Data processing method of internet of things card, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a data processing method of an Internet of Things card, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring Internet of Things card data in a preset area in a preset statistical period; obtaining a first knowledge graph set and a second knowledge graph set according to the Internet of Things card data, a preset entity type and a preset attribute type; according to the first knowledge graph set and the second knowledge graph set, obtaining an entity pair set of data enhanced entity alignment; inputting a preset domain rule and the entity pair set into the large language model, and obtaining a target entity pair set output by the large language model; generating a plurality of knowledge graph communities according to the target entity pair set, monitoring the Internet of Things cards based on the knowledge graph communities to discover fraudulent Internet of Things cards, performing data enhancement when entity analysis is performed on knowledge graphs, and enabling the coverage range of risk communities to be more comprehensive through a large amount of enhanced data. Therefore, accurate monitoring of the Internet of Things card is realized.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data processing method, electronic device, storage medium and program product for an Internet of Things card. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, IoT devices have been widely used in smart cities, smart homes, industrial control, smart agriculture and other fields, greatly promoting the process of social informatization and intelligence. As the key bridge connecting IoT devices and cloud servers, the security of IoT cards is directly related to the stable operation and data security of the entire IoT system.

[0003] Generally, when improving the anti-fraud capabilities of the Internet of Things, a domain knowledge graph is constructed to achieve a deep understanding and efficient query of the complex relationships in the Internet of Things ecosystem, providing a solid data foundation for Internet of Things anti-fraud.

[0004] After building the knowledge graph, entity resolution maps fuzzy or repeated entities in the original data to clear and unique entities in the knowledge graph to ensure the accuracy and consistency of the data. This process is crucial for identifying abnormal behaviors in the use of IoT cards and associating potential fraudsters and their activity trajectories. Based on the results of entity resolution, possible risk communities can be established. Risk communities refer to a collection of IoT card users, devices or transactions with similar fraud characteristics or behavior patterns. By identifying and monitoring these risk communities, potential fraud activities can be discovered in a timely manner, achieving early warning and precise strikes on risks.

[0005] When establishing a risk community after entity parsing the knowledge graph, a large amount of original data is usually required. The larger the amount of data, the wider and more comprehensive the coverage of the risk community. However, during the current entity parsing, the amount of original data is limited, which makes the coverage of the risk community not comprehensive enough, and thus causes the monitoring of IoT cards to be not accurate enough. Summary of the invention

[0006] The data processing method, electronic device, storage medium and program product of the Internet of Things card provided in the embodiments of the present application perform data enhancement when performing entity parsing on the knowledge graph. The large amount of enhanced data makes the coverage of the risk community more comprehensive, thereby achieving accurate monitoring of the Internet of Things card.

[0007] In a first aspect, an embodiment of the present application provides a data processing method for an Internet of Things card, comprising: obtaining Internet of Things card data in a preset area within a preset statistical period, wherein the Internet of Things card data includes operation data of each Internet of Things card within the statistical period;

[0008] According to the IoT card data, the preset entity type and the preset attribute type, a first knowledge graph set and a second knowledge graph set are obtained, wherein the first knowledge graph in the first knowledge graph set includes structure information, and the second knowledge graph in the second knowledge graph set includes attribute information;

[0009] According to the first knowledge graph set and the second knowledge graph set, obtaining a data-enhanced entity pair set of entity alignment, wherein the entity pair set includes a first entity in the first knowledge graph and a second entity in the second knowledge graph having an entity alignment relationship with the first entity;

[0010] Inputting the preset domain rules and the entity pair set into a large language model, obtaining a target entity pair set output by the large language model, wherein the target entity pair set includes a first entity and a second entity similar to the first entity;

[0011] According to the target entity pair set, multiple knowledge graph communities are generated, and based on the knowledge graph communities, the Internet of Things cards are monitored to discover fraudulent Internet of Things cards.

[0012] In a possible implementation, acquiring the first knowledge graph set and the second knowledge graph set according to the IoT card data, the preset entity type, and the preset attribute type includes:

[0013] Acquire an initial entity according to the IoT card data and a preset entity type; wherein the preset entity type includes an IoT card and a geographic entity, wherein the geographic entity includes a roaming province and a roaming city, and the preset attribute type includes at least one of traffic, a high-risk access number, or a binding change number;

[0014] Extracting attribute information of the initial entity and the relationship between the initial entities according to the initial entity, the preset attribute type and the IoT card data;

[0015] Constructing a first knowledge graph set according to the relationship between the initial entities;

[0016] Construct a second knowledge graph set based on the attribute information of the initial entity.

