Internet of Things (IoT) SIM card traffic detection methods and related equipment

Abstract

This disclosure provides a method and related equipment for traffic detection of IoT cards, relating to the emerging field of information technology. The method includes: acquiring traffic data to be detected from the IoT card, wherein the traffic data to be detected is multi-dimensional traffic data with temporal sequence characteristics; inputting the traffic data to be detected into a convolutional neural network for processing to obtain spatial relationship features; inputting the spatial relationship features into a gated recurrent unit for processing to obtain temporal features; inputting the temporal features into an attention layer for processing to obtain an attention value vector; and inputting the attention value vector into a fully connected layer to obtain a predicted probability value corresponding to the traffic data to be detected. The predicted probability value is used to determine the state of the traffic data to be detected. By acquiring multi-dimensional traffic data under complex conditions and combining convolutional neural networks, gated recurrent units, attention layers, and fully connected layers, the accuracy of judging unauthorized use behavior under complex conditions is improved.

Description

Technical Field

[0001] This disclosure relates to the field of emerging information technology, and in particular to a method and related equipment for detecting the traffic of an Internet of Things (IoT) card. Background Technology

[0002] IoT cards are user identification cards launched by operators. Based on cellular mobile communication networks, they enable communication connections between people, machines, and things. They are mainly used in various industries such as vehicle networking, smart wearables, smart security, and smart water and electricity meters.

[0003] In related technologies, abnormal behavior identification of IoT cards is achieved through traffic detection, including the following methods: based on device usage, based on traffic usage, and based on accessed sites. However, with the increasing power of IoT devices and the more diverse purposes and uses of internet access by users, existing detection methods are insufficient to handle unauthorized usage in complex situations.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides a method and related equipment for detecting the traffic of an Internet of Things (IoT) card, which at least to some extent overcomes the inability of related technologies to cope with unauthorized use under complex circumstances.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] In a first aspect, embodiments of this disclosure provide a method for detecting traffic flow of an Internet of Things (IoT) card, the method comprising:

[0008] Acquire the traffic data to be detected from the IoT SIM card; the traffic data to be detected is multi-dimensional traffic data with time sequence characteristics;

[0009] The traffic data to be detected is input into a convolutional neural network for processing to obtain spatial connection features;

[0010] Spatial relationship features are input into a gated loop unit for processing to obtain temporal features;

[0011] Temporal features are input into the attention layer for processing to obtain an attention value vector.

[0012] The attention value vector is input into the fully connected layer to obtain the predicted probability value corresponding to the traffic data to be detected. The predicted probability value is used to determine the state of the traffic data to be detected.

[0013] In one possible embodiment, acquiring the traffic data to be detected from the IoT card includes:

[0014] Obtain the original service logs of the IoT card by observing its request behavior.

[0015] The original service logs are cleaned, and the cleaned data is stored in tuples to obtain behavioral data.

[0016] The behavioral data is aggregated and statistically processed according to a preset time window to obtain business characteristic data.

[0017] Preprocess the business characteristic data to obtain preprocessed traffic;

[0018] The preprocessed traffic is sorted according to time series to obtain the traffic data to be detected.

[0019] In one possible embodiment, the business characteristic data is preprocessed to obtain preprocessed traffic, including:

[0020] The field values ​​of the business feature data are checked, and missing values ​​are processed using the forward imputation method to obtain the first data;

[0021] Outliers in the first dataset are identified using the standard deviation method, and the data is then replaced with the median to obtain the second dataset.

[0022] The second data is normalized using the max-min method to obtain the preprocessed flow.

[0023] In one possible embodiment, the traffic data to be detected includes at least: time sequence number, total traffic, total number of characters in SMS messages, total call duration, number of SMS messages sent, number of SMS messages received, number of outgoing calls, and number of incoming calls.

[0024] In one possible embodiment, the convolutional neural network includes convolutional layers and pooling layers;

[0025] The traffic data to be detected is input into a convolutional neural network for processing to obtain spatial connection features, including:

[0026] The traffic data to be detected is input into a convolutional layer with m kernels for one-dimensional convolution processing to obtain m first feature maps;

[0027] m feature maps are input into a pooling layer for average pooling to obtain m second feature maps;

[0028] Expand and reduce the dimensionality of the m second feature maps to obtain spatial relationship features; spatial relationship features are those that have temporal sequence and preserve the spatial relationships of multidimensional traffic data in the traffic data to be detected.

[0029] In one possible embodiment, temporal features are input into an attention layer for processing to obtain an attention value vector, including:

[0030] Based on temporal features, network weights in the attention layer, and biases in the attention layer, the correlation score between input and output features in the attention layer is determined.

[0031] The relevance scores are normalized to obtain the attention score.

[0032] Based on the quantity and temporal characteristics of attention, an attention value vector is obtained; the attention value vector is used to characterize the impact of user characteristic states at different times on current traffic usage.

[0033] In one possible embodiment, the method further includes:

[0034] The status of the traffic data to be detected is determined based on the predicted probability value;

[0035] If the traffic data to be detected is determined to be in the first state, then the IoT card will be blocked;

[0036] If the traffic data to be detected is determined to be in the second state, the IoT card will be manually reviewed.

[0037] In one possible embodiment, the method further includes:

[0038] Determine whether the predicted probability value is greater than or equal to a pre-set first threshold;

[0039] If so, then the traffic data to be detected is determined to be in the first state;

[0040] If not, determine whether the predicted probability value is greater than or equal to the pre-set second threshold;

[0041] If so, then the traffic data to be detected is determined to be in the second state.

[0042] In one possible embodiment, the method further includes:

[0043] Obtain the traffic data to be detected that is in the second state and has been confirmed as the first state after manual review;

[0044] The training dataset is updated to train the convolutional neural network, gated recurrent units, attention layers, and fully connected layers.

