Anti-theft meter box

Abstract

The present invention relates to the technical field of anti-theft alarm technology, and in particular to an anti-theft meter box. Firstly, according to the characteristics that the input habits of normal users usually do not change, the password input speed is fast, and the wrong password that has been input is usually close to the correct password, the degree of behavioral abnormality of each decryption process is determined; further, based on the fact that normal users know the correct password or can quickly obtain the correct password, the corresponding degree of behavioral abnormality of each decryption process is usually small and the values ​​are usually close, so according to the overall size of the degree of behavioral abnormality corresponding to each decryption process, the distribution disorder and the total number of decryption processes, the alarm coefficient is determined, so that the obtained alarm coefficient can be combined with the user behavior characteristics to make the real-time theft alarm judgment more accurate, thereby improving the anti-theft effect of the anti-theft meter box.

Description

Technical Field

[0001] The invention relates to the technical field of anti-theft alarm, and in particular to an anti-theft metering box. Background Art

[0002] The anti-theft meter box is a device used to prevent electricity theft, and is commonly used in power supply facilities such as residential, commercial buildings and industrial sites. The device is mainly used to monitor and control electricity usage to ensure the accuracy of electricity metering and prevent illegal operations and electricity theft.

[0003] By setting a password lock, it is possible to determine whether a theft has occurred based on whether the password is entered correctly. The means of using a password lock for anti-theft alarm in the prior art usually sets an upper limit on the number of consecutive incorrect password inputs, and when the corresponding upper limit is exceeded, it is considered that theft has occurred and an alarm is issued; however, the password lock can only record whether the password is entered correctly or not, and has no ability to distinguish the actual behavior of the password inputter; when the password is relatively simple, it is usually impossible to perform effective anti-theft warnings; and when the password is relatively complex, a normal user may forget the password or touch it by mistake, resulting in continuous input errors. Therefore, when judging theft based solely on the number of consecutive incorrect password inputs, errors are likely to occur; therefore, the method of setting an upper limit on the number of errors in the prior art to judge theft is more likely to result in misjudgment, resulting in poor anti-theft effect of the anti-theft meter box. Summary of the invention

[0004] In order to solve the technical problem that the method of setting an upper limit on the number of errors in the prior art for judging theft behavior has a high probability of misjudgment, resulting in poor anti-theft effect of the anti-theft meter box, the present application provides an anti-theft meter box, and the technical solution adopted is as follows:

[0005] The present application provides an anti-theft meter box, including a processor and a memory, wherein the processor is used to process instructions stored in the memory to implement the following monitoring process:

[0006] Obtaining the input password data recorded in each decryption process of the anti-theft meter box within a preset historical time period before the current moment;

[0007] Determine the degree of change in character input in each decryption process based on the overall deviation of characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process; determine the degree of abnormal behavior in each decryption process based on the degree of change in character input and the concentrated distribution of input time intervals of each password position in the input password data recorded in each decryption process;

[0008] Determine the abnormal probability of decryption at the current moment according to the overall magnitude of the abnormal behavior and the distribution disorder of each decryption process in the preset historical time period before the current moment; determine the alarm coefficient at the current moment according to the total number of decryption processes in the preset historical time period before the current moment and the abnormal probability of decryption;

[0009] A real-time theft alarm determination is performed based on the alarm coefficient.

[0010] Furthermore, the process of obtaining the degree of change of the character input includes:

[0011] The input password data recorded in the previous decryption process of each decryption process is used as the comparison password data corresponding to each decryption process;

[0012] The number of password positions where characters are different between the input password data and the compared password data recorded in each decryption process is taken as the degree of change of character input in each decryption process.

[0013] Furthermore, the process of obtaining the degree of behavioral abnormality includes:

[0014] The number of password positions where characters differ between the input password data and the correct password data recorded in each decryption process is taken as the total number of wrong characters in each decryption process;

[0015] Under each cluster division number, cluster analysis is performed on the input time points of all password positions in the input password data recorded in each decryption process to obtain at least two input password position clusters corresponding to each decryption process under each cluster division number; the cluster division number is an integer and is less than or equal to a preset cluster threshold; the preset cluster threshold is greater than or equal to a positive integer 2;

[0016] In each decryption process, the input discreteness of each clustering number is determined according to the distribution concentration of the time intervals between the temporally adjacent password positions in each input password position cluster under each clustering number;

[0017] The number of clusters with the minimum input discreteness corresponding to each decryption process is used as the input frequency of each decryption process; the minimum value of the input discreteness corresponding to each decryption process is used as the reference input speed of each decryption process; the degree of abnormality of the input process of each decryption process is determined according to the reference input speed and the deviation between the input frequency of each decryption process and the input frequency of the previous decryption process;

[0018] The degree of behavioral abnormality of each decryption process is determined according to the degree of abnormality of the input process, the total number of erroneous characters and the degree of change of the character input; wherein the degree of abnormality of the input process, the total number of erroneous characters and the degree of change of the character input are all positively correlated with the degree of behavioral abnormality.