[0017] In a possible implementation manner, before inputting the preset domain rules and the entity pair set into the large language model, the method further includes:

[0018] According to each entity pair in the entity pair set, obtaining the similarity between the first entity and the second entity according to the cosine similarity algorithm;

[0019] According to the similarity between the first entity and the second entity, for each first entity, obtain the most similar K second entities, where K is an integer;

[0020] According to the first entity and the K second entities, a new entity pair set is obtained;

[0021] The step of inputting the preset domain rules and the entity pair set into the large language model includes:

[0022] The preset domain rules and the new entity pair set are input into the large language model.

[0023] In a possible implementation, inputting the preset domain rules and the entity pair set into a large language model, and obtaining a target entity pair set output by the large language model, includes:

[0024] Inputting preset domain rules into the large language model, wherein the preset domain rules include at least two domain rules, each domain rule is used to indicate whether entity alignment is satisfied between the difference data;

[0025] Input instruction information and a set of entity pairs into a large language model to obtain a target set of entity pairs output by the large language model; wherein the instruction information is used to instruct the large language model to determine the similarity between the first entity and the second entity, and the instruction information is also used to indicate the output content of the large language model.

[0026] In a possible implementation, monitoring the Internet of Things card based on the knowledge graph community to discover fraudulent Internet of Things cards includes:

[0027] Draw the knowledge graph community, and in the knowledge graph community, explicitly mark the entities in the first knowledge graph set and the second knowledge graph set, wherein the entity type is an entity of an Internet of Things card, and its marking color is different from that of other entities;

[0028] Determine the Internet of Things card to be monitored according to the association relationship between the Internet of Things card and other entities or attributes;

[0029] The Internet of Things cards to be monitored are monitored to detect fraudulent Internet of Things cards.

[0030] In a possible implementation, obtaining a data-enhanced entity pair set according to the first knowledge graph set and the second knowledge graph set includes:

[0031] According to the first knowledge graph set and the second knowledge graph set, obtaining a marked alignment entity set;

[0032] Based on the aligned entity set, the entity alignment is enhanced by alternately passing through the TransE component and the pseudo-twin network until the TransE component and the pseudo-twin network no longer predict new aligned entities, thereby obtaining a data-enhanced entity pair set;

[0033] The TransE component is used to learn the structural embedding of entities according to the aligned entity set and the first knowledge graph set to obtain a first aligned entity;

[0034] The pseudo twin network is used to learn the embedding of entities in attribute information based on the aligned entity set and the second knowledge graph set to obtain second aligned entities.

[0035] In a second aspect, an embodiment of the present application provides a data processing device for an Internet of Things card, comprising:

[0036] A data acquisition module, used to acquire the IoT card data in a preset area within a preset statistical period, wherein the IoT card data includes the operation data of each IoT card within the statistical period;

[0037] A graph acquisition module, configured to acquire a first knowledge graph set and a second knowledge graph set according to the IoT card data, a preset entity type, and a preset attribute type, wherein the first knowledge graph in the first knowledge graph set includes structural information, and the second knowledge graph in the second knowledge graph set includes attribute information;

[0038] A data enhancement module, configured to obtain a data-enhanced entity pair set of entity alignment according to the first knowledge graph set and the second knowledge graph set, wherein the entity pair set includes a first entity in the first knowledge graph and a second entity in the second knowledge graph having an entity alignment relationship with the first entity;

[0039] A target entity pair acquisition module, used to input the preset domain rules and the entity pair set into the large language model, and acquire the target entity pair set output by the large language model, wherein the target entity pair set includes the first entity and a second entity similar to the first entity;

[0040] The knowledge graph community generation module is used to generate multiple knowledge graph communities according to the target entity pair set, and monitor the Internet of Things cards based on the knowledge graph communities to detect fraudulent Internet of Things cards.