[0045] In one possible embodiment, the traffic detection model includes: a convolutional neural network, a gated recurrent unit, an attention layer, and a fully connected layer;

[0046] The training process for the traffic detection model includes:

[0047] Obtain the training dataset; the training dataset is a collection of traffic data from IoT cards;

[0048] The network parameters of the convolutional neural network, gated recurrent unit, attention layer and fully connected layer in the traffic detection model to be trained are initialized to obtain the initialized traffic detection model;

[0049] Based on the training dataset, the initialized traffic detection model is iteratively trained. One iteration of the training process includes:

[0050] Training samples are extracted from the training dataset and input into the initialized traffic detection model to determine the probability value of abnormal traffic of the IoT card;

[0051] The loss function value is determined based on the traffic anomaly probability value and the true value of the traffic anomaly probability corresponding to the training sample;

[0052] Based on the loss function value, adjust the network parameters of the traffic detection model until the loss function value meets a preset threshold, or the number of iterations reaches a preset number of training iterations, to obtain the trained traffic detection model; wherein, the network parameters when the loss function value meets the preset threshold, or the number of iterations reaches the preset number of training iterations, are used as the network parameters of the trained traffic detection model.

[0053] Secondly, embodiments of this disclosure provide a data traffic detection device for an Internet of Things (IoT) card, comprising:

[0054] The acquisition unit is used to acquire the traffic data to be detected from the IoT card; the traffic data to be detected is multi-dimensional traffic data with time sequence.

[0055] Convolutional units are used to input the traffic data to be detected into a convolutional neural network for processing to obtain spatial connection features.

[0056] The gated loop unit is used to input spatial relationship features into the gated loop unit for processing to obtain temporal features;

[0057] The attention unit is used to input temporal features into the attention layer for processing, and obtain the attention value vector.

[0058] The prediction unit is used to input the attention value vector into the fully connected layer to obtain the prediction probability value corresponding to the traffic data to be detected. The prediction probability value is used to determine whether the traffic data to be detected is abnormal.

[0059] Thirdly, embodiments of this disclosure provide a traffic detection system for an Internet of Things (IoT) card, comprising:

[0060] The acquisition module is used to acquire the traffic data to be detected from the IoT card; the traffic data to be detected is multi-dimensional traffic data with time sequence.

[0061] The traffic identification and prediction module is used to input the traffic data to be detected into a convolutional neural network for processing to obtain spatial connection features; input the spatial connection features into a gated recurrent unit for processing to obtain temporal features; input the temporal features into an attention layer for processing to obtain an attention value vector; input the attention value vector into a fully connected layer to obtain the prediction probability value corresponding to the traffic data to be detected, which is used to determine whether the traffic data to be detected is abnormal.

[0062] Fourthly, embodiments of this disclosure provide an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the method of the first aspect described above by executing the executable instructions.

[0063] Fifthly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect above.

[0064] Sixthly, according to another aspect of this disclosure, a computer program product or computer program is also provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform any of the methods described above.

[0065] This disclosure provides a method and related equipment for detecting traffic flow of an IoT SIM card. The method includes: acquiring traffic flow data to be detected from the IoT SIM card; the traffic flow data to be detected is multi-dimensional traffic flow data with temporal sequence characteristics; inputting the traffic flow data to be detected into a convolutional neural network for processing to obtain spatial relationship features; inputting the spatial relationship features into a gated recurrent unit for processing to obtain temporal features; inputting the temporal features into an attention layer for processing to obtain an attention value vector; and inputting the attention value vector into a fully connected layer to obtain a predicted probability value corresponding to the traffic flow data to be detected. The predicted probability value is used to determine the state of the traffic flow data to be detected. By collecting multi-dimensional traffic flow data with added time series data under complex conditions, and combining convolutional neural networks, gated recurrent units, attention layers, and fully connected layers, the spatial relationships between different feature values ​​of the multi-dimensional traffic flow data are obtained through the convolutional neural network. The temporal characteristics of user behavior are discovered through the gated recurrent unit, and the influence of user feature states at different times on current traffic usage is captured through the attention layer. Finally, a predicted probability value is obtained to analyze the state of traffic flow. This can expand the analysis scope of traffic flow data of IoT SIM cards and improve the accuracy of judging illegal usage behavior under complex conditions.

[0066] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0067] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0068] Figure 1 This diagram illustrates the structure of a traffic detection system for an IoT card according to an embodiment of the present disclosure.

[0069] Figure 2 This diagram illustrates the structure of another IoT card traffic detection system according to an embodiment of the present disclosure;

[0070] Figure 3 A flowchart illustrating a traffic detection method for an IoT card according to an embodiment of this disclosure is shown;

[0071] Figure 4 This diagram illustrates a flowchart of an embodiment of the present disclosure for acquiring traffic data to be detected.

[0072] Figure 5 This diagram illustrates a flowchart of a preprocessing procedure according to an embodiment of the present disclosure;

[0073] Figure 6 A model architecture diagram of a traffic prediction model in an embodiment of this disclosure is shown;

[0074] Figure 7 This diagram illustrates a flowchart of a convolutional neural network processing procedure according to an embodiment of the present disclosure.

[0075] Figure 8 This diagram illustrates a network structure of a gated loop unit according to an embodiment of the present disclosure.

[0076] Figure 9 This diagram illustrates a flowchart of an attention layer processing procedure according to an embodiment of the present disclosure;

[0077] Figure 10 This diagram illustrates a network structure of a fully connected layer according to an embodiment of the present disclosure.

[0078] Figure 11 A flowchart illustrating another method for detecting traffic using an IoT card in an embodiment of this disclosure is shown.

[0079] Figure 12 This document shows a flowchart illustrating the training process of a traffic detection model according to an embodiment of the present disclosure.

[0080] Figure 13 This diagram illustrates the structure of a traffic detection device for an IoT card according to an embodiment of the present disclosure.

[0081] Figure 14 A schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0082] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0083] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0084] The following explanations are provided for the terms that appear in this disclosure:

[0085] 1. Convolutional Neural Networks (CNN): A type of feedforward neural network that includes convolutional computation and has a deep structure. It extracts features through operations such as convolution and pooling, maps the input data into a high-dimensional feature space, and then classifies or regresses the features through fully connected layers.

