenarios, a large number of single risk is caused by the misjudgment of normal use of card numbers, which leads to the continuous triggering of early warning rules for normal Internet of Things cards for single check, and a large amount of human resources is needed to handle the repeated invalid risk of misjudgment. On the other hand, it also leads to the fact that the real illegal behavior cannot be effectively highlighted and quickly processed after being checked. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide an Internet of Things card risk identification method, system, device, medium and product, which can effectively improve the accuracy of Internet of Things card risk identification, reduce the risk of misjudgment, and at the same time accelerate the processing of single check of real illegal behavior.

[0004] To achieve the above-mentioned purpose, the embodiments of the present application provide an Internet of Things card risk identification method, comprising:

[0005] Obtaining the use behavior data of at least two Internet of Things cards within a set time period;

[0006] Analyzing the use behavior data to obtain candidate Internet of Things cards with risks and corresponding risk behaviors of the candidate Internet of Things cards;

[0007] Filtering target Internet of Things cards that have performed corresponding risk behavior single check operations from the candidate Internet of Things cards;

[0008] Extracting a target feature vector of the use behavior data of the target Internet of Things card;

[0009] Inputting the target feature vector into a risk identification model corresponding to the risk behavior, so that the risk identification detection model outputs a risk identification result of the risk behavior.

[0010] As an improvement of the above scheme, after obtaining the risk identification result of the target Internet of Things card, the method further comprises:

[0011] For the target Internet of Things card with a risk identification result of illegal use, a single dispatch verification operation is performed;

[0012] For the target Internet of Things card with a risk identification result of normal use, the corresponding risk behavior is eliminated from the system, and the single dispatch verification operation does not need to be performed.

[0013] As an improvement of the above scheme, the method further comprises:

[0014] Filtering reference Internet of Things cards that have not performed the corresponding risk behavior single dispatch verification operation from the candidate Internet of Things cards, and performing single dispatch verification operation on the reference Internet of Things cards;

[0015] Summarizing the single dispatch verification results of the reference Internet of Things cards to generate reference risk verification records;

[0016] Extracting a sample feature vector from the reference risk verification records;

[0017] Generating a risk identification model using the sample feature vector; wherein different risk behaviors of different reference Internet of Things cards each correspond to a risk identification model.

[0018] As an improvement of the above scheme, the generating a risk identification model using the sample feature vector comprises:

[0019] Dividing the sample feature vectors corresponding to a plurality of reference Internet of Things cards to obtain a training set and a test set;

[0020] Establishing a risk identification model based on a random forest binary classifier using the training set;

[0021] Using the test set to predict the risk identification model and output a prediction result;

[0022] Comparing the prediction result with the actual result to optimize the model parameters of the risk identification model.

[0023] As an improvement of the above scheme, the establishing a risk identification model based on a random forest binary classifier using the training set comprises:

[0024] When constructing a node of a decision tree, randomly select a subset of attributes from the feature attributes in the training set by random selection variable method;

[0025] Selecting a feature attribute with the smallest branch Gini index in the attribute subset as a split point;

[0026] According to the split points, node splitting is performed to complete the construction of the decision tree, and a risk identification model is obtained.

[0027] As an improvement of the above scheme, the usage behavior data includes at least one of communication access data, usage location data, usage terminal data, and basic feature data.

[0028] As an improvement of the above scheme, the target feature vector of the usage behavior data of the target Internet of Things card includes:

[0029] The usage behavior data of the target Internet of Things card is processed by dimension reduction to obtain a plurality of target feature vectors.

[0030] To achieve the above object, the embodiment of the present application further provides an Internet of Things card risk identification system, comprising:

[0031] The native risk identification module is configured to obtain usage behavior data of at least two Internet of Things cards in a set time period, and analyze the usage behavior data to obtain candidate Internet of Things cards with risks and corresponding risk behaviors of the candidate Internet of Things cards;

[0032] The risk secondary classification module is configured to filter out a target Internet of Things card from the candidate Internet of Things cards, which has performed a corresponding risk behavior dispatching verification operation; extract a target feature vector of usage behavior data of the target Internet of Things card; and input the target feature vector into a risk identification model corresponding to the risk behavior, so that the risk identification model outputs a risk identification result of the risk behavior.

[0033] To achieve the above object, the embodiment of the present application further provides an Internet of Things card risk identification device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the Internet of Things card risk identification method according to any one of the above embodiments.

[0034] To achieve the above object, the embodiment of the present application further provides a computer readable storage medium, which comprises a stored computer program, wherein the computer program controls a device where the computer readable storage medium is located to execute the Internet of Things card risk identification method according to any one of the above embodiments when the computer program is running.

[0035] To achieve the above object, the embodiment of the present application further provides a computer program product, comprising a computer program, which is executed by a processor to implement the Internet of Things card risk identification method according to any one of the above embodiments.