[0019] Furthermore, the process of obtaining the input discreteness includes:

[0020] Under each number of cluster divisions in each decryption process, the time difference between the input time point of each password position and the input time point of the previous password position in the time sequence of each password position cluster is used as the input time interval of each corresponding password position;

[0021] The average of the input time intervals of all password positions in all password position clusters under each number of cluster divisions in each decryption process is used as the input discreteness under each number of cluster divisions in each decryption process.

[0022] Furthermore, the process of obtaining the abnormality degree of the input process includes:

[0023] The difference between the input frequency of each decryption process and the input frequency of the previous decryption process is taken as the input habit difference of each decryption process;

[0024] The abnormality degree of the input process of each decryption process is determined according to the product of the negative correlation mapping value of the reference input speed of each decryption process and the input habit difference.

[0025] Furthermore, the process of determining the degree of abnormal behavior of each decryption process according to the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change of the character input includes:

[0026] The degree of abnormality of the input process, the total number of erroneous characters and the sum of squares of the degree of change in character input are normalized to determine the degree of abnormal behavior of each decryption process.

[0027] Furthermore, the process of obtaining the abnormal probability of decryption includes:

[0028] Determine the degree of abnormal behavior fluctuation at the current moment according to the variance of the degree of abnormal behavior corresponding to all decryption processes in the preset historical time period corresponding to the current moment;

[0029] The product of the average value of the behavior abnormality degree corresponding to all decryption processes in the preset historical time period corresponding to the current moment and the behavior abnormality fluctuation degree is normalized to determine the abnormal probability of decryption at the current moment.

[0030] Furthermore, the process of obtaining the alarm coefficient includes:

[0031] The product of the total number of decryption processes in a preset historical time period before the current moment and the abnormal probability of decryption is normalized to determine the alarm coefficient at the current moment.

[0032] Furthermore, the process of performing real-time theft alarm judgment according to the alarm coefficient includes:

[0033] When the alarm coefficient is less than or equal to the preset alarm threshold, no real-time theft alarm signal is issued; when the alarm coefficient is greater than the preset alarm threshold, a real-time theft alarm signal is issued.

[0034] An anti-theft meter box also includes an alarm module and a central control panel; wherein the alarm module includes an indicator light, a buzzer and an alarm; the alarm is used to control the indicator light to light up and trigger the buzzer when receiving a real-time theft alarm signal from the central control panel; the central control panel is used to input a password and record the input password data of each decryption process; in the central control panel, the input password data recorded in each decryption process of the anti-theft meter box in a preset historical time period before the current moment is obtained;

[0035] Determine the degree of change in character input in each decryption process based on the overall deviation of characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process; determine the degree of abnormal behavior in each decryption process based on the degree of change in character input and the concentrated distribution of input time intervals of each password position in the input password data recorded in each decryption process;

[0036] Determine the abnormal probability of decryption at the current moment according to the overall magnitude of the abnormal behavior and the distribution disorder of each decryption process in the preset historical time period before the current moment; determine the alarm coefficient at the current moment according to the total number of decryption processes in the preset historical time period before the current moment and the abnormal probability of decryption;

[0037] A real-time theft alarm determination is performed based on the alarm coefficient.

[0038] This application has the following beneficial effects:

[0039] First of all, it is necessary to consider that although users or staff who know the password may forget the password or touch the password by mistake, they usually obtain the correct password in a short time or already know the correct password. Therefore, normal users are usually more familiar with the password and usually enter the password faster. However, users who steal do not know the correct password, that is, they are usually less familiar with the password, so the corresponding password input speed is usually relatively slow. In addition, for users who know the correct password but ultimately enter the password incorrectly, when the user is reminded that the password is entered incorrectly, the user will usually re-enter the password based on the known correct password, and even if the password is entered incorrectly again, since it is entered based on the correct password, there will usually not be many changes in the characters of the password position between the newly entered password and the last entered password. Therefore, the present application combines the overall deviation of the characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process, as well as the concentrated distribution of the input time intervals of each password position in the input password data recorded in each decryption process, to determine the degree of behavioral abnormality of each decryption process; thereby measuring the possibility of theft in each decryption process based on the degree of behavioral abnormality.

[0040] Furthermore, since normal users know the correct password or can quickly obtain the correct password, the corresponding decryption processes are usually less likely to be considered as theft behaviors, and the values ​​are usually close; while in the case of theft behaviors, since the correct password is not known, the overall abnormality of the behavior of each decryption process detected is usually large, and there is a large fluctuation; therefore, according to the overall size and distribution disorder of the abnormality of the behavior corresponding to each decryption process in the preset historical time period before the current moment, the abnormal probability of decryption is determined. And on the basis of the abnormal probability of decryption, combined with the characteristics that normal users usually spend less decryption processes to decrypt when they know the correct password or can quickly obtain the correct password, according to the total number of decryption processes in the preset historical time period before the current moment and the abnormal probability of decryption, the alarm coefficient for real-time theft alarm judgment at the current moment is determined; so that the behavioral characteristics of password input are combined when judging theft behavior, so that the accuracy of real-time theft alarm judgment is higher, and the anti-theft effect of the anti-theft meter box is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1A schematic diagram of the front structure of an anti-theft metering box provided by one embodiment of the present invention;

[0043] Figure 2 A schematic diagram of the back structure of an anti-theft metering box provided by one embodiment of the present invention;