[0086] 2. Gated Recurrent Unit (GRU): This is a type of Recurrent Neural Network (RNN) that can solve problems in RNNs such as the inability to retain information for long periods and gradient issues during backpropagation.

[0087] 3. Attention Mechanism (AM): A special structure embedded in a machine learning model to automatically learn and calculate the contribution of input data to output data.

[0088] 4. Multi-Layer Perceptron (MLP): This is a feedforward artificial neural network that can be used for tasks such as classification, regression, and prediction. It has a multi-layer structure, with each layer consisting of multiple neurons, and the output of the previous layer serving as the input to the next layer.

[0089] The methods for detecting IoT SIM card traffic in related technologies generally include: device-based, traffic-based, and site-based. Device-based methods identify the type of terminal the IoT SIM card is attached to. Traffic-based methods identify traffic based on historical traffic information. Site-based methods monitor IoT SIM card access behavior by setting up a site blacklist. However, with the increasing power of IoT devices and the more diverse purposes and uses of internet access by users, existing detection methods are insufficient to handle unauthorized usage in complex situations.

[0090] This disclosure provides a method and related equipment for detecting the traffic of an Internet of Things (IoT) card, specifically including: a method, device, system, electronic equipment, medium, and program product for detecting the traffic of an IoT card.

[0091] The traffic detection method for IoT cards disclosed herein can be applied to electronic devices or to IoT card traffic detection systems.

[0092] Figure 1 A schematic diagram of the structure of a traffic detection system for an Internet of Things (IoT) card, according to an embodiment of this disclosure, is shown. Figure 1 As shown, the traffic detection system 100 may include an acquisition module 110 and a traffic identification and prediction module 120. The traffic identification and prediction module 120 may include a convolutional neural network 121, a gated recurrent unit 122, an attention layer 123, and a fully connected layer 124.

[0093] In one possible embodiment, the acquisition module 110 is used to acquire the traffic data to be detected from the IoT card; the traffic data to be detected is multi-dimensional traffic data with time sequence.

[0094] The traffic identification and prediction module 120 is used to input the traffic data to be detected into the convolutional neural network 121 for processing to obtain spatial connection features; input the spatial connection features into the gated recurrent unit 122 for processing to obtain temporal features; input the temporal features into the attention layer 123 for processing to obtain attention value vector; input the attention value vector into the fully connected layer 124 to obtain the prediction probability value corresponding to the traffic data to be detected, and the prediction probability value is used to determine whether the traffic data to be detected is abnormal.

[0095] In one possible embodiment, the convolutional neural network 121, the gated recurrent unit 122, the attention layer 123, and the fully connected layer 124 can be integrated into a single model called a traffic identification model.

[0096] Furthermore, Figure 2 A schematic diagram of the structure of another IoT card traffic detection system according to an embodiment of this disclosure is shown.

[0097] like Figure 2 As shown, the traffic detection system 100 may also include an anomaly handling platform 130.

[0098] The acquisition module 110 may include a data acquisition module 111, a service feature extraction module 112, and a traffic preprocessing module 113.

[0099] In one possible embodiment, the data acquisition module 111 is responsible for collecting daily traffic logs of the IoT card; the service feature extraction module 112 uses the traffic log data to extract user-related service feature data; the traffic preprocessing module 113 preprocesses the service feature data for input into the model; and the traffic identification and prediction module 120 performs real-time inference calculations on the collected IoT card traffic data to obtain the predicted probability value of illegal use of the network card.

[0100] The traffic preprocessing module 113 and the traffic identification and prediction module 120 can be integrated into a single traffic detection module.

[0101] The traffic identification model in this disclosure needs to be trained before real-time inference calculation. The traffic detection module can design and calculate the traffic identification model, optimize the model parameters using the profile features of the training samples, and obtain the optimal traffic identification model that can identify abnormal traffic.

[0102] The anomaly handling platform 130 can perform hierarchical control and handling based on the predicted probability value predicted by the traffic identification model.

[0103] In one possible embodiment, the data acquisition module 111 is used to obtain the raw service logs of the IoT card through request behavior; clean the raw service logs and store the cleaned data in tuple format to obtain behavioral data. The business feature extraction module 112 is used to aggregate and statistically process the behavioral data according to a preset time window to obtain business feature data. The traffic preprocessing module 113 is used to preprocess the business feature data to obtain preprocessed traffic; and sort the preprocessed traffic according to a time series to obtain traffic data to be detected.

[0104] In one possible embodiment, the anomaly handling platform 130 is used to determine the status of the traffic data to be detected based on the predicted probability value; if the traffic data to be detected is determined to be in a first state, the IoT card is blocked; if the traffic data to be detected is determined to be in a second state, the IoT card is manually reviewed.

[0105] By deploying the traffic detection system 100 in the IoT end-to-end protection system and connecting it to IoT cards, the system can obtain predicted probability values ​​by utilizing the daily request behavior of IoT cards, detect the traffic of IoT cards, and obtain results. This improves the accuracy and recall rate of detection and can deal with the illegal use of IoT cards in various complex situations.

[0106] The following detailed description of this exemplary implementation method is provided in conjunction with the accompanying drawings and embodiments.

[0107] First, this disclosure provides a method for detecting the traffic of an Internet of Things (IoT) card, which can be executed by any electronic device with computing capabilities.

[0108] Figure 3 A flowchart illustrating a traffic detection method for an IoT card according to an embodiment of this disclosure is shown, such as... Figure 3 As shown, it includes the following steps:

[0109] S302: Obtain the traffic data to be detected from the IoT card. The traffic data to be detected is multi-dimensional traffic data with time sequence.

[0110] In one possible embodiment, the traffic data to be detected may include at least: time sequence number, total traffic, total number of characters in SMS messages, total call duration, number of SMS messages sent, number of SMS messages received, number of outgoing calls, and number of incoming calls.

[0111] S304: Input the traffic data to be detected into a convolutional neural network for processing to obtain spatial connection features.