[0036] Compared with the prior art, the Internet of Things card risk identification method, system, device, medium and product disclosed by the application analyze the use behavior data of the Internet of Things card in a set time period, obtain the candidate Internet of Things card with risk and the corresponding risk behavior, complete the initial risk assessment of the Internet of Things card, then filter out the target Internet of Things card which has performed the corresponding risk behavior dispatching and checking operation from the candidate Internet of Things card, extract the target feature vector of the use behavior data of the target Internet of Things card, input the target feature vector into the risk identification model corresponding to the risk behavior, so that the risk identification detection model outputs the risk identification result, and completes the secondary risk assessment of the Internet of Things card. Through twice risk identification, the accuracy of the risk identification of the Internet of Things card can be effectively improved, the misjudgment risk is reduced, and the dispatching and checking of the real violation behavior can be accelerated. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is a flowchart of an Internet of Things card risk identification method provided by an embodiment of the application;

[0038] Figure 2 is an analysis schematic diagram of a risk behavior provided by an embodiment of the application;

[0039] Figure 3 is another flowchart of an Internet of Things card risk identification method provided by an embodiment of the application;

[0040] Figure 4 is a training schematic diagram of a risk identification model provided by an embodiment of the application;

[0041] Figure 5 is a structural block diagram of an Internet of Things card risk identification system provided by an embodiment of the application;

[0042] Figure 6 is a structural block diagram of another Internet of Things card risk identification system provided by an embodiment of the application;

[0043] Figure 7 is a working flow schematic diagram of each module in the Internet of Things card risk identification system provided by an embodiment of the application;

[0044] Figure 8 is a structural block diagram of an Internet of Things card risk identification device provided by an embodiment of the application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the application.

[0046] Referring to Figure 1 , Figure 1 is a flowchart of a method for identifying risks of Internet of Things cards according to an embodiment of the present application. The method for identifying risks of Internet of Things cards comprises the following steps.

[0047] S1, obtaining usage behavior data of at least two Internet of Things cards in a set time period;

[0048] S2, analyzing the usage behavior data to obtain candidate Internet of Things cards with risks and corresponding risk behaviors of the candidate Internet of Things cards;

[0049] S3, screening target Internet of Things cards that have performed corresponding risk behavior dispatching and checking operations from the candidate Internet of Things cards;

[0050] S4, extracting a target feature vector of usage behavior data of the target Internet of Things cards;

[0051] S5, inputting the target feature vector into a risk identification model corresponding to the risk behavior, so that the risk identification detection model outputs a risk identification result of the risk behavior.

[0052] It is worth noting that the method for identifying risks of Internet of Things cards according to the embodiment of the present application can be implemented by an Internet of Things platform. The Internet of Things platform analyzes usage behavior data of Internet of Things cards to obtain candidate Internet of Things cards with risks and corresponding risk behaviors of the candidate Internet of Things cards, completes a primary risk assessment of the Internet of Things cards, and then screens target Internet of Things cards that have performed corresponding risk behavior dispatching and checking operations from the candidate Internet of Things cards. The target Internet of Things cards that have performed risk behavior dispatching and checking operations have been subjected to risk assessment for the risk behavior, and a corresponding risk identification model has been established in advance for the risk behavior of the target Internet of Things cards. Therefore, a target feature vector of usage behavior data of the target Internet of Things cards needs to be extracted, the target feature vector is inputted into a risk identification model corresponding to the risk behavior, so that the risk identification detection model outputs a risk identification result of the risk behavior, and a secondary risk assessment of the target Internet of Things cards is completed. The risk identification result includes two cases of normal use and illegal use. Through twice risk identification, the accuracy of risk identification of Internet of Things cards can be effectively improved, the risk of misjudgment can be reduced, and the processing of real illegal behavior dispatching and checking can be accelerated.

[0053] Specifically, in step S1, usage behavior data of at least two Internet of Things cards in a set time period is acquired; the usage behavior data includes at least one of communication access data, usage location data, usage terminal data and basic feature data; the communication access data includes online behavior data, short message log data and call record data; the basic feature data includes service subscription data and card basic data.

[0054] For example, the set time period can be a latest time period, such as 1 min, 30 min, 1 h, etc. from the current time of the Internet of Things platform. The usage behavior data can be collected by an operator network element system and a business system, and the specific acquisition method is not limited. For example, the usage behavior data can refer to Table 1. It should be noted that the usage behavior data in Table 1 is only an example, and in actual use, one or more indicators of each data type can be selected to represent the current data type, such as selecting "terminal type" to represent the usage terminal data, or selecting "IMEI (International Mobile Equipment Identity, International Mobile Equipment Identity) number", "terminal type", "terminal change frequency", "terminal use time length" and "terminal use traffic" to represent the usage terminal data.

[0055] Table 1: Example of usage behavior data

[0056]

[0057]

[0058] Specifically, in step S2, the usage behavior data is analyzed to obtain a candidate Internet of Things card with a risk and a corresponding risk behavior; the risk behavior includes business non-compliance risk and abnormal abuse risk.