[0041] In a third aspect, an embodiment of the present application provides a data processing device for an Internet of Things card, including: a memory, a processor;

[0042] The memory stores computer-executable instructions;

[0043] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0044] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0045] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0046] The data processing method, electronic device, storage medium and program product of the Internet of Things card provided in the embodiments of the present application can obtain a first knowledge graph set and a second knowledge graph set through the operation data of the Internet of Things card and the preset entity type, realize data enhancement of entities, and generate an entity pair set after aligning the entities after data enhancement, and obtain a target entity pair set after filtering the entity pair set through a large language model and preset domain rules, and then generate a knowledge graph community according to the target entity pair set. By generating a knowledge graph community after data enhancement of the entities, accurate monitoring of the Internet of Things card can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0048] Figure 1 Schematic diagram of the data processing method of the Internet of Things card provided in this application Figure 1 ;

[0049] Figure 2 Schematic diagram of the data processing method of the Internet of Things card provided in this application Figure 2 ;

[0050] Figure 3 A schematic diagram of the structure of the data processing device of the Internet of Things card provided by this application;

[0051] Figure 4 A schematic diagram of the structure of the data processing device of the Internet of Things card provided in this application.

[0052] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0053] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0054] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0055] In the IoT card anti-fraud model, after building the domain knowledge graph, entity parsing and establishing possible risk communities can improve the recognition accuracy and response speed of IoT card fraud.

[0056] The purpose of entity resolution is to discover multiple entity records belonging to the same group in the real world. Accurate entity resolution methods can aggregate entities with similar or identical features and mine new risk entities, labels, etc.

[0057] In the prior art, when performing entity resolution, the entity is usually existing data, so the number of entities is relatively limited, which makes the radiation range of the risk community relatively limited, and the monitoring accuracy of the Internet of Things card is lacking.

[0058] By performing data enhancement after parsing the existing knowledge graph entities, the entity expansion is achieved, thereby making the generated risk community cover a wider range and achieving accurate monitoring of IoT cards.

[0059] Figure 1 Schematic diagram of the data processing method of the Internet of Things card provided in this application Figure 1 ,like Figure 1 As shown, the method includes:

[0060] S101. Obtain IoT card data in a preset area within a preset statistical period.

[0061] IoT card data includes the operating data of each IoT card during the statistical period.

[0062] The operation data is the operation record of the IoT card on the installed device. The operation data may include the roaming location, traffic, number of high-risk visits, number of binding changes, etc. of the IoT card.

[0063] The operating status of the IoT card can be monitored by the operating data within the statistical period, and the statistical period can be one month, six months or one year.

[0064] S102. Obtain a first knowledge graph set and a second knowledge graph set according to the IoT card data, preset entity types, and preset attribute types.

[0065] By acquiring IoT card data within the statistical period, the IoT card and the corresponding operation data of the IoT card can be obtained, and the operation data can be standardized by cleaning and deduplicating the operation data. The cleaned operation data includes multiple entities, the relationship between entities, and the attributes of the entities.

[0066] According to the preset entity type, entities in the running data can be identified, and the relationships between the entities can be extracted and integrated to generate a first knowledge graph, the first knowledge graph includes structural information, and the structural information is the relationship between the entities. The first knowledge graph set includes the first knowledge graphs of multiple IoT cards.

[0067] According to the preset entity type and the preset attribute type, attribute information of the entity in the running data is extracted, and the entity is used as a node, and the attribute information is used as the attribute or metadata of the node to generate a second knowledge graph, and the second knowledge graph includes the attribute information. The second knowledge graph set includes the second knowledge graphs of multiple IoT cards.

[0068] S103. Obtain a data-enhanced entity pair set of entity alignment according to the first knowledge graph set and the second knowledge graph set.

[0069] Entity alignment can be achieved through the structural information and attribute information in the first knowledge graph and the second knowledge graph, and through continuous iterative expansion training, the structural information and attribute information are complementarily enhanced to achieve the expansion of entity pairs and generate an entity pair set. The entity pair set includes multiple entity pairs, and the entity pair is a first entity in the first knowledge graph and a second entity in the second knowledge graph that has an alignment relationship with the first entity.

[0070] S104: Input the preset domain rules and entity pair set into the large language model to obtain the target entity pair set output by the large language model.

[0071] The target entity pair set includes a plurality of target entity pairs, where the target entity pairs include a first entity and a second entity similar to the first entity.

[0072] The preset domain rule is a rule set according to the corresponding domain. For example, the preset domain rule is "the traffic usage of the IoT card within a certain usage period is within 100M, which is a small traffic scenario". When the traffic usage of the IoT card to be monitored is less than 100M in the same usage period, the attributes of the IoT card to be monitored meet the preset domain rule, and the attributes of the two entities are considered to be the same.

[0073] S105. Generate multiple knowledge graph communities based on the target entity pair set, and monitor the Internet of Things cards based on the knowledge graph communities to discover fraudulent Internet of Things cards.