[0044] Figure 3 A first schematic diagram of a plate support structure of an anti-theft metering box provided by an embodiment of the present invention;

[0045] Figure 4 A second schematic diagram of a plate support structure of an anti-theft metering box provided by an embodiment of the present invention;

[0046] Figure 5 A flow chart of a data processing process of an anti-theft meter box provided by one embodiment of the present invention;

[0047] In the figure, 1- observation window; 2- socket; 3- semicircular plate support; 4- countersunk screw hole; 5- high hardness insulating shell; 6- plate support base; 7- copper wire; 8- round conductive copper sheet; 9- fan-shaped conductive copper sheet; 10- alarm; 11- indicator light; 12- rectangular bracket; 13- operation window; 14- meter protective shell; 15- buzzer; 16- central control panel; 17- remote password lock; 18- circuit protection cover. DETAILED DESCRIPTION

[0048] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation method, structure, characteristics and effects of an anti-theft metering box proposed according to the present invention are described in detail below in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment, and the specific features, structures or characteristics in one or more embodiments may be combined in any suitable form. In addition, the terms "first" and "second" are used only for descriptive purposes and cannot be understood as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0049] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0050] The specific scheme of the anti-theft metering box provided by the present invention is described in detail below with reference to the accompanying drawings.

[0051] Embodiment 1 of an anti-theft meter box:

[0052] This embodiment provides an anti-theft meter box, including an alarm module and a central control panel. Figure 1 , which shows a front structural schematic diagram of an anti-theft meter box provided by an embodiment of the present invention; please refer to Figure 2 , which shows a schematic diagram of the back structure of an anti-theft meter box provided by an embodiment of the present invention; Figure 1 and Figure 2 The utility model comprises an observation window 1, a socket 2, a semicircular plate support 3, a high-hardness insulating shell 5, a plate support base 6, an alarm 10, an indicator light 11, a rectangular bracket 12, an electric meter protective shell 14, a buzzer 15, a central control panel 16, a remote password lock 17 and a circuit protection cover 18.

[0053] The plate support base 6 is fixed on the rectangular bracket 12, and the plate support base 6 and the rectangular bracket 12 are fixed to the wall together; the semicircular plate support 3 is installed on the high-hardness insulating shell 5, and the semicircular plate support 3 is fixed to the plate support base 6 by screws; please refer to Figure 3 , which shows a first schematic diagram of a plate support structure of an anti-theft meter box provided by an embodiment of the present invention; please refer to Figure 4 , which shows a second schematic diagram of a plate support structure of an anti-theft metering box provided by an embodiment of the present invention; Figure 3 and Figure 4 The semicircular plate support 3 includes a countersunk screw hole 4, a high-hardness insulating shell 5, a plate support base 6, a copper wire 7, a circular conductive copper sheet 8 and a fan-shaped conductive copper sheet 9. The surface of the semicircular plate support is designed with a countersunk screw hole 4; the copper wire 7 is embedded in the semicircular plate support 3, and the copper wire 7 extends through the frame of the high-hardness insulating shell 5, and enters the semicircular plate support 3 from both sides of the semicircular plate support 3 to fully contact the circular conductive copper sheet 8; the circular conductive copper sheets 8 of the semicircular plate support 3 and the plate support base 6 respectively slightly exceed the plane of each plate support by about 0.5 mm, and the two can be aligned and overlapped in the vertical direction when the two plate supports overlap; the copper wire 7 continues to extend downward along the circular conductive copper sheet 8 of the plate support base 6 until it fully contacts the fan-shaped conductive copper sheet 9; the fan-shaped conductive copper sheet 9 is placed on both sides of the bottom of the countersunk screw hole 4.

[0054] Eight observation windows 1 are installed on the surface of the high-hardness insulating shell 5, and a jack 2 is reserved below the observation window 1. The jack 2 is used to accommodate an electric meter that needs to insert an IC card for purchasing electricity; at the same time, an openable and closable operation window 13 is reserved on the far left; the alarm 10 is installed on one side of the central control panel 16, and an indicator light 11 is installed above the alarm 10, and a buzzer 15 is installed below; various components and circuits in the electric meter are wrapped inside the electric meter protection shell 14; the electric wires are under the electric meter, which are wrapped by a circuit protection cover 18; the circuit protection cover 18 and the electric meter protection shell 14 fit each other, and a remote password lock 17 is installed at the connection between the circuit protection cover 18 and the electric meter protection shell 14.