[0059] For example, the business non-compliance risk includes three cases:

[0060] 1) Machine card separation: terminal change behavior occurs, and exceeds the bound terminal range;

[0061] 2) Cross-region use: location fixed scene occurs location movement, and exceeds the limited range;

[0062] 3) Exceeding the whitelist use: the access content exceeds the agreed whitelist range.

[0063] The abnormal abuse risk includes four cases:

[0064] 1) Abnormal terminal use: inserting a mobile phone terminal, Modem POOL equipment, and hotspot equipment use;

[0065] 2)Sensitive area roaming: roaming in fraud-prone areas, border areas;

[0066] 3)Blacklist access: human networking applications, pornographic applications, access to overseas addresses;

[0067] 4)Business usage mutation: traffic / sms / voice usage exceeds threshold or historical average.

[0068] For example, see Figure 2 , Figure 2 is a schematic diagram of risk behavior provided by an embodiment of the present application. In combination with typical misuse scenarios of Internet of Things cards, a threshold rule model or a machine learning algorithm is used to establish an original risk detection model for Internet of Things cards, including business non-compliance risk and abnormal misuse risk detection, etc. The original risk type identification result of the Internet of Things card is output, and the candidate Internet of Things card with risk and its corresponding risk behavior are obtained as the original risk set A, original risk set A = {a[a1], a[a2], b[a1]... n[a1, a2]}; wherein a, b, and n respectively represent different Internet of Things cards, a1 represents business non-compliance risk, a2 represents abnormal misuse risk, a[a1] represents that the Internet of Things card a has business non-compliance risk, a[a2] represents that the Internet of Things card a has abnormal misuse risk, and so on. The preliminary risk identification result of all Internet of Things cards is obtained. The specific risk type detection process can be derived from existing mature technical detection means in the industry field, and the present application does not make specific limitations.

[0069] Specifically, in step S3, the target Internet of Things card that has performed the corresponding risk behavior dispatching and checking operation is screened out from the candidate Internet of Things card.

[0070] For example, the original risk set A and the historical risk checking result data are obtained, it is judged whether each Internet of Things card in the original risk set A and its corresponding risk behavior has performed the dispatching and checking operation, and the original risk set C of the target Internet of Things card that has performed the corresponding risk behavior dispatching operation is screened out from the original risk set A. For example, for the Internet of Things card a, it is detected in step S2 that there is a risk behavior a1, then it is queried in the historical risk checking result data whether there is a dispatching and checking operation of the Internet of Things card a + risk behavior a1, if yes, it indicates that the risk assessment has been performed for the risk behavior a1 of the Internet of Things card a, and the corresponding risk identification model is previously established for the risk behavior a1 of this target Internet of Things card a, and a[a1] is written into the original risk set C; if no, it indicates that the risk behavior a1 of the Internet of Things card a is detected for the first time, and a[a1] does not need to be written into the original risk set C, and the risk identification model for the Internet of Things card a + risk behavior a1 needs to be subsequently constructed.

[0071] Specifically, in step S4, a target feature vector of the use behavior data of the target Internet of Things card in the original risk set C is extracted; wherein the target feature vector includes at least one of a communication access feature vector, a use location feature vector, a use terminal feature vector, and a basic feature vector.

[0072] For example, if all use behavior data of the Internet of Things card is directly combined as an input of the risk identification model, it will cause a too large model calculation amount, and a long time is needed to wait for a detection result. Therefore, in the training phase of the model, several kinds of data are pre-selected from all use behavior data as a feature vector, and after the use behavior data is obtained in real time, the target feature vector is extracted from the use behavior data obtained in real time according to the feature vector used in the training, and a value example of the target feature vector extracted is shown in Table 2. It should be noted that the specific value can be set by the data actually obtained, and is not limited here.

[0073] Table 2: Value example of target feature vector

[0074]

[0075]

[0076] Specifically, in step S5, the target feature vector is input into the risk identification model corresponding to the risk behavior, so that the risk identification model outputs a risk identification result of the risk behavior.

[0077] For example, the original risk set C is obtained, and the target feature vector of all target Internet of Things cards in the original risk set C is input into the corresponding risk identification model. In the embodiment of the present application, for each risk behavior of each target Internet of Things card, a corresponding risk identification model is pre-trained, and the risk identification model is trained after the risk behavior of the target Internet of Things card is first identified, that is, for a target Internet of Things card, there are t risk behaviors that have been checked by the order (i.e. not the first time), and t risk identification models are pre-trained. Since each target Internet of Things card has a corresponding risk identification model pre-established, when analyzing the target Internet of Things card, the corresponding risk identification model can be quickly indexed according to the card number and the risk behavior of the target Internet of Things card, and then the target feature vector corresponding to the target Internet of Things card is input into the risk identification model for secondary risk assessment, to obtain the risk identification result of the target Internet of Things card. If the label is 0, the risk behavior is normal use; if the label is 1, the risk behavior is illegal use.