[0074] The knowledge graph community will connect entities with similar or identical attributes and associations to improve the association between entities, thereby making the monitoring of IoT cards more comprehensive, exploring the potential risks of IoT cards, and improving the security of IoT cards.

[0075] The data processing method of the Internet of Things card provided in the embodiment of the present application performs data enhancement on entities in the first knowledge graph and the second knowledge graph about structural information and attribute information generated by the Internet of Things card data to generate a data-enhanced entity pair set. The data-enhanced entity pair set expands the number of entities in the preset entity type to generate more entity alignment results, and further filters the entity pair set in combination with the preset domain rules and the large language model to generate a target entity pair set to obtain entity alignment results with higher similarity. The expanded and filtered target entity pairs are connected through the risk map community to achieve more comprehensive monitoring of the Internet of Things card, so as to explore the potential risks of the Internet of Things card and improve the security of the Internet of Things card.

[0076] Figure 2 Schematic diagram of the data processing method of the Internet of Things card provided in this application Figure 2 ,like Figure 2 As shown, in this embodiment Figure 1 Based on the embodiment, a data processing method of the Internet of Things card is described in detail, and the method includes:

[0077] S201. Obtain IoT card data in a preset area within a preset statistical period.

[0078] S202. Obtain an initial entity according to the IoT card data and a preset entity type.

[0079] Preset entity types include IoT card and geographic entity.

[0080] Geographic entities include roaming provinces and roaming cities.

[0081] For example, the initial entities are: IoT card, Yunnan, and Kunming.

[0082] The preset attribute type includes at least one of traffic flow, high-risk access times, or binding change times.

[0083] S203: Extract attribute information of the initial entity and the relationship between the initial entities according to the initial entity, the preset attribute type and the IoT card data.

[0084] For example, the attribute information of the initial entity is: Internet of Things Card-Traffic-300M; the relationship between the initial entities is: Internet of Things Card-Roaming Location-Yunnan / Kunming.

[0085] S204. Construct a first knowledge graph set based on the relationships between the initial entities.

[0086] S205. Construct a second knowledge graph set based on the attribute information of the initial entity.

[0087] S206. Obtain a set of marked aligned entities according to the first knowledge graph set and the second knowledge graph set.

[0088] According to the running data, entity alignment and labeling are performed in advance between the initial entities in the first knowledge graph and the second knowledge graph to obtain aligned entities, and the aligned entity set includes multiple aligned entities.

[0089] S207. Based on the aligned entity set, the entity alignment is enhanced by alternately using the TransE component and the pseudo-twin network until the TransE component and the pseudo-twin network no longer predict new aligned entities, thereby obtaining a data-enhanced entity pair set.

[0090] The TransE component is used to learn the structural embedding of entities based on the aligned entity set and the first knowledge graph set to obtain the first aligned entity.

[0091] The pseudo-twin network is used to learn the embedding of entities in attribute information based on the aligned entity set and the second knowledge graph set to obtain the second aligned entity.

[0092] In the TransE model, the known alignment relationship is used to replace the initial entity in the triple in the other knowledge graph with the initial entity in one knowledge graph to form a new triple positive example. The nearest neighbor algorithm is used to replace the second initial entity in the aligned entity pair to generate negative samples, that is, according to the nearest neighbor algorithm, n entities that are most similar to the replaced initial entity cosine are selected as candidate entities for replacement.

[0093] Given a triple (h, r, t)∈S in a knowledge graph, where h, t∈E, r∈R. E and R represent the initial entity set and relationship set in the knowledge graph, respectively, and S represents the triple set in the knowledge graph. In the TransE model, h, r, and t are all represented by a 1-dimensional vector of length k, and it is assumed that for any triple (h, r, t), h+r≈t is satisfied. Based on this assumption, the margin-based objective function is defined as:

[0094]

[0095] Where d(x, y) represents the Euclidean distance between x and y, γ 1 >0,γ 2 >0 indicates a boundary hyperparameter, [x] + It means that when x<0, it takes the value 0. ′ , r ′ , t ′ )∈S ′ Represents a set of triplets after replacing the head entity or tail entity of the triplet, which is a negative sample of the training triplets.

[0096] In the TransE model, positive and negative samples work together in the model training process, promoting the improvement of model performance by defining correct entity relationships, enhancing the model's discrimination ability, improving the model's generalization ability, and avoiding overfitting.