[0112] S306: Input the spatial relationship features into the gated loop unit for processing to obtain the temporal features.

[0113] S308: Input the temporal features into the attention layer for processing to obtain the attention value vector.

[0114] S310: Input the attention value vector into the fully connected layer to obtain the predicted probability value corresponding to the traffic data to be detected. The predicted probability value is used to determine the state of the traffic data to be detected.

[0115] The methods described in the above embodiments, for traffic data under complex conditions, can obtain spatial relationships between different feature values ​​of multidimensional traffic data through convolutional neural networks, discover temporal features of user behavior through gated recurrent units, and capture the impact of user feature states at different times on current traffic usage through attention layers, thereby obtaining high-dimensional discriminative features of IoT cards. Finally, predicted probability values ​​are obtained to analyze the state of traffic. This can expand the analysis scope of IoT card traffic data, analyze the correlation between traffic data under complex conditions, the temporal features of user behavior, and the impact of user feature states at different times. Compared with identifying IoT cards that violate regulations based on terminal type, access site blacklists, or traffic maximum threshold limits, the processing methods are singular and cannot cope with flexible and ever-changing usage patterns. The methods in the embodiments of this disclosure can improve the accuracy of judging illegal usage behavior under complex conditions. In the temporal behavior analysis scenario with multiple features, it can improve the accuracy and recall of the traffic identification model.

[0116] In one possible embodiment, Figure 4 A flowchart for acquiring traffic data to be detected is shown, such as... Figure 4 As shown, it includes the following steps:

[0117] S402: Obtain the raw service logs of the IoT card through the request behavior of the IoT card.

[0118] In one possible embodiment, by responding to the request behavior of the IoT card, behavioral data such as traffic, SMS messages, and calls of the IoT card are collected and stored as raw service logs.

[0119] S404: Clean the raw service logs and store the cleaned data in tuples to obtain behavioral data.

[0120] In one possible implementation, since the original service logs contain a large amount of meaningless border gateway protocol traffic, data cleaning can be performed using features such as protocol, port number, and traffic size.

[0121] After cleaning, the data is stored in tuples, where the tuple format can be: source address, destination address, source port, destination port, protocol, traffic volume, time, access terminal, number of SMS characters, and call duration.

[0122] Record behavioral data during the use of the IoT card; sample data is shown in Table 1.

[0123] Table 1

[0124] Source address 123.xxx.xxx.249 Destination address 202.xxx.xxx.201 Source port 8000 Destination port 9000 time 2022.12.26 09:58:01 protocol http Flow rate (M) 100 Access Terminal cell phone SMS message character count (words) 56 Call duration (s) 30

[0125] S406: Aggregate and statistically process behavioral data according to a preset time window to obtain business characteristic data.

[0126] In one possible embodiment, network requests initiated by the IoT SIM card represent the user's behavioral habits, and the behavioral data of the IoT SIM card is aggregated and statistically analyzed according to time windows.

[0127] For example, the time window can be in the hour. The user's behavior data for the past two weeks can be calculated in hours to obtain business feature data.

[0128] The business characteristic data may include at least: total traffic volume, total number of characters in SMS messages, total call duration, number of SMS messages sent and received, number of outgoing calls, and number of incoming calls. Sample data is shown in Table 2.

[0129] Table 2

[0130] Time point 9:00 AM, December XX, 2022 Total flow rate (M) 1200 Total number of characters in the text message (characters) 140 Total call duration (s) 45 Number of SMS messages sent (messages) 5 SMS messages received (number of messages) 2 Number of outgoing calls (number of calls) 1 Number of incoming calls (number of calls) 0

[0131] S408: Preprocess business characteristic data to obtain preprocessed traffic.

[0132] S410: Sort the preprocessed flow according to the time series to obtain the flow data to be detected.

[0133] In one possible embodiment, the preprocessing stage of business feature data can employ various preprocessing methods.

[0134] After obtaining the preprocessed traffic, it is sorted according to the time series, and the preprocessed traffic under each time window is labeled with the corresponding sorting number to obtain the traffic data to be detected.

[0135] The flow data to be detected can be shown in Table 3.

[0136] Table 3

[0137] Serial Number 9 Total Flow Size 0.8 Total number of characters in the text message 0.1 Total call duration 0.03 SMS sending volume 0.05 SMS Received 0.02 Number of callers 0.05 Number of calls received 0

[0138] The sequence number represents the position of the current preprocessed traffic in the preprocessed traffic set of its respective IoT card, sorted in ascending order by time.

[0139] In one possible embodiment, Figure 5 A flowchart of a preprocessing procedure is shown, such as Figure 5 As shown, it includes the following steps:

[0140] S502: Check the field values ​​of the business characteristic data, and process the missing values ​​using the forward filling method to obtain the first data.

[0141] S504: Outliers in the first data are identified using the standard deviation method, and the data is replaced by the median to obtain the second data.

[0142] S506: Normalize the second data according to the max-min method to obtain the preprocessed flow.

[0143] In one possible embodiment, the traffic prediction model in this disclosure may include: a convolutional neural network, a gated recurrent unit, an attention layer, and a fully connected layer. Figure 6 A model architecture diagram of a traffic prediction model is shown, such as... Figure 6 As shown.

[0144] The traffic data to be detected is input into the traffic prediction model for processing to obtain the predicted probability value. The specific process can be described in the following four examples.

[0145] The data format for the input data can be configured, including batch size, time steps, and feature dimensions. For example, the data format can be set to a batch size of 1, a time step of t, and a feature dimension of n. Then, a single IoT SIM card traffic sample, i.e., a single piece of traffic data to be detected, can be viewed as a real-number sequence matrix R. t×n .

[0146] Example 1: The process of processing traffic data to be detected by a convolutional neural network.

[0147] Figure 7 A flowchart of a convolutional neural network processing procedure is shown, such as... Figure 7 As shown, a convolutional neural network includes convolutional layers and pooling layers. It includes the following steps:

[0148] S702: Input the traffic data to be detected into a convolutional layer with m kernels for one-dimensional convolution processing to obtain m first feature maps.