[0078] Exemplarily, assuming that the risk behavior a1 of the target IoT card a corresponds to the risk identification model b1, the risk behavior a2 of the target IoT card a corresponds to the risk identification model b2, and the risk behavior a1 of the target IoT card b corresponds to the risk identification model b3, the output results of the three models are exemplified in Table 3.

[0079] Table 3: Output results of risk identification models

[0080]

[0081]

[0082] In the embodiment of the present application, the accuracy of the risk identification of the IoT card can be effectively improved by twice risk identification, the risk of misjudgment can be reduced, and the handling of the real irregular behavior can be accelerated. In addition, since a risk identification model corresponding to each target IoT card is set for each target IoT card, the risk identification model is only used to analyze the target feature vector of the current target IoT card, and a large amount of data does not need to be analyzed, so the identification result can be quickly output, and the risk identification efficiency of the IoT card can be improved.

[0083] Specifically, after obtaining the risk identification result of the target IoT card by executing step S5, the method further comprises:

[0084] S6, for the target IoT card with the risk identification result of irregular use, performing a dispatching inspection operation;

[0085] S7, for the target IoT card with the risk identification result of normal use, eliminating the corresponding risk behavior from the system, and the dispatching inspection operation does not need to be performed.

[0086] Exemplarily, referring to Figure 3 , Figure 3 is another flowchart of the IoT card risk identification method provided by the embodiment of the present application. For the target IoT card determined as irregular use by the risk identification model, a target risk dispatching record G is generated, and a dispatching inspection is performed according to the target risk dispatching record G. For the target IoT card determined as normal use by the risk identification model, it is indicated that the preliminary risk identification result of step 2 is incorrect, and the secondary risk identification result output by the risk identification model in step S5 is used as the criterion. The corresponding risk behavior is eliminated from the system, and the dispatching inspection operation does not need to be performed.

[0087] Exemplarily, the target risk assignment record takes the Internet of Things card number, risk type, and risk time as the unique identifier, and aggregates the risk-related communication behavior information to form a target risk assignment record. The fields in the target risk assignment record include, but are not limited to, the card number, risk type, risk time, use IMEI, attached base station, access URL address, call record usage, subscription package, and the like. For example, refer to Table 4.

[0088] Table 4: Example of target risk assignment record field

[0089]

[0090]

[0091] Exemplarily, after obtaining the target risk assignment record G, a hierarchical flow transfer assignment mechanism of the province, city, district, and customer manager is established according to the opening card channel information of the risk card number, and is distributed to the most fine-grained management unit account for manual review and disposal by the corresponding customer manager. The customer manager checks the target risk assignment record G to be checked, and according to the customer channel information and risk behavior information of the target risk assignment record G, audits the actual use scene of the customer offline, checks whether the Internet of Things card exists illegal use or non-contractual scene use, and according to the risk degree, performs disposal and control operations on the card number, including canceling the account, stopping the machine, closing the voice function, closing the SMS function, closing the flow function, and adding the customer to the blacklist. After the customer manager completes the check, the check result information of the target risk assignment record G is input, including normal use and illegal use. Thus, the last manual check record is completed.

[0092] Further, referring to Figure 4 , Figure 4 is a training schematic diagram of the risk identification model provided by the embodiment of the present application. The embodiment of the present application further provides a training method of the risk identification model. The method further includes:

[0093] S8, filtering a reference Internet of Things card that has not performed the corresponding risk behavior assignment check operation from the candidate Internet of Things cards, and performing an assignment check operation on the reference Internet of Things card;

[0094] S9, aggregating the assignment check result of the reference Internet of Things card to generate a reference risk check record;

[0095] S10, extracting a sample feature vector from the reference risk check record;

[0096] S11, generating a risk identification model by using the sample feature vector. Different risk behavior of different reference Internet of Things cards corresponds to a risk identification model.

[0097] Specifically, in step S8, the reference IoT cards that do not perform the risk behavior dispatching and checking operation are filtered out from the candidate IoT cards, and the original risk set B is obtained in combination with the risk behaviors of the reference IoT cards. It can be understood that the original risk set A = B + C. For all reference IoT cards in the original risk set B, a reference risk dispatching record D is generated, the field information of the reference risk dispatching record D is the same as that of the target risk dispatching record G, and the data recorded in Table 4 can be referred to, and the detailed process of the dispatching and checking operation can also be referred to the above process, and will not be repeated here.

[0098] Specifically, in step S9, the dispatching and checking results of the reference IoT cards are summarized to generate a reference risk checking record, which records the reference risk dispatching record and the checking result (normal use or illegal use). The field information of the specific reference risk checking record can be referred to Table 5.