[0055] The semicircular plate support 3 and the plate support base 6 fit each other with a small gap to avoid malicious prying; the central control panel 16 contains a DC power supply inside and provides a 50 mA current, which is conducted through the copper wire 7, and after the semicircular plate support 3 and the plate support base 6 are fixed by a semicircular head hexalobular screw with conductive ability, the screw is in full contact with the fan-shaped conductive copper sheet 9 at the bottom of the countersunk screw hole 4; at the same time, in order to avoid the copper wire 7 in the semicircular plate support 3 and the plate support base 6 being too thin, so that the two are not in sufficient contact after the plate support is fixed, resulting in a circuit break, a circular conductive copper sheet 8 is designed, and when the semicircular plate support 3 and the plate support base 6 fit together, the two are in full contact; at this time, the current generated by the DC power supply is conducted to the copper wire 7 and the circular conductive copper sheet 8 in the semicircular plate support 3 through the copper wire 7, and then conducted to the fan-shaped conductive copper sheet 9 by the circular conductive copper sheet 8 of the plate support base 6 along its internal copper wire 7, and finally conducted to the fan-shaped conductive copper sheet 9 on the other side through the screw; after traversing all the plate supports, the entire high The 7 copper wires in the hardness insulating shell 5 form a loop; the alarm 10 is used to control the indicator light 11 to light up and trigger the buzzer 15 when receiving the real-time theft alarm signal from the central control panel 16; after the entire external anti-theft mechanism is installed, the copper wire 7 is energized; at this time, the user or administrator needs to contact the insurance through the administrator password of the central control panel 16 to stop the power supply, otherwise the screws will be directly removed; when the external anti-theft mechanism is pried with a tool, the screws are separated from the fan-shaped conductive copper sheet 9, causing the entire circuit to be abnormally broken, and triggering the central control panel 16 to send a real-time theft alarm signal and transmit it to the alarm 10 to alarm, and through the Internet of Things signal transmission module inside the alarm 10, the abnormal behavior here is transmitted to the remote control terminal to remind the management personnel; at the same time, the alarm 10 controls the indicator light 11 to light up and trigger the buzzer 15; until the management personnel confirm that there is no abnormality in the external anti-theft mechanism, the alarm is turned off through the central control panel 16 and the loop operation is reset.

[0056] Since foreseeable theft will modify the internal circuit of the meter, the circuit in the meter needs to be extra protected; therefore, the circuit protection cover 18 and the remote password lock 17 together form an internal anti-theft mechanism; the remote password lock 17 is connected to the central control panel 16 through the Internet of Things; the circuit protection cover 18 can be opened only after the household number and the password of the remote password lock 17 corresponding to the household number are entered through the central control panel 16. It should be noted that the password lock used in the present invention is a digital password lock, and the password length is set to 16 digits, including "*" and "#" in the numeric keys, and the password length and password character type can be adjusted according to the specific implementation environment; the entire metering device is protected by the internal and external anti-theft mechanisms; at the same time, the entire design structure is relatively simple, which is convenient for work and maintenance personnel to operate in an emergency; at the same time, by monitoring the entire anti-theft metering box, when there is theft, timely response and alarm to the relevant agencies are made, thereby improving the anti-theft efficiency;

[0057] The central control panel 16 is used to input the password and record the input password data of each decryption process; the central control panel 16 includes a data processing module, which can be a data processing chip such as a CPU or MCU; after recording the input password data of each decryption process, the central control panel 16 transmits all the input password data to the internal data processing module to perform real-time theft alarm judgment according to the predetermined data processing process; and transmits the real-time theft alarm signal to the alarm 10 when the real-time theft alarm is successful. Please refer to Figure 5 , which shows a flow chart of a data processing process of an anti-theft meter box provided by an embodiment of the present invention, including the following steps:

[0058] Step S501: Acquire the input password data recorded in each decryption process of the anti-theft meter box within a preset historical time period before the current moment.

[0059] In a specific implementation of an embodiment of the present invention, the preset historical time period is set to 20 minutes, that is, when a real-time theft alarm judgment is performed at each moment, the input password data recorded by all decryption processes within the previous 20 minutes are recorded; and each decryption process corresponds to a complete password input process; the time length of the preset historical time period can be adjusted according to the specific implementation environment. In a specific implementation of an embodiment of the present invention, each input password data is a password character time sequence, and while recording the input password data recorded in each decryption process, the time point when each password position in the password character time sequence is typed is recorded to facilitate subsequent analysis.

[0060] Step S502: Determine the degree of change in character input for each decryption process based on the overall deviation of characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process; determine the degree of behavioral abnormality for each decryption process based on the degree of change in character input and the concentrated distribution of input time intervals of each password position in the input password data recorded for each decryption process.

[0061] First of all, it is necessary to consider that although users or staff who know the password may forget the password or touch the password by mistake, they usually obtain the correct password in a short time or already know the correct password. Therefore, normal users are usually more familiar with the password and usually enter the password faster. However, users who steal do not know the correct password, that is, they are usually less familiar with the password, so the corresponding password input speed is usually relatively slow. In addition, for users who know the correct password but ultimately enter the password incorrectly, when the user is reminded that the password is entered incorrectly, the user will usually re-enter the password based on the known correct password, and even if the password is entered incorrectly again, since it is entered based on the correct password, there will usually not be many changes in the characters of the password position between the newly entered password and the last entered password. Therefore, the present application combines the overall deviation of the characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process, as well as the concentrated distribution of the input time intervals of each password position in the input password data recorded in each decryption process, to determine the degree of behavioral abnormality of each decryption process; thereby measuring the possibility of theft in each decryption process based on the degree of behavioral abnormality.