[0149] In one possible embodiment, for the traffic data to be detected, one-dimensional convolution is used, with the convolution kernel performing convolution only in a single time domain direction. The number of convolution kernels is m, the kernel size is k, and the sliding step size is 1. Feature extraction is performed once for the sequence vector at every k time steps. The specific processing procedure can be shown in formula (1).

[0150] o i =f(w*x) i:i+k-1 +b) Formula (1)

[0151] Where f represents the non-linear activation function, w is the weight of the convolution kernel, b is the bias of the convolution kernel, and x represents the input; o i This represents the first feature map of the output.

[0152] S704: Input m first feature maps into the pooling layer for average pooling operation to obtain m second feature maps.

[0153] In one possible embodiment, the m first feature maps are subjected to average pooling operation with a pooling size of 2 and a sliding step size of 2 to obtain m second feature maps o of shape [(t-k+1) / 2]×1. The specific calculation formula is shown in formula (2).

[0154] o = avg{o i ,o i+1 Formula (2) (i = 1, 3, 5, ..., tk)

[0155] S706: Expand and reduce the dimensionality of the m second feature maps to obtain spatial relationship features. Spatial relationship features are features that have temporal sequence and preserve the spatial relationship of multidimensional traffic data in the traffic data to be detected.

[0156] In one possible embodiment, the m second feature maps are expanded and dimensionality reduced to obtain a real vector of length m*(t-k+1) / 2, which is the spatial relationship feature. The spatial relationship feature preserves the spatial relationship between different feature values ​​of the samples and serves as the input of the GRU network.

[0157] By using convolutional neural networks to extract spatial relationships between different feature values ​​in the data, the shortcomings of GRU in capturing the spatial components of the data are overcome, while the features extracted still retain temporal characteristics.

[0158] When sample data enters the CNN layer, it undergoes convolution, pooling, and node unrolling (dimensionality reduction) operations in sequence, and finally outputs feature data that integrates information from different dimensions such as traffic, SMS, and calls.

[0159] Example 2:

[0160] Spatial connection features are input into the gated recurrent unit, where the network structure diagram of the gated recurrent unit is as follows: Figure 8 As shown, this includes update gates, reset gates, candidate hidden layer states, etc.

[0161] The process of processing spatial connection characteristics is as follows, taking x as an example. t Given the input data, the specific calculation process includes:

[0162] Update Gate: z t =σ(W z ·[h t-1 ,x t ]+b z ) Formula (3)

[0163] Reset Gate: r t =σ(W r·[h t-1 ,x t ]+b r ) Formula (4)

[0164] Candidate hidden layer states:

[0165] Output status:

[0166] Where σ represents the activation function, x t h represents the input data. t-1 b represents the state information of the previous moment. z b r b h These are the biases for the update gate, reset gate, and candidate state, respectively, W. z W r W h These represent the weight parameter matrices for the update gate, reset gate, and candidate state, respectively.

[0167] After the input spatial relationship features of the time series data are processed through the GRU network, the time features of the user's IoT card usage behavior can be extracted, i.e., the time series features.

[0168] Example 3:

[0169] Figure 9 A flowchart of an attention layer processing procedure is shown, such as Figure 9 As shown, it includes the following steps:

[0170] S902: Determine the correlation score between the input and output features in the attention layer based on the temporal features, the network weights in the attention layer, and the bias in the attention layer.

[0171] In one possible embodiment, the attention layer utilizes an attention mechanism to filter key information from a large amount of information by calculating the attention probability distribution, using temporal features as input.

[0172] The formula for determining the relevance score can be shown below:

[0173] s t =tanh(h) t ·W h +b h ) Formula (7)

[0174] Among them, s t h represents the relevance score. t It is a temporal characteristic, W h These are the weights of the attention network, b h It is the bias of the attention network.

[0175] S904: Normalize the relevance scores to obtain the attention score.

[0176] In one possible embodiment, the relevance score is normalized and then passed through a Softmax function to obtain the attention score a. t .

[0177] Calculate the number of attention scores a t It can be as shown in formula (8).

[0178]

[0179] S906: Based on the quantity and temporal characteristics of attention, an attention value vector is obtained. The attention value vector is used to characterize the impact of user characteristic states at different times on current traffic usage.

[0180] In one possible embodiment, the attention value vector s can be calculated as shown in Equation (9).

[0181] s=∑a t h t Formula (9)

[0182] Through the above embodiments, attention mechanisms can be utilized to filter key information from a large amount of information by calculating the attention probability distribution, thereby obtaining an attention value vector that represents the impact of user characteristic states at different times on current traffic usage, and enabling more detailed information mining.

[0183] Example 4:

[0184] The attention value vector is input into the fully connected layer to obtain the predicted probability value corresponding to the traffic data to be detected. The predicted probability value is used to determine the state of the traffic data to be detected.

[0185] A fully connected layer can be a fully connected multi-layer neural network, such as a multi-layer perceptron network, used to reduce the dimensionality of high-dimensional features. Figure 10 shows a schematic diagram of a fully connected layer network structure. Figure 10 As shown, it specifically includes the following:

[0186] The input can be an attention value vector. The fully connected layer can include: Hidden Layer-1, Hidden Layer-2, and an output layer. Hidden Layer-1 can be a hidden layer with 128 neurons, Hidden Layer-2 can be a hidden layer with 2 neurons, and the final output layer can be a Softmax function to normalize the features of the input and output layers. The output of the fully connected layer can be a predicted probability value. The predicted probability value can range from 0 to 1. The higher the predicted probability value, the higher the probability of unauthorized use of the IoT card, i.e., the higher the probability of an anomaly. The predicted probability value can also be understood as a confidence level used to characterize the abnormal situation of the IoT card.

[0187] In one possible embodiment, the predicted probability value can be used to determine the status of the traffic data to be detected.