[0097] In each iteration, the TransE component is used to learn entity embedding based on structure, and the pseudo-Siamese network is used to learn entity embedding based on attribute information.

[0098] The pseudo-twin network learns entity embedding representations based on the attribute information of two knowledge graphs, and then uses some trained metrics to evaluate the similarity between entities. It uses a bidirectional GRU unit to extract the character-level features of attribute values, and uses a shared attention matrix to act on attribute types and attribute values ​​to form a joint attention mechanism.

[0099] By calculating the embedding similarity of entity pairs in the first knowledge graph and the second knowledge graph and filtering them using a threshold, all candidate aligned entity pairs are generated in the form of a bipartite graph. Then, the data-enhanced entity pair set is obtained using the best bipartite graph matching algorithm.

[0100] By alternately utilizing structural information and attribute information to align entities, the set of data-enhanced entity pairs can be iteratively expanded.

[0101] For example, if the initial states in the first knowledge graph and the second knowledge graph are:

[0102] Relationship: IoT card A-bound device-smart water meter; IoT card B-bound device-smart electricity meter.

[0103] Attributes: IoT card-ID; IoT card-operator; IoT card-activation date.

[0104] First round of expansion: TransE

[0105] New entities: No new entities are discovered directly, but the TransE model may identify that IoT card A and IoT card B have highly similar traffic usage patterns through the similarity of the vector space.

[0106] New relation: Similar Flow Pattern. The TransE model infers that this relation exists between IoT card A and IoT card B because their traffic usage patterns are close in vector space.

[0107] Second round of expansion: Pseudo-twin network

[0108] New Entity: The pseudo-twin network analyzes the geographic location information of IoT SIM A and IoT SIM B and finds that they are both located in the same commercial area, and there are multiple other IoT SIMs in the area. Therefore, the pseudo-twin network infers a new entity, the Commercial Area IoT SIM Cluster.

[0109] New relationship: Cluster Member. The pseudo-twin network establishes this relationship between IoT card A, IoT card B and the commercial area IoT card cluster, indicating that they are members of the cluster.

[0110] The third round of expansion: TransE (based on new information)

[0111] New relationship: Based on the new entity of the commercial area IoT card cluster, the TransE model can further analyze the traffic usage patterns of the IoT cards in the cluster and find that in addition to the original similar traffic patterns, these IoT cards also show the commonality of high traffic usage in specific time periods (such as 9 am to 5 pm on weekdays). Therefore, the TransE model can infer a new relationship of Peak Hour High Flow and apply it between IoT cards in the cluster.

[0112] Fourth round of expansion: Pseudo-twin network (refinement)

[0113] New relationship: The pseudo-twin network may further analyze the operation data of the IoT card cluster in the commercial area and find that the IoT cards in the cluster also show certain similarities in terms of signal strength, network latency, etc., and these characteristics are greatly affected by the regional environment. Therefore, the pseudo-twin network can refine the region dependency relationship and concretize it into region signal dependency and region network latency dependency to more accurately describe the relationship between the IoT cards in the cluster and the regional environment.

[0114] After alternate expansion by TransE and pseudo-twin networks, the first knowledge graph and the second knowledge graph not only contain the basic information of IoT cards and the binding relationship with the device, but also add entities such as similar traffic patterns, IoT card clusters in commercial areas, and new relationships such as high traffic during peak hours, regional signal dependence, and regional network delay dependence. These newly added entities and relationships expand the first knowledge graph and the second knowledge graph to obtain a data-enhanced entity pair set, which can more comprehensively reflect the operation of IoT cards and their interaction with the environment.

[0115] S208 . According to each entity pair in the entity pair set, the similarity between the first entity and the second entity is obtained according to a cosine similarity algorithm.

[0116] Usually, a first entity corresponds to multiple second entities. By calculating the similarity between the first entity and the second entity, the association result between the entities can be obtained, which is convenient for expanding the entity relationship.

[0117] S209. According to the similarity between the first entity and the second entity, for each first entity, obtain the most similar K second entities, where K is an integer.

[0118] S210: Obtain a new entity pair set according to the first entity and K second entities.

[0119] S211. Input the preset domain rules into the large language model.

[0120] The preset domain rules include at least two domain rules, and each domain rule is used to indicate whether entity alignment is satisfied between the difference data.

[0121] For example, the preset domain rules are: [Domain Rule 1: If the traffic used by the IoT card is less than 100M in one day, it is considered small traffic. Domain Rule 2: If the number of times the device is changed within the past 7 days reaches 10 times, it is considered frequent device changes. Rule N: ...]