[0099] Table 5: Reference risk checking record field example

[0100]

[0101]

[0102] Specifically, in step S10, the sample feature vector is extracted from the reference risk checking record, including: performing dimension reduction processing on the use behavior data in the reference risk checking record to obtain a plurality of sample feature vectors.

[0103] For example, taking each reference checking result record as a sample source, the use behavior data of the risk occurrence time of the reference IoT card is obtained, the feature behavior index set is extracted through feature engineering dimension reduction, the machine learning classification detection algorithm is established, and the original risk is secondarily divided. The specific description example is as follows:

[0104] 1) Taking the reference risk checking record (the real artificial checking record) as the sample data set, the full amount of use behavior data of the card number corresponding to the risk time is obtained, which is used to represent the running state of the reference IoT card when the risk behavior occurs, and covers all traffic, short message, voice use data related to the communication of the reference IoT card, including communication access data, use location data, use terminal data, basic feature data, etc., which can comprehensively depict the behavior trend of the reference IoT card in the risk time. It should be noted that the specific use behavior data example can be referred to Table 1, and will not be repeated here.

[0105] 2) Since the number of reference Internet of Things cards triggering the risk check every day reaches millions, if all the use behavior data of the reference Internet of Things cards are directly combined as the input of the risk identification model, it will cause the model calculation to be too large and the training model process to consume a lot of time. In order to reduce the feature dimension of the sample and speed up the training model, the application reduces the dimension of the behavior data through feature engineering, selects the indicators with the influence factor greater than the influence threshold as the feature parameters, and finally forms 18 kinds of sample feature vectors, which can extract effective information and reduce the dimension of the sample set. It is worth noting that the specific examples of the 18 kinds of sample feature vectors can refer to Table 2, which will not be repeated here.

[0106] Specifically, in step S11, the risk identification model is generated by using the sample feature vector, comprising:

[0107] S111, divide the sample feature vectors corresponding to a plurality of reference Internet of Things cards to obtain a training set and the test set;

[0108] S112, using the training set to establish a risk identification model based on a random forest binary classifier;

[0109] S113, using the test set to predict the risk identification model, and outputting a prediction result;

[0110] S114, comparing the prediction result with an actual result to optimize the model parameters of the risk identification model.

[0111] Specifically, in step S111, 18 kinds of sample feature vectors of corresponding time behaviors are calculated for S reference risk check records respectively, which are combined to form 18-dimensional feature vectors for representing samples, denoted as xi, and S vectors are generated. The i-th feature vector satisfies:

[0112]

[0113] Exemplarily, a feature matrix T with a dimension of Sx18 is obtained after extraction, the samples checked as irregular use are set as result coding "1", representing irregular use, and the samples checked as normal use are set as result coding "0", representing normal use, and finally a sample matrix T of Sx18 is obtained as a sample data set, and the sample matrix T satisfies the following formula:

[0114]

[0115] Wherein, yi represents the i-th reference risk check record.

[0116] Specifically, the risk secondary identification classification can be converted into a binary classification problem of machine learning, the application selects a random forest algorithm as an example to establish a risk identification model based on a random forest binary classifier. The sample data set is randomly divided into 75% training set and 25% test set, and model training and testing are respectively performed.

[0117] Further, using 75% of the original training set as the original sample set, a training sample set is constructed based on the Bagging idea, that is, the sample data set is sampled with replacement for Nr times, a new training set containing Nr samples can be obtained, and through repeated K times, KxNr training sample sets can be obtained.

[0118] Specifically, in step S112, the risk identification model based on the random forest binary classifier is established by using the training set, including: when constructing a node of a decision tree, an attribute subset is constructed by randomly selecting a variable method from feature attributes in the training set; selecting a feature attribute with the minimum branch Gini index in the attribute subset as a split point; and performing node splitting according to the split point to complete the construction of the decision tree, thereby obtaining the risk identification model.

[0119] Specifically, when constructing a node of a decision tree, an attribute subset is constructed by randomly selecting a variable method from 18 feature attributes, and then node splitting is performed. The attribute subset contains L sub , L sub ≥log2L f , L f is the total number of feature attributes, that is, the number of selected features when node splitting is not less than log218, and at least 4 feature attributes are required to construct the attribute subset.

[0120] Specifically, the CART (Classification And Regression Tree) algorithm is used to select the Gini impurity as the evaluation standard, the Gini index of the training sample set is calculated, and the feature with the minimum branch Gini index is selected as the split point. In the attribute set, the Gini index Gii of the mth branch node satisfies the following formula:

[0121]

[0122] Wherein, Λ is the training sample set; Λ m is the proportion of the mth class sample; M is the total number of categories, and η represents the attribute.

[0123] Specifically, in step S113, the test of the correlation index is performed based on the test set, each decision tree predicts the sample in the test set, and the majority voting method is used to select the prediction result, that is, when a prediction label obtains more than half of the decision tree votes, the final prediction is the prediction label, otherwise the prediction label is rejected, and the final output Hpre(X) formula is:

[0124]

[0125] Wherein, θj is the label category; j is the number of categories; y is the number of categories; k is the kth decision tree; is the decision result of the decision tree.