[0062] Preferably, in some possible implementations of the embodiments of the present invention, the process of obtaining the degree of change of character input includes:

[0063] The input password data recorded in the previous decryption process of each decryption process is used as the comparison password data corresponding to each decryption process; the number of password positions with different characters between the input password data recorded in each decryption process and the comparison password data is used as the degree of change of character input in each decryption process. That is, the password character timing sequence corresponding to the input password data of each decryption process is compared with the password characters with the same index value in the password character timing sequence corresponding to the input password data of the previous decryption process, and the number of different index values ​​of password characters is used as the degree of change of character input; the smaller the degree of change of character input, the smaller the change of password input in two adjacent decryption processes, and the more likely the corresponding decryption process is input based on the correct password, and the smaller the abnormality of the corresponding decryption behavior.

[0064] Preferably, in some possible implementations of the embodiments of the present invention, the process of obtaining the degree of abnormal behavior includes:

[0065] The number of password positions where characters differ between the input password data and the correct password data recorded in each decryption process is taken as the total number of wrong characters in each decryption process. For each decryption process, the more wrong characters are input, the more abnormal the behavior is; that is, if the correct password is known, the password entered by a normal user usually does not contain many wrong characters. Therefore, the more wrong characters are input, the greater the corresponding abnormal behavior.

[0066] Under each clustering number, cluster analysis is performed on the input time points of all password positions in the input password data recorded in each decryption process, and at least two input password position clusters corresponding to each decryption process under each clustering number are obtained; the clustering number is an integer and is less than or equal to the preset clustering threshold; the preset clustering threshold is greater than or equal to the positive integer 2. In a specific implementation of an embodiment of the present invention, the clustering analysis method adopts the k-means clustering algorithm; the preset clustering threshold is set to 4, that is, the values ​​of the clustering number are 2, 3 and 4 respectively; the size of the preset clustering threshold can be adjusted according to the specific implementation environment. Since the password is long and usually complex, normal users usually need to enter the password in batches, and the input of different batches usually has a large time interval. For example, for a 16-digit password, if a normal user enters the password in 4 times, and enters 4 characters each time; then there will be a relatively long pause after entering 4 password characters; therefore, in order to obtain a more accurate input speed corresponding to each decryption process, it is necessary to exclude the input pause between different batches, which is more in line with the objective scene. Therefore, in each decryption process, the input discreteness of each cluster division quantity is determined according to the distribution concentration of the time intervals between the sequentially adjacent password positions in each input password position cluster under each cluster division quantity.

[0067] Preferably, in some possible implementations of the embodiments of the present invention, the process of obtaining the input discreteness includes:

[0068] Under each number of cluster divisions in each decryption process, the time difference between the input time point of each password position in the time sequence of each password position cluster and the input time point of the previous password position is used as the input time interval of each corresponding password position; the mean of the input time intervals of all password positions in all password position clusters under each number of cluster divisions in each decryption process is used as the input discreteness under each number of cluster divisions in each decryption process. In a specific implementation of an embodiment of the present invention, the input time interval of the first password position in each password position cluster is set to 0, so that the calculation process excludes the influence of input pauses between different input batches as much as possible, so as to calculate a more accurate input discreteness. In other specific implementations of the embodiment of the present invention, the first password position in each password position cluster may not be analyzed. The smaller the overall size of the input time intervals of all password positions in all password position clusters, the more concentrated the input time points of each password position are, and the smaller the corresponding input discreteness is.

[0069] In a specific implementation of the embodiment of the present invention, the process of obtaining the input discreteness is expressed by the formula: ;in, For the The first decryption process The degree of input discreteness under the number of cluster divisions; For the The first decryption process The number of password position clusters under the number of cluster divisions; For the The first decryption process The number of clustering partitions The number of password positions in a password position cluster; For the The first decryption process The number of clustering partitions The password position cluster The time difference between the input time point of the password position and the input time point of the previous password position is the input time interval.

[0070] For each number of cluster divisions, the denser the data points of each data password position cluster under the corresponding number of cluster divisions, the more likely it is to exclude input pauses between different batches; that is, the smaller the input discreteness, the denser the corresponding password input time points, and the more likely it is to exclude input pauses between different batches. It also shows that the corresponding number of cluster divisions is more likely to be the number of input batches, that is, the input frequency. Therefore, the number of cluster divisions with the smallest input discreteness in each decryption process is further taken as the input frequency of each decryption process. Under the premise of determining the input frequency, the input discreteness under the corresponding number of cluster divisions can better represent the overall discreteness of the input behavior, and the smaller the input discreteness, the denser the corresponding input process is distributed in time series, that is, the faster the input speed; therefore, the minimum value of the input discreteness in each decryption process is further taken as the reference input speed of each decryption process.

[0071] After determining the reference input speed of each decryption process, it is necessary to consider that the input habits of normal users usually do not change, and the corresponding input frequency is usually relatively stable; and when the correct password is known, the input speed is usually fast; therefore, the abnormality of the input process of each decryption process is further determined based on the reference input speed and the deviation between the input frequency of each decryption process and the input frequency of the previous decryption process. Preferably, in some possible implementations of the embodiments of the present invention, the process of obtaining the abnormality of the input process includes:

[0072] The difference between the input frequency of each decryption process and the input frequency of the previous decryption process is taken as the input habit difference of each decryption process; the degree of abnormality of the input process of each decryption process is determined according to the product of the negative correlation mapping value of the reference input speed of each decryption process and the input habit difference. The smaller the difference between the input frequency of each decryption process and the input frequency of the previous decryption process, the smaller the change in input habits is, and the more normal the corresponding input process is; based on the difference in input habits and the characteristic that the input speed of normal users is usually faster, the greater the degree of abnormality of the input process is, the more abnormal the corresponding input behavior is, that is, the greater the degree of abnormality of the behavior is.