[0122] S212: Input the instruction information and the entity pair set into the large language model, and obtain the target entity pair set output by the large language model.

[0123] The instruction information is used to instruct the large language model to determine the similarity between the first entity and the second entity. The instruction information is also used to instruct the output content of the large language model.

[0124] For example, combined with the above preset domain rules, the instruction information is: [Please judge the similarity between the candidate entity and the target entity from the perspective of a language expert, combined with your knowledge and the domain rules I set for you, and output in the following format: {"Is it the same type of entity": "Yes or No", "Reason explanation": "Please write down your thinking process"}].

[0125] Target entity: [Entity type: IoT card, roaming province: Yunnan, roaming city: Kunming, data usage on the day: 30M, number of visits to high-risk areas: 3 times, number of device changes in the past 7 days: 15 times...]

[0126] Candidate entity 1: [Entity type: IoT card, roaming province: Yunnan, roaming city: Kunming, data usage on the day: 70M, number of visits to high-risk areas: 5 times, number of device changes in the past 7 days: 22 times...]

[0127] After inputting the instruction information and the entity pair set into the large language model, the result given by the large language model can be obtained: {“Are they the same type of entity”: Yes, “Reason explanation”: “The target entity and the candidate entity are slightly different in the number of visits to high-risk areas, but according to common sense, they are most likely the same type of entity. First of all, the types of the two entities are consistent. The roaming provinces and cities are exactly the same, which is consistent. The target entity's traffic usage on that day was 30M, while the candidate entity's usage on that day was 70M. According to the expert rules, they both belong to the attribute of small traffic, so the traffic usage is consistent. The number of times the target entity and the candidate entity changed devices in the past 7 days were 15 and 22 respectively. According to the expert rules, both belong to the attribute of frequent device changes, which is consistent. In summary, except for the slightly different number of visits to high-risk areas, other attributes are consistent, and it can be basically determined that the target entity and the candidate entity belong to the same type of entity."}.

[0128] By inputting instruction information and entity pair sets into a large language model and combining them with preset domain rules, matching and screening of target entity pairs can be achieved.

[0129] S213. Draw a knowledge graph community based on the target entity pair set, and explicitly mark the entities in the first knowledge graph set and the second knowledge graph set in the knowledge graph community.

[0130] The entity type is IoT card, and its marking color is different from other entities.

[0131] For example, in the first knowledge graph and the second knowledge graph,

[0132] Entity: IoT card;

[0133] Attributes: Activation date - January 1, 2000; Traffic: 1G; Device type: smart water meter, smart electricity meter, smart security camera;

[0134] Relationship: Binding device;

[0135] After the expansion of TransE and pseudo-twin network, new relationships or new entities can be obtained. New entities can be high-traffic IoT cards (if an IoT card continuously shows high-traffic usage characteristics, the TransE model may infer that this is a new entity category representing IoT cards with high traffic demand by comparing its traffic usage pattern with other IoT cards), clusters of IoT cards in a specific area (the pseudo-twin network may analyze the geographic location information of multiple IoT cards and find that they are concentrated in a specific area and show similar operating characteristics (such as network latency, signal strength, etc.). Based on this information, the pseudo-twin network can infer a new entity); new relationships can be similar traffic patterns (if multiple IoT cards show similar patterns in traffic usage (such as peak hours, periodic changes, etc.), the TransE model can learn these patterns and infer that there is a "similar traffic pattern" relationship between these IoT cards), regional dependence (if the pseudo-twin network finds that the performance of an IoT card (such as data transmission speed, connection stability) is highly correlated with other IoT cards in its area, then it can be inferred that there is a "regional dependence" relationship between these IoT cards, that is, their performance is affected by common regional factors).

[0136] Assume that an IoT SIM Card (IoT SIM Card A) is bound to a smart security camera in a commercial area in City A. Through the TransE model, the traffic usage pattern of IoT SIM Card A is very similar to that of another IoT SIM Card (IoT SIM Card B) bound to a smart meter, both showing the characteristics of lower traffic at night and higher traffic during the day. Therefore, we can infer that there is a "similar traffic pattern" relationship between IoT SIM Card A and IoT SIM Card B.