[0126] Specifically, in step S114, in the iteration process of the risk identification model, the accuracy of model diagnosis is calculated by comparing the category prediction value and the actual value of each sample in the random forest, and the highest confidence and accuracy indicators of the risk identification model are obtained through model parameter optimization. The optimal parameters of the risk identification model in the embodiment of the present application can be referred to Table 6, and the model accuracy is 99.40%.

[0127] Table 6: Optimal parameter example of risk identification model

[0128] Model parameters Parameter name Explanation maxDepth Maximum depth of the tree

[15] maxBins Maximum number of bins for discretizing continuous features

[100] minInstancesPerNode Minimum number of instances each child must have after split [1] minInfoGain Minimum information gain to consider a split at a tree node [0.0] impurity entropy, Gini information gain algorithm ['entropy'] numTrees Number of trees to train

[30]

[0129] Exemplarily, after the risk identification model is trained and optimized, the risk identification model is packaged and stored as an interface file for subsequent real-time risk classification. In actual risk identification, the target feature vector of the target Internet of Things card to be classified is input into the trained risk identification model, and the label of the diagnosis vector is determined through the model decision to realize the secondary classification of the risk. If the label obtained is 0, the risk behavior is normal use; if the label obtained is 1, the risk behavior is illegal use.

[0130] Compared with the prior art, the Internet of Things card risk identification method disclosed by the present application embeds risk checking result information to establish a self-learning risk classification detection means in the risk monitoring and control link of the daily use stage of the Internet of Things card, can effectively eliminate the risk data of the historical check belonging to the normal use scene, accurately identify the risk data of the real illegal use, realize the risk accurate early warning and control, solve the problem of low control efficiency caused by the large amount of repeated identification and dispatch of the risk data of the historical check in the risk dispatch link, and effectively focus on the real illegal risk problem. In addition, the present application does not need terminal device adaptation and modification, and can be realized only by obtaining the use behavior data and historical risk checking result data of the Internet of Things card, and is suitable for the risk identification, checking and disposal system of the general safety management process of the Internet of Things card, and has great advantages in cost reduction and efficiency improvement.

[0131] Referring toFigure 5 , Figure 5 is a structural block diagram of an Internet of Things card risk identification system 100 provided by an embodiment of the application, the Internet of Things card risk identification system 100 comprising:

[0132] a native risk identification module 11, configured to acquire usage behavior data of at least two Internet of Things cards in a set time period, and analyze the usage behavior data to obtain candidate Internet of Things cards with risks and corresponding risk behaviors of the candidate Internet of Things cards;

[0133] a risk secondary classification module 12, configured to filter out target Internet of Things cards that have performed a corresponding risk behavior dispatching and checking operation from the candidate Internet of Things cards, extract a target feature vector of usage behavior data of the target Internet of Things cards, and input the target feature vector into a risk identification model corresponding to the risk behavior, so that the risk identification detection model outputs a risk identification result of the risk behavior.

[0134] Further, referring to Figure 6 , Figure 6 is a structural block diagram of another Internet of Things card risk identification system 100 provided by an embodiment of the application, the Internet of Things card risk identification system 100 comprising a risk detection system and a risk dispatching and checking system, the risk detection system comprising the native risk identification module 11, the risk secondary classification module and a checking result self-learning module 13, and the risk dispatching and checking system comprising a risk dispatching module 15 and a visual interactive module 16. Among them,

[0135] the checking result self-learning module 13, configured to establish a risk identification model of a risk behavior of an Internet of Things card;

[0136] a system interactive interface 14, configured to perform data interaction between the risk detection system and the risk dispatching and checking system, and transmit Internet of Things card risk data, risk checking result data and the like,

[0137] the risk dispatching module 15, configured to dispatch risk dispatching records to staff in a hierarchical manner according to a channel attribution of an Internet of Things card;

[0138] the visual interactive module 16, configured to provide an interactive interface to the staff, so that the staff can query and process risk data of the Internet of Things card, and input risk checking result information.

[0139] Specifically, after obtaining the risk identification result of the target Internet of Things card, for the target Internet of Things card with a risk identification result of irregular use, the risk dispatching module 15 performs a dispatching and checking operation; and for the target Internet of Things card with a risk identification result of normal use, the native risk identification module 11 eliminates the corresponding risk behavior from the system, and the risk dispatching module 15 does not need to perform the dispatching and checking operation.

[0140] Specifically, the risk assignment module 15 is further configured to filter reference IoT cards that do not perform corresponding risk behavior assignment verification operations from the candidate IoT cards, and perform assignment verification operations on the reference IoT cards; aggregate the assignment verification results of the reference IoT cards to generate reference risk verification records; the verification result self-learning module 13 is configured to extract sample feature vectors from the reference risk verification records; generate a risk identification model using the sample feature vectors; wherein different risk behaviors of different reference IoT cards correspond to a risk identification model.