[0073] In a specific implementation of the embodiment of the present invention, the process of obtaining the abnormality degree of the input process includes: ;in, For the The degree of abnormality in the input process of the decryption process; For the The reference input speed of the decryption process; For the Input frequency of the decryption process; For the Input frequency of the decryption process; For the The input habit difference of the first decryption process is set to 0 for making the embodiment more complete; is the absolute value symbol; is an exponential function with a natural constant as the base. Implementers can adopt other negative correlation mapping methods according to the specific implementation environment, such as , and the reciprocal, where is a hyperbolic tangent function, which will not be further described here.

[0074] Since the greater the abnormality of the input process, the greater the total number of erroneous characters, and the greater the degree of change in character input, the more likely the corresponding decryption process is to be an abnormal behavior, that is, the more likely it is to be a theft behavior, the degree of behavioral abnormality of each decryption process is further determined based on the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change in character input; among them, the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change in character input are all positively correlated with the degree of behavioral abnormality.

[0075] Preferably, in some possible implementations of the embodiments of the present invention, the process of determining the degree of abnormal behavior of each decryption process according to the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change of character input includes:

[0076] The square sum of the abnormality degree of the input process, the total number of erroneous characters, and the degree of change of the character input is normalized to determine the degree of abnormal behavior of each decryption process. In other specific implementations of the embodiments of the present invention, the degree of abnormal behavior can also be calculated by other methods based on the correlation, such as the normalized value of the mean or product of the abnormality degree of the input process, the total number of erroneous characters, and the degree of change of the character input, which will not be further elaborated here.

[0077] In a specific implementation of the embodiment of the present invention, the process of obtaining the degree of abnormal behavior is expressed by the formula: ;in, For the The degree of abnormal behavior during the decryption process; For the The degree of abnormality in the input process of the decryption process; For the The degree of change in character input during the decryption process; For the The total number of wrong characters in the decryption process; For the The square value of the abnormality of the input process of the decryption process; For the The square value of the change in the character input during the decryption process; For the The square value of the total number of wrong characters in the decryption process; It is a linear normalization function. The implementer can adjust the normalization method according to the specific implementation environment.

[0078] Step S503: Determine the abnormal probability of decryption at the current moment according to the overall magnitude of abnormal behavior and the distribution disorder corresponding to each decryption process in the preset historical time period before the current moment; determine the alarm coefficient at the current moment according to the total number of decryption processes in the preset historical time period before the current moment and the abnormal probability of decryption.

[0079] Furthermore, since normal users know the correct password or can quickly obtain the correct password, the corresponding decryption processes are usually less likely to be considered as theft behaviors, and the values ​​are usually close; while in theft behaviors, since the correct password is not known, the overall abnormality of the behavior of each decryption process detected is usually large, and there is a large fluctuation; therefore, according to the overall size and distribution disorder of the abnormality of the behavior corresponding to each decryption process in the preset historical time period before the current moment, the abnormal probability of decryption is determined. And on the basis of the abnormal probability of decryption, combined with the characteristics that normal users usually spend less decryption processes to decrypt when they know the correct password or can quickly obtain the correct password, according to the total number of decryption processes in the preset historical time period before the current moment and the abnormal probability of decryption, the alarm coefficient for real-time theft alarm judgment at the current moment is determined; so that the behavioral characteristics of password input are combined when judging theft behavior, so that the accuracy of real-time theft alarm judgment is higher, and the anti-theft effect of the anti-theft meter box is better.

[0080] Preferably, in some possible implementations of the embodiments of the present invention, the process of obtaining the decryption abnormal probability includes:

[0081] According to the variance of the behavioral abnormality levels of all decryption processes in the preset historical time period before the current moment, the degree of behavioral abnormality fluctuation at the current moment is determined; the greater the degree of behavioral abnormality fluctuation, the greater the overall fluctuation in the behavioral abnormality levels of all decryption processes, and the greater the corresponding probability of abnormal decryption.

[0082] Normalize the product of the mean value of the abnormal behavior degree of all decryption processes in the preset historical time period before the current moment and the abnormal behavior fluctuation degree to determine the abnormal probability of decryption at the current moment. The larger the mean value of the abnormal behavior degree of all decryption processes in the preset historical time period before the current moment, the greater the overall abnormal behavior degree of all decryption processes, and the greater the corresponding abnormal probability of decryption; therefore, on the basis of the mean value, the abnormal behavior fluctuation degree is combined by multiplication and normalization, so that the value of the obtained abnormal probability of decryption is limited to 0 to 1, making the observation of decryption abnormality more intuitive.