[0137] At the same time, the pseudo-twin network may analyze the geographic location information and operation data of IoT SIM Card A and find that it exhibits similar characteristics with multiple other IoT cards in the commercial area (such as IoT SIM Card C, D, etc.) in terms of signal strength, network delay, etc. Based on this information, the pseudo-twin network can infer a new entity - "commercial area IoT card cluster", and add IoT SIM Card A, B, C, D, etc. to this cluster, while establishing a "regional dependency" relationship between them.

[0138] The knowledge graph community not only includes the structural and attribute information of entities in the first knowledge graph and the second knowledge graph, but also expands more entities and relationships, improving the coverage and accuracy of the risk community.

[0139] By explicitly marking the entities in the first knowledge graph set and the second knowledge graph set, it is convenient to accurately judge and distinguish the association relationship of IoT cards.

[0140] S214: Determine the Internet of Things card to be monitored according to the association relationship between the Internet of Things card and other entities or attributes.

[0141] S215. Monitor the IoT cards to be monitored to detect fraudulent IoT cards.

[0142] The data processing method of the Internet of Things card provided in the embodiment of the present application performs data enhancement on the initial entities in the Internet of Things card data through the TransE component and the pseudo-twin network to generate a data-enhanced entity pair set. The data-enhanced entity pair set facilitates a wider discovery of the association between entities and a more comprehensive risk mining of the Internet of Things card. The difference data is indicated by preset domain rules, and the entity alignment is performed based on the preset domain rules through a large language model. The similarity between the entities after data enhancement is further screened to make the knowledge graph community more comprehensive and accurate. By labeling the Internet of Things cards and entities, it is convenient to distinguish the relationship between entities or the attributes of entities, so as to clearly discover the association role of entities in the knowledge graph community, so as to monitor the Internet of Things to be detected and discover fraudulent Internet of Things cards.

[0143] Figure 3 A schematic diagram of the structure of the data processing device of the Internet of Things card provided in this application, such as Figure 3 As shown, the data processing device 30 of the Internet of Things card provided in this embodiment includes:

[0144] The data acquisition module 301 is used to acquire the Internet of Things card data in a preset area within a preset statistical period, wherein the Internet of Things card data includes the operation data of each Internet of Things card within the statistical period.

[0145] The graph acquisition module 302 is used to acquire a first knowledge graph set and a second knowledge graph set according to IoT card data, preset entity types and preset attribute types, wherein the first knowledge graph in the first knowledge graph set includes structural information, and the second knowledge graph in the second knowledge graph set includes attribute information.

[0146] The data enhancement module 303 is used to obtain a data-enhanced entity-aligned entity pair set based on the first knowledge graph set and the second knowledge graph set, wherein the entity pair set includes a first entity in the first knowledge graph and a second entity in the second knowledge graph that has an entity alignment relationship with the first entity.

[0147] The target entity pair acquisition module 304 is used to input the preset domain rules and the entity pair set into the large language model, and obtain the target entity pair set output by the large language model, where the target entity pair set includes the first entity and the second entity similar to the first entity.

[0148] The knowledge graph community generation module 305 is used to generate multiple knowledge graph communities according to the target entity pair set, and monitor the Internet of Things cards based on the knowledge graph communities to detect fraudulent Internet of Things cards.

[0149] The data processing device for the Internet of Things card provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0150] Figure 4 This is a schematic diagram of the structure of the data processing device of the Internet of Things card provided in this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the device 40 also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus 404.

[0151] In a specific implementation process, at least one processor 401 executes the computer-executable instructions stored in the memory 402, so that at least one processor 401 executes the above method.

[0152] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0153] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0154] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0155] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0156] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0157] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0158] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0159] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0160] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0161] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0162] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0163] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0164] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0165] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A data processing method for an Internet of Things card, characterized in that: include: Acquire the Internet of Things card data in a preset area within a preset statistical period, wherein the Internet of Things card data includes the operation data of each Internet of Things card within the statistical period; According to the IoT card data, the preset entity type and the preset attribute type, a first knowledge graph set and a second knowledge graph set are obtained, wherein the first knowledge graph in the first knowledge graph set includes structure information, and the second knowledge graph in the second knowledge graph set includes attribute information; According to the first knowledge graph set and the second knowledge graph set, obtaining a data-enhanced entity pair set of entity alignment, wherein the entity pair set includes a first entity in the first knowledge graph and a second entity in the second knowledge graph having an entity alignment relationship with the first entity; Inputting the preset domain rules and the entity pair set into a large language model, obtaining a target entity pair set output by the large language model, wherein the target entity pair set includes a first entity and a second entity similar to the first entity; According to the target entity pair set, multiple knowledge graph communities are generated, and based on the knowledge graph communities, the Internet of Things cards are monitored to discover fraudulent Internet of Things cards.