[0141] Specifically, the verification result self-learning module 13 includes:

[0142] a sample division unit configured to divide sample feature vectors corresponding to a plurality of reference IoT cards to obtain a training set and the test set;

[0143] a risk identification model establishment unit configured to establish a risk identification model based on a random forest binary classifier using the training set;

[0144] a prediction unit configured to predict the risk identification model using the test set and output a prediction result;

[0145] a model optimization unit configured to compare the prediction result with an actual result to optimize model parameters of the risk identification model.

[0146] Specifically, the risk identification model establishment unit is configured to: when constructing a node of a decision tree, randomly extract a feature attribute subset from feature attributes in the training set by random selection variable method; select a feature attribute with the smallest branch Gini index in the feature attribute subset as a split point; and perform node splitting according to the split point to complete the construction of the decision tree and obtain a risk identification model.

[0147] Specifically, the usage behavior data includes at least one of communication access data, usage location data, usage terminal data, and basic feature data.

[0148] Specifically, the extracting sample feature vectors from the reference risk verification records includes: performing dimension reduction processing on usage behavior data in the reference risk verification records to obtain a plurality of sample feature vectors.

[0149] Referring to Figure 7 , Figure 7is a working process schematic diagram of each module in the Internet of Things card risk identification system 100 provided by the embodiment of the application, steps 1.1-1.13 are a process for constructing a corresponding risk identification model when the risk behavior a1 of the Internet of Things card a is detected for the first time, and steps 2.1-2.4 are a risk identification process when the risk behavior a1 of the Internet of Things card a occurs again.

[0150] For example, in steps 1.1-1.13, the native risk identification module 11 obtains the use behavior data of the Internet of Things card a in a set time period, detects that the risk behavior a1 of the Internet of Things card a occurs, and transmits this detection result to the risk secondary classification module 12. The risk secondary classification module 12 detects that the risk behavior a1 occurs for the first time (there is no risk identification model corresponding to the current Internet of Things card + risk behavior a1), indicating that the risk behavior a1 needs to be checked by dispatching, sends a dispatching checking instruction to the system interaction interface 14, so that the system interaction interface 14 sends the dispatching checking instruction of the risk behavior a1 to the risk dispatching module 15, the risk dispatching module performs risk grading and dispatching processing, and a customer manager performs manual auditing and disposal. The customer manager views the risk record to be checked of the risk behavior a1 on the visual interaction module 16, checks whether there is irregular use offline, inputs the risk checking result information of the risk dispatching record, including normal use and irregular use, on the visual interaction module 16 after completing the checking, the visual interaction module 16 feeds back the checking result of the risk behavior a1 to the risk dispatching module 15, the risk dispatching module 15 sends the checking result of the risk behavior a1 to the checking result self-learning module 13 through the system interaction interface 14, takes the checking result information of the risk behavior a1 as input data of the risk identification model, the checking result self-learning module 13 extracts a sample feature vector from the checking result information, and establishes a risk identification model of the risk behavior a1 of the Internet of Things card a based on a random forest algorithm.

[0151] For example, in steps 2.1-2.4, when the native risk identification module 11 detects that the risk behavior a1 of the Internet of Things card a occurs, the detection result is transmitted to the risk secondary classification module 12. The risk secondary classification module 12 detects that the risk behavior a1 does not occur for the first time (there is a risk identification model corresponding to the current Internet of Things card + risk behavior a1), extracts the use behavior data of the Internet of Things card a, the risk secondary classification module 12 further extracts a target feature vector from the use behavior data, inputs the target feature vector into the risk identification model corresponding to the current Internet of Things card a + risk behavior a1, so that the risk identification model outputs an identification result, such as a normal use of the risk behavior a1, and the risk behavior a1 of the Internet of Things card a is eliminated from the system without manual checking again.

[0152] It is worth mentioning that the working process of each module in the Internet of Things card risk identification system 100 described in the embodiments of the present application can refer to the working process of the Internet of Things card risk identification method described in the above embodiments, which will not be repeated here.

[0153] Referring to Figure 8 , Figure 8 is a structural block diagram of an Internet of Things card risk identification device 200 provided by the embodiments of the present application, the Internet of Things card risk identification device 200 includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. The processor 21 implements the steps in each of the above Internet of Things card risk identification method embodiments when executing the computer program, such as steps S1-S5.

[0154] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present application. The one or more modules / units can be a series of computer program instruction segments that can complete a specific function, which are used to describe the execution process of the computer program in the Internet of Things card risk identification device 200.