[0083] Preferably, in some possible implementations of the embodiments of the present invention, the process of obtaining the alarm coefficient includes:

[0084] Normalize the product of the total number of decryption processes in the preset historical time period before the current moment and the probability of abnormal decryption to determine the alarm coefficient at the current moment. Since normal users usually spend less time on decryption when they know the correct password or can quickly obtain the correct password, the greater the total number of decryption processes in the preset historical time period before the current moment, the more likely it is to correspond to theft; and the greater the probability of abnormal decryption, the greater the possibility of theft; therefore, the total number of decryption processes and the probability of abnormal decryption are combined in the form of a product, and the alarm coefficient is quantified through the normalization method, which is convenient for setting the alarm threshold.

[0085] Step S504: Perform real-time theft alarm determination based on the alarm coefficient.

[0086] The larger the alarm coefficient is, the more likely it is that the anti-theft meter box is being stolen at the current moment, so a real-time theft alarm judgment is further performed based on the alarm coefficient. Preferably, in some possible implementations of the embodiments of the present invention, the process of performing a real-time theft alarm judgment based on the alarm coefficient includes:

[0087] When the alarm coefficient is less than or equal to the preset alarm threshold, no real-time theft alarm signal is issued; when the alarm coefficient is greater than the preset alarm threshold, a real-time theft alarm signal is issued. In the embodiment of the present invention, the preset alarm threshold is set to 0.87, which can be adjusted according to the specific implementation environment, and will not be further elaborated here. After the real-time theft alarm signal is issued, the real-time theft alarm signal is received by the alarm 10, and the abnormal behavior here is transmitted to the remote control terminal through the Internet of Things signal transmission module inside the alarm 10 to alert the management personnel; at the same time, the alarm 10 controls the indicator light 11 to light up and trigger the buzzer 15; until the management personnel confirms that there is no abnormality in the external anti-theft mechanism, the alarm is turned off through the central control panel 16 and the loop operation is reset.

[0088] A second embodiment of an anti-theft meter box:

[0089] This embodiment provides an anti-theft meter box, including a processor and a memory, wherein the processor is used to process instructions stored in the memory to implement the following monitoring process:

[0090] Obtaining the input password data recorded in each decryption process of the anti-theft meter box within a preset historical time period before the current moment;

[0091] Determine the degree of change in character input in each decryption process based on the overall deviation of characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process; determine the degree of abnormal behavior in each decryption process based on the degree of change in character input and the concentrated distribution of input time intervals of each password position in the input password data recorded in each decryption process;

[0092] Determine the abnormal probability of decryption at the current moment according to the overall magnitude of the abnormal behavior and the distribution disorder of each decryption process in the preset historical time period before the current moment; determine the alarm coefficient at the current moment according to the total number of decryption processes and the abnormal probability of decryption in the preset historical time period before the current moment;

[0093] Make real-time theft alarm judgment based on the alarm coefficient.

[0094] Therefore, the anti-theft meter box provided in this embodiment is essentially a processor device, which is implemented by an internal data processing process. Since the data processing process has been described in detail in the above-mentioned embodiment 1 of the road and bridge construction compaction detection device, it will not be repeated here.

[0095] To summarize, an anti-theft meter box first determines the degree of behavioral abnormality of each decryption process according to the characteristics that the input habits of normal users usually do not change, the password input speed is fast, and the wrong password that has been entered is usually close to the correct password; further, based on the fact that normal users know the correct password or can quickly obtain the correct password, the corresponding degree of behavioral abnormality of each decryption process is usually small and the values ​​are usually close, so the alarm coefficient is determined according to the overall size of the behavioral abnormality corresponding to each decryption process, the distribution disorder and the total number of decryption processes, so that the obtained alarm coefficient can be combined with the user behavior characteristics to make the real-time theft alarm judgment more accurate, thereby improving the anti-theft effect of the anti-theft meter box.

[0096] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0097] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. An anti-theft metering box, characterized in that: The system comprises a processor and a memory, wherein the processor is used to process instructions stored in the memory to implement the following monitoring process: Obtaining the input password data recorded in each decryption process of the anti-theft meter box within a preset historical time period before the current moment; Determine the degree of change of character input in each decryption process according to the overall deviation of characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process; The process of obtaining the degree of behavioral abnormality includes: The number of password positions where characters differ between the input password data and the correct password data recorded in each decryption process is taken as the total number of wrong characters in each decryption process; Under each cluster division number, cluster analysis is performed on the input time points of all password positions in the input password data recorded in each decryption process to obtain at least two input password position clusters corresponding to each decryption process under each cluster division number; the cluster division number is an integer and is less than or equal to a preset cluster threshold; the preset cluster threshold is greater than or equal to a positive integer 2; In each decryption process, the input discreteness of each clustering number is determined according to the distribution concentration of the time intervals between the temporally adjacent password positions in each input password position cluster under each clustering number; The number of clusters with the minimum input discreteness corresponding to each decryption process is used as the input frequency of each decryption process; the minimum value of the input discreteness corresponding to each decryption process is used as the reference input speed of each decryption process; the degree of abnormality of the input process of each decryption process is determined according to the reference input speed and the deviation between the input frequency of each decryption process and the input frequency of the previous decryption process; Determine the degree of behavioral abnormality of each decryption process according to the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change of the character input; wherein the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change of the character input are all positively correlated with the degree of behavioral abnormality; The process of obtaining the decrypted abnormal probability includes: Determine the degree of abnormal behavior fluctuation at the current moment according to the variance of the degree of abnormal behavior corresponding to all decryption processes in the preset historical time period corresponding to the current moment; Normalize the product of the average of the behavior abnormality levels corresponding to all decryption processes in the preset historical time period corresponding to the current moment and the behavior abnormality fluctuation level to determine the abnormal probability of decryption at the current moment; Determine the alarm coefficient at the current moment according to the total number of decryption processes in a preset historical time period before the current moment and the probability of abnormal decryption; A real-time theft alarm determination is performed based on the alarm coefficient.