2. The method according to claim 1, characterized in that: The obtaining of the first knowledge graph set and the second knowledge graph set according to the IoT card data, the preset entity type and the preset attribute type includes: Acquire an initial entity according to the IoT card data and a preset entity type; wherein the preset entity type includes an IoT card and a geographic entity, wherein the geographic entity includes a roaming province and a roaming city, and the preset attribute type includes at least one of traffic, a high-risk access number, or a binding change number; Extracting attribute information of the initial entity and the relationship between the initial entities according to the initial entity, the preset attribute type and the IoT card data; Constructing a first knowledge graph set according to the relationship between the initial entities; Construct a second knowledge graph set based on the attribute information of the initial entity.

3. The method according to claim 2, characterized in that Before inputting the preset domain rules and the entity pair set into the large language model, the method further includes: According to each entity pair in the entity pair set, obtaining the similarity between the first entity and the second entity according to the cosine similarity algorithm; According to the similarity between the first entity and the second entity, for each first entity, obtain the most similar K second entities, where K is an integer; According to the first entity and the K second entities, a new entity pair set is obtained; The step of inputting the preset domain rules and the entity pair set into the large language model includes: The preset domain rules and the new entity pair set are input into the large language model.

4. The method according to claim 1, characterized in that: The step of inputting the preset domain rules and the entity pair set into the large language model and obtaining the target entity pair set output by the large language model includes: Inputting preset domain rules into the large language model, wherein the preset domain rules include at least two domain rules, each domain rule is used to indicate whether entity alignment is satisfied between the difference data; Input instruction information and a set of entity pairs into a large language model to obtain a target set of entity pairs output by the large language model; wherein the instruction information is used to instruct the large language model to determine the similarity between the first entity and the second entity, and the instruction information is also used to indicate the output content of the large language model.

5. The method according to claim 1, characterized in that The monitoring of the IoT card based on the knowledge graph community to discover fraudulent IoT cards includes: Draw the knowledge graph community, and in the knowledge graph community, explicitly mark the entities in the first knowledge graph set and the second knowledge graph set, wherein the entity type is an entity of an Internet of Things card, and its marking color is different from that of other entities; Determine the Internet of Things card to be monitored according to the association relationship between the Internet of Things card and other entities or attributes; The Internet of Things cards to be monitored are monitored to detect fraudulent Internet of Things cards.

6. The method according to claim 1, characterized in that The step of obtaining a data-enhanced entity pair set according to the first knowledge graph set and the second knowledge graph set includes: According to the first knowledge graph set and the second knowledge graph set, obtaining a marked alignment entity set; Based on the aligned entity set, the entity alignment is enhanced by alternately passing through the TransE component and the pseudo-twin network until the TransE component and the pseudo-twin network no longer predict new aligned entities, thereby obtaining a data-enhanced entity pair set; The TransE component is used to learn the structural embedding of entities according to the aligned entity set and the first knowledge graph set to obtain a first aligned entity; The pseudo twin network is used to learn the embedding of entities in attribute information based on the aligned entity set and the second knowledge graph set to obtain second aligned entities.

7. A data processing device for an Internet of Things card, characterized in that: include: A data acquisition module, used to acquire the IoT card data in a preset area within a preset statistical period, wherein the IoT card data includes the operation data of each IoT card within the statistical period; A graph acquisition module is used to acquire a first knowledge graph set and a second knowledge graph set according to the IoT card data, the preset entity type and the preset attribute type, wherein the first knowledge graph in the first knowledge graph set includes structural information, and the second knowledge graph in the second knowledge graph set includes attribute information A data enhancement module, configured to obtain a data-enhanced entity pair set of entity alignment according to the first knowledge graph set and the second knowledge graph set, wherein the entity pair set includes a first entity in the first knowledge graph and a second entity in the second knowledge graph having an entity alignment relationship with the first entity; A target entity pair acquisition module, used to input the preset domain rules and the entity pair set into the large language model, and acquire the target entity pair set output by the large language model, wherein the target entity pair set includes the first entity and a second entity similar to the first entity; The knowledge graph community generation module is used to generate multiple knowledge graph communities according to the target entity pair set, and monitor the Internet of Things cards based on the knowledge graph communities to detect fraudulent Internet of Things cards.

8. A data processing device for an Internet of Things card, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images