[0155] The Internet of Things card risk identification device 200 can include, but is not limited to, a processor 21, a memory 22. Those skilled in the art can understand that the schematic diagram is only an example of the Internet of Things card risk identification device 200, and does not constitute a limitation on the Internet of Things card risk identification device 200, and can include more or fewer components than the diagram, or combine certain components, or different components, for example, the Internet of Things card risk identification device 200 can also include an input / output device, a network access device, a bus, etc.

[0156] The processor 21 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, etc. The general-purpose processor can be a microprocessor or can also be any conventional processor. The processor 21 is a control center of the Internet of Things card risk identification device 200, and is connected with various parts of the Internet of Things card risk identification device 200 through various interfaces and lines.

[0157] The memory 22 can be used to store computer programs and / or modules. The processor 21 realizes various functions of the Internet of Things card risk identification device 200 by running or executing computer programs and / or modules stored in the memory 22, and calling data stored in the memory 22. The memory 22 can mainly include a program storage area and a data storage area. The program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), etc. The data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 22 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0158] The modules / units of the Internet of Things card risk identification device 200 are stored in a computer readable storage medium if they are realized in the form of software function units and sold or used as independent products. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware. The computer program can be stored in a computer readable storage medium. When the computer program is executed by the processor 21, the steps of the above-mentioned various method embodiments can be realized. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium, etc.

[0159] The above is the preferred embodiment of the present application. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which are also considered within the scope of protection of the present application.

Claims

1. A method for identifying risks associated with Internet of Things (IoT) cards, characterized in that, The method comprises the following steps: obtaining usage behavior data of at least two Internet of Things cards within a set time period; analyzing the usage behavior data to obtain candidate Internet of Things cards with risk behaviors and corresponding risk behaviors; selecting target Internet of Things cards from the candidate Internet of Things cards that have performed corresponding risk behavior dispatch verification operations; extracting a target feature vector of the usage behavior data of the target Internet of Things cards; inputting the target feature vector into a risk identification model corresponding to the risk behavior, so that the risk identification model outputs a risk identification result of the risk behavior.

2. The IoT card risk identification method of claim 1, wherein, After obtaining the risk identification result of the target Internet of Things card, the method further comprises: for the target Internet of Things card with a risk identification result of illegal use, performing a dispatch verification operation; for the target Internet of Things card with a risk identification result of normal use, eliminating the corresponding risk behavior from the system and not performing the dispatch verification operation.

3. The IoT card risk identification method of claim 1, wherein, The method further comprises: selecting reference Internet of Things cards from the candidate Internet of Things cards that have not performed corresponding risk behavior dispatch verification operations, and performing dispatch verification operations on the reference Internet of Things cards; summarizing the dispatch verification results of the reference Internet of Things cards to generate reference risk verification records; extracting a sample feature vector from the reference risk verification records; generating a risk identification model using the sample feature vector; wherein different risk behaviors of different reference Internet of Things cards correspond to a risk identification model.

4. The IoT card risk identification method of claim 3, wherein, The method of generating a risk identification model using the sample feature vector comprises: dividing the sample feature vectors corresponding to a plurality of reference Internet of Things cards to obtain a training set and a test set; establishing a risk identification model based on a random forest binary classifier using the training set; using the test set to predict the risk identification model and output a prediction result; comparing the prediction result with the actual result to optimize the model parameters of the risk identification model.

5. The IoT card risk identification method of claim 4, wherein, The method of establishing a risk identification model based on a random forest binary classifier using the training set comprises: when constructing a decision tree node, randomly select a feature attribute from the feature attributes in the training set by random selection variable method to form an attribute subset; selecting a feature attribute with the smallest branch Gini index in the attribute subset as a split point; performing node splitting according to the split point to complete the construction of the decision tree and obtain a risk identification model.

6. The IoT card risk identification method of claim 1, wherein, The usage behavior data comprises at least one of communication access data, usage location data, usage terminal data, and basic feature data.

7. The IoT card risk identification method of claim 3, wherein, The method of extracting a sample feature vector from the reference risk verification records comprises: performing dimension reduction processing on the usage behavior data in the reference risk verification records to obtain a plurality of sample feature vectors.

8. An Internet of Things card risk identification system, characterized in that, The method comprises the following steps: a native risk identification module is configured to obtain usage behavior data of at least two Internet of Things cards within a set time period, and analyze the usage behavior data to obtain candidate Internet of Things cards with risk behaviors and corresponding risk behaviors; A risk secondary classification module is configured to filter out a target IoT card that has performed a corresponding risk behavior order checking operation from the candidate IoT cards, extract a target feature vector of usage behavior data of the target IoT card, and input the target feature vector into a risk identification model corresponding to the risk behavior, so that the risk identification model outputs a risk identification result of the risk behavior. 9.A risk identification device for an Internet of Things card, characterized in that, A computer readable storage medium includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the IoT card risk identification method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium includes a stored computer program, wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the IoT card risk identification method according to any one of claims 1 to 7 when the computer program runs.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the IoT card risk identification method according to any one of claims 1 to 7.

Images