[0188] In one possible embodiment, the state of the traffic data to be detected can be determined based on the predicted probability value; if the traffic data to be detected is determined to be in the first state, the IoT card is blocked; if the traffic data to be detected is determined to be in the second state, the IoT card is manually reviewed.

[0189] In one possible embodiment, the specific determination of the state can be as follows, corresponding to different prediction and probability values: determine whether the predicted probability value is greater than or equal to a preset first threshold; if yes, determine that the traffic data to be detected is in the first state; if no, determine whether the predicted probability value is greater than or equal to a preset second threshold; if yes, determine that the traffic data to be detected is in the second state.

[0190] In this case, the traffic data to be detected in the second state will be blocked if it is determined to belong to the first state after manual review.

[0191] In one possible embodiment, traffic data to be detected that is in a second state and has been confirmed as abnormal after manual review can also be acquired and added to the training dataset for training convolutional neural networks, gated recurrent units, attention layers, and fully connected layers.

[0192] Figure 11 A flowchart of another method for detecting traffic using an IoT card is shown, such as... Figure 11 As shown, it includes the following steps:

[0193] S1102: Obtain the raw service logs of the IoT card through the request behavior of the IoT card.

[0194] S1104: Clean the raw service logs and store the cleaned data in tuples to obtain behavioral data.

[0195] S1106: Aggregate and statistically process behavioral data according to a preset time window to obtain business characteristic data.

[0196] S1108: Preprocess the business characteristic data to obtain preprocessed traffic.

[0197] S1110: Sort the preprocessed traffic according to the time series to obtain the traffic data to be detected.

[0198] S1112: Input the traffic data to be detected into a convolutional neural network for processing to obtain spatial connection features.

[0199] S1114: Input the spatial relationship features into the gated loop unit for processing to obtain the temporal features.

[0200] S1116: Input the temporal features into the attention layer for processing to obtain the attention value vector.

[0201] S1118: Input the attention value vector into the fully connected layer to obtain the predicted probability value corresponding to the traffic data to be detected. The predicted probability value is used to determine the state of the traffic data to be detected.

[0202] S1120: Determine whether the predicted probability value is greater than or equal to the first threshold; if yes, execute S1122; if no, execute S1124.

[0203] S1122: Determine that the traffic data to be detected is in the first state, and block the IoT card.

[0204] S1124: Determine whether the predicted probability value is greater than or equal to the second threshold. If yes, execute S1126; otherwise, end.

[0205] S1126: Determine that the traffic data to be detected is in the second state, and manually review the IoT card.

[0206] S1128: Update the training dataset with the traffic data to be detected that is in the second state and has been confirmed as the first state after manual review, and use it to train the convolutional neural network, gated recurrent unit, attention layer and fully connected layer.

[0207] The method provided in this disclosure can handle traffic usage in complex situations by utilizing the daily request behavior of IoT cards. It obtains spatial relationships between different feature values ​​through a CNN layer, discovers temporal features of user behavior using a GRU layer, and finally captures the impact of user feature states at different times on current traffic usage using an AM layer. The resulting predicted probability value is then sent to an anomaly handling platform for processing. For operations and maintenance personnel, simply connecting the system to an IoT card improves the accuracy of anomaly prediction and increases user recall, thereby reducing their workload. In temporal behavior analysis scenarios with multiple features, the method provided in this disclosure can improve the accuracy and recall of traffic identification models.

[0208] The models used in the above embodiments are all pre-trained network models that can be used directly. Figure 12 A flowchart of the training process for a traffic detection model is shown, such as... Figure 12 As shown, it includes the following steps:

[0209] S1202: Obtain the training dataset, which is a collection of traffic data from IoT cards.

[0210] S1204: Initialize the network parameters of the convolutional neural network, gated recurrent unit, attention layer and fully connected layer in the traffic detection model to be trained, and obtain the initialized traffic detection model.

[0211] In one possible embodiment, the initialization of network parameters may include initializing the weights and biases of each layer of the network.

[0212] S1206: Extract training samples from the training dataset and input them into the initialized traffic detection model to determine the probability value of traffic anomalies of the IoT card.

[0213] In one possible embodiment, the data in the training dataset may undergo a data preprocessing process before being input into the traffic detection model to be trained. The preprocessing process may include handling missing values ​​and outliers, and normalizing using the min-max method.

[0214] It is understood that the training samples in this embodiment are extracted from the training dataset and are preprocessed data.

[0215] In one possible embodiment, the training samples are input into the initialized traffic detection model. Specifically, the data processing flow involves a series of processes, including convolutional neural networks, gated recurrent units, attention layers, and fully connected layers, to obtain the traffic anomaly probability value.

[0216] For example, the specific processing procedure can be as follows:

[0217] CNN layer: The training samples are used as input data and pass through the convolutional layer and pooling layer in sequence to extract spatial features from the input data and output them to the GRU layer.

[0218] GRU layer: Extracts the temporal features of the input data through the GRU layer and outputs them to the AM layer.

[0219] AM layer: Calculates the attention value vector for the input temporal features and sums them according to the weights to obtain the attention vector.

[0220] Fully connected layer: After passing through a multi-layer perceptron network, the high-dimensional features are reduced to 2-dimensionality. The scores are then converted into probabilities using the Softmax function to obtain the abnormal probability value of traffic from unauthorized use of IoT cards.

[0221] S1208: Determine the loss function value based on the traffic anomaly probability value and the true value of the traffic anomaly probability corresponding to the training sample.

[0222] In one possible implementation, the cross-entropy function is used to calculate the error between the model's predicted value and the true value, i.e., the loss function value.

[0223] The calculation can be performed using formula (10), as shown below:

[0224]

[0225] Among them, y i Represents the actual value. represents the predicted value, and loss represents the loss function value.

[0226] S1210: Determine whether the loss function value meets the preset threshold, or whether the number of iterations has reached the preset number of training iterations; if not, execute S1212; if yes, execute S1214.

[0227] In one possible implementation, the backpropagation process of the error adjusts the network parameters that do not currently meet the conditions based on the loss function or the number of iterations, and then retrains.