2. The anti-theft metering box according to claim 1, characterized in that: The process of obtaining the degree of change of the character input includes: The input password data recorded in the previous decryption process of each decryption process is used as the comparison password data corresponding to each decryption process; The number of password positions where characters are different between the input password data and the compared password data recorded in each decryption process is taken as the degree of change of character input in each decryption process.

3. The anti-theft metering box according to claim 1, characterized in that: The process of obtaining the input discreteness includes: Under each number of cluster divisions in each decryption process, the time difference between the input time point of each password position and the input time point of the previous password position in the time sequence of each password position cluster is used as the input time interval of each corresponding password position; The average of the input time intervals of all password positions in all password position clusters under each number of cluster divisions in each decryption process is used as the input discreteness under each number of cluster divisions in each decryption process.

4. The anti-theft metering box according to claim 1, characterized in that: The process of obtaining the abnormality degree of the input process includes: The difference between the input frequency of each decryption process and the input frequency of the previous decryption process is taken as the input habit difference of each decryption process; The abnormality degree of the input process of each decryption process is determined according to the product of the negative correlation mapping value of the reference input speed of each decryption process and the input habit difference.

5. The anti-theft metering box according to claim 1, characterized in that: The process of determining the degree of abnormal behavior of each decryption process according to the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change of the character input includes: The degree of abnormality of the input process, the total number of erroneous characters and the sum of squares of the degree of change in character input are normalized to determine the degree of abnormal behavior of each decryption process.

6. The anti-theft metering box according to claim 1, characterized in that: The process of obtaining the alarm coefficient includes: The product of the total number of decryption processes in a preset historical time period before the current moment and the abnormal probability of decryption is normalized to determine the alarm coefficient at the current moment.

7. The anti-theft metering box according to claim 1, characterized in that: The process of performing real-time theft alarm judgment according to the alarm coefficient includes: When the alarm coefficient is less than or equal to the preset alarm threshold, no real-time theft alarm signal is issued; when the alarm coefficient is greater than the preset alarm threshold, a real-time theft alarm signal is issued.

8. An anti-theft metering box, characterized in that: It also includes an alarm module and a central control panel; wherein the alarm module includes an indicator light, a buzzer and an alarm; the alarm is used to control the indicator light to light up and trigger the buzzer when receiving a real-time theft alarm signal from the central control panel; the central control panel is used to input a password and record the input password data of each decryption process; in the central control panel, the input password data recorded in each decryption process of the anti-theft meter box in a preset historical time period before the current moment is obtained; Determine the degree of change of character input in each decryption process according to the overall deviation of characters between the input password data corresponding to each decryption process and the input password data corresponding to the previous decryption process; The process of obtaining the degree of behavioral abnormality includes: The number of password positions where characters differ between the input password data and the correct password data recorded in each decryption process is taken as the total number of wrong characters in each decryption process; Under each cluster division number, cluster analysis is performed on the input time points of all password positions in the input password data recorded in each decryption process to obtain at least two input password position clusters corresponding to each decryption process under each cluster division number; the cluster division number is an integer and is less than or equal to a preset cluster threshold; the preset cluster threshold is greater than or equal to a positive integer 2; In each decryption process, the input discreteness of each clustering number is determined according to the distribution concentration of the time intervals between the temporally adjacent password positions in each input password position cluster under each clustering number; The number of clusters with the minimum input discreteness corresponding to each decryption process is used as the input frequency of each decryption process; the minimum value of the input discreteness corresponding to each decryption process is used as the reference input speed of each decryption process; the degree of abnormality of the input process of each decryption process is determined according to the reference input speed and the deviation between the input frequency of each decryption process and the input frequency of the previous decryption process; Determine the degree of behavioral abnormality of each decryption process according to the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change of the character input; wherein the degree of abnormality of the input process, the total number of erroneous characters, and the degree of change of the character input are all positively correlated with the degree of behavioral abnormality; The process of obtaining the decrypted abnormal probability includes: Determine the degree of abnormal behavior fluctuation at the current moment according to the variance of the degree of abnormal behavior corresponding to all decryption processes in the preset historical time period corresponding to the current moment; Normalize the product of the average of the behavior abnormality levels corresponding to all decryption processes in the preset historical time period corresponding to the current moment and the behavior abnormality fluctuation level to determine the abnormal probability of decryption at the current moment; Determine the alarm coefficient at the current moment according to the total number of decryption processes in a preset historical time period before the current moment and the probability of abnormal decryption; A real-time theft alarm determination is performed based on the alarm coefficient.

Images