[0228] S1212: Adjust the network parameters of the traffic detection model and return to S1206.

[0229] In one possible implementation, the weights and biases of each layer of the network can be updated, and training samples can be re-sampled for training.

[0230] S1214: Use the current network parameters as the network parameters of the trained traffic detection model to obtain the trained traffic detection model.

[0231] Based on the same inventive concept, this disclosure also provides an apparatus, as shown in the following embodiment. Since the principle by which this apparatus solves the problem is similar to that of the method embodiment described above, the implementation of this apparatus embodiment can refer to the implementation of the method embodiment described above, and repeated details will not be elaborated further.

[0232] Figure 13 This diagram illustrates the structure of a data traffic detection device for an IoT card according to an embodiment of the present disclosure. Figure 13 As shown, the device includes: an acquisition unit 1301 for acquiring traffic data to be detected from an IoT card; the traffic data to be detected is multi-dimensional traffic data with temporal sequence; a convolution unit 1302 for inputting the traffic data to be detected into a convolutional neural network for processing to obtain spatial relationship features; a gated recurrent unit 1303 for inputting the spatial relationship features into the gated recurrent unit for processing to obtain temporal features; an attention unit 1304 for inputting the temporal features into an attention layer for processing to obtain an attention value vector; and a prediction unit 1305 for inputting the attention value vector into a fully connected layer to obtain a prediction probability value corresponding to the traffic data to be detected, the prediction probability value being used to determine whether the traffic data to be detected is abnormal.

[0233] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0234] The following reference Figure 14 To describe an electronic device 1400 according to such an embodiment of the present disclosure. Figure 14 The electronic device 1400 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0235] like Figure 14 As shown, the electronic device 1400 is manifested in the form of a general-purpose computing device. The components of the electronic device 1400 may include, but are not limited to: at least one processing unit 1410, at least one storage unit 1420, and a bus 1430 connecting different system components (including storage unit 1420 and processing unit 1410).

[0236] The storage unit stores program code that can be executed by the processing unit 1410, causing the processing unit 1410 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 1410 can perform the steps of any of the above-described method embodiments.

[0237] Storage unit 1420 may include readable media in the form of volatile storage units, such as random access memory (RAM) 14201 and / or cache memory 14202, and may further include read-only memory (ROM) 14203.

[0238] Storage unit 1420 may also include a program / utility 14204 having a set (at least one) of program modules 14205, such program modules 14205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0239] Bus 1430 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0240] Electronic device 1400 can also communicate with one or more external devices 1440 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 1400, and / or with any device that enables electronic device 1400 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1450. Furthermore, electronic device 1400 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1460. As shown, network adapter 1460 communicates with other modules of electronic device 1400 via bus 1430. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0241] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0242] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods described above.

[0243] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the methods described above is stored thereon. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0244] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0245] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0246] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0247] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0248] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0249] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0250] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0251] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A traffic detection method of an Internet of Things card, characterized in that, The method comprises: acquiring to-be-detected traffic data of an Internet of Things card; the to-be-detected traffic data is multi-dimensional traffic data with time sequence; the multi-dimensional traffic data comprises a time sequence number, total traffic, total number of short message words, total duration of call, short message sending quantity, short message receiving quantity, call calling quantity and call called quantity; inputting the to-be-detected traffic data into a convolutional neural network for processing to obtain spatial contact features; inputting the spatial contact features into a gated recurrent unit (GRU) for processing to obtain time sequence features; inputting the time sequence features into an attention layer for processing to obtain an attention value vector; the attention layer is configured to obtain the attention value vector by calculating an attention probability distribution by using an attention mechanism (AM); inputting the attention value vector into a fully connected layer to obtain a prediction probability value corresponding to the to-be-detected traffic data, the prediction probability value being used to judge a user's irregular use behavior of the Internet of Things card to determine whether the to-be-detected traffic data is abnormal; the fully connected layer is configured to perform dimension reduction processing on the attention value vector by using a multi-layer perception network, and obtain the prediction probability value by processing by using a Softmax function; the method further comprises: judging whether the prediction probability value is greater than or equal to a first threshold value set in advance; if yes, determining that the to-be-detected traffic data is in a first state, and then disabling the Internet of Things card; if no, judging whether the prediction probability value is greater than or equal to a second threshold value set in advance; if yes, determining that the to-be-detected traffic data is in a second state, and then performing manual auditing on the Internet of Things card.

2. The method of claim 1, wherein, The acquiring to-be-detected traffic data of an Internet of Things card comprises: acquiring original service logs of the Internet of Things card by requesting behavior of the Internet of Things card; performing data cleaning on the original service logs, and storing the data cleaned in a tuple manner to obtain behavior data; performing aggregation statistical processing on the behavior data according to a preset time window to obtain service feature data; performing preprocessing on the service feature data to obtain preprocessed traffic; sorting the preprocessed traffic according to a time sequence to obtain to-be-detected traffic data.

3. The method of claim 2, wherein, The preprocessing of the service feature data to obtain preprocessed traffic comprises: checking field values of the service feature data, and processing missing values by using a forward filling method to obtain first data; judging abnormal values in the first data by using a standard deviation method, and replacing the abnormal values by using a median to obtain second data; performing normalization processing on the second data by using a maximum and minimum method to obtain preprocessed traffic.

4. The method of claim 1, wherein, The convolutional neural network comprises a convolution layer and a pooling layer; The inputting of the to-be-detected traffic data into the convolutional neural network for processing to obtain spatial contact features comprises: inputting the to-be-detected traffic data into a convolution layer with m convolution kernels for one-dimensional convolution processing to obtain m first feature maps; inputting the m feature maps into a pooling layer for average pooling operation to obtain m second feature maps; The m second feature maps are unfolded and reduced in dimension to obtain spatial contact features; the spatial contact features have time sequence and save spatial relationships of the multi-dimensional traffic data in the to-be-detected traffic data.

5. The method of claim 1, wherein, The inputting the time sequence features into the attention layer for processing to obtain an attention value vector comprises: According to the time sequence features, network weights in the attention layer, and bias in the attention layer, determining a correlation score of input features and output features in the attention layer; The correlation score is normalized to obtain an attention score quantity; According to the attention score quantity and the time sequence features, an attention value vector is obtained; the attention value vector is used to represent the influence of user feature states at different time on current traffic usage.

6. The method of claim 1, wherein, The method further comprises: Obtaining to-be-detected traffic data in a second state and confirmed as a first state after artificial review; Updating the training data set for training the convolutional neural network, the gated recurrent unit, the attention layer, and the fully connected layer.

7. The method of claim 1, wherein, The traffic detection model comprises: a convolutional neural network, a gated recurrent unit, an attention layer, and a fully connected layer; The training process of the traffic detection model comprises: Obtaining a training data set; the training data set is a traffic data set of the Internet of Things card; Initializing network parameters of the convolutional neural network, the gated recurrent unit, the attention layer, and the fully connected layer in the to-be-trained traffic detection model to obtain an initialized traffic detection model; According to the training data set, iteratively training the initialized traffic detection model, wherein one iteration training process comprises: Extracting a training sample from the training data set and inputting it into the initialized traffic detection model to determine a traffic anomaly probability value of the Internet of Things card; According to the traffic anomaly probability value and a real value of the traffic anomaly probability corresponding to the training sample, determining a loss function value; According to the loss function value, adjusting the network parameters of the traffic detection model until the loss function value meets a preset threshold value, or the number of iterations of the iterative training reaches a preset training number, to obtain a trained traffic detection model; wherein the network parameters when the loss function value meets the preset threshold value or the number of iterations of the iterative training reaches the preset training number are used as the network parameters of the trained traffic detection model. 8.A traffic detection device of an Internet of Things card, characterized in that, Comprise: An acquisition unit is configured to acquire to-be-detected traffic data of an Internet of Things card; The to-be-detected traffic data is multi-dimensional traffic data with time sequence; The multi-dimensional traffic data comprises: a time sequence number, total traffic, total number of short message, total duration of call, short message sending quantity, short message receiving quantity, call calling quantity, and call called quantity; A convolution unit is configured to input the to-be-detected traffic data into a convolutional neural network for processing to obtain spatial contact features; A gated recurrent unit is configured to input the spatial contact features into a gated recurrent unit GRU for processing to obtain time sequence features; An attention unit is configured to input the time sequence features into an attention layer for processing to obtain an attention value vector; wherein the attention layer is configured to obtain the attention value vector by calculating an attention probability distribution using an attention mechanism AM. The prediction unit is configured to input the attention value vector into a full connection layer to obtain a prediction probability value corresponding to the to-be-detected traffic data, the prediction probability value being used to determine whether the user has a violation use behavior on the IoT card to determine whether the to-be-detected traffic data is abnormal; wherein the full connection layer is configured to perform dimension reduction processing on the attention value vector through a multi-layer perception network, and obtain the prediction probability value through a Softmax function processing. The traffic detection device of the IoT card is further configured to determine whether the prediction probability value is greater than or equal to a first threshold value set in advance; if yes, it is determined that the to-be-detected traffic data is in a first state, and the IoT card is then banned; if no, it is determined whether the prediction probability value is greater than or equal to a second threshold value set in advance; if yes, it is determined that the to-be-detected traffic data is in a second state, and the IoT card is then manually audited. 9.A traffic detection system of an Internet of Things card, characterized in that, Comprise: The acquisition module is configured to acquire to-be-detected traffic data of an IoT card; The to-be-detected traffic data is multi-dimensional traffic data with time sequence; The multi-dimensional traffic data comprises a time sequence number, total traffic, total number of SMS, total duration of call, SMS sending quantity, SMS receiving quantity, call making quantity, and call receiving quantity; The traffic recognition prediction module is configured to input the to-be-detected traffic data into a convolutional neural network for processing to obtain spatial contact features; input the spatial contact features into a gated recurrent unit (GRU) for processing to obtain time sequence features; input the time sequence features into an attention layer for processing to obtain an attention value vector; and input the attention value vector into a full connection layer to obtain a prediction probability value corresponding to the to-be-detected traffic data, the prediction probability value being used to determine whether the user has a violation use behavior on the IoT card to determine whether the to-be-detected traffic data is abnormal; wherein the attention layer is configured to obtain the attention value vector by calculating an attention probability distribution through an attention mechanism (AM); and the full connection layer is configured to perform dimension reduction processing on the attention value vector through a multi-layer perception network, and obtain the prediction probability value through a Softmax function processing. Further comprise: the abnormality disposal platform is configured to determine whether the prediction probability value is greater than or equal to a first threshold value set in advance; if yes, it is determined that the to-be-detected traffic data is in a first state, and the IoT card is then banned; if no, it is determined whether the prediction probability value is greater than or equal to a second threshold value set in advance; if yes, it is determined that the to-be-detected traffic data is in a second state, and the IoT card is then manually audited.

10. The system of claim 9, wherein, The acquisition module comprises a data acquisition module, a business feature extraction module, and a traffic preprocessing module; The data acquisition module is configured to acquire original service logs of the IoT card through a request behavior of the IoT card; perform data cleaning on the original service logs, and store the data cleaned data in the form of a tuple to obtain behavior data; The business feature extraction module is configured to perform aggregation statistical processing on the behavior data according to a preset time window to obtain business feature data; The traffic preprocessing module is configured to preprocess the service feature data to obtain preprocessed traffic, and sort the preprocessed traffic according to a time sequence to obtain to-be-detected traffic data.

11. An electronic device, comprising: Comprise: A processor; And A memory for storing executable instructions of the processor; Wherein the processor is configured to execute the executable instructions to perform the method of any one of claims 1-7.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-7.

13. A computer program product, comprising: Computer programs or instructions, characterized in that the computer programs or instructions are executed by the processor to implement the method of any one of claims 1-7.

Images