Abnormal terminal detection method and device, electronic equipment and computer program product

Abstract

The invention discloses an abnormal terminal detection method and device, electronic equipment and a computer program product. The method comprises the following steps: acquiring a plurality of pieces of historical user context information comprising terminal numbers and user identification card numbers in a preset time period through a core network; in the multiple pieces of historical user context information, determining the historical user context information of which the terminal number belongs to the target terminal number category as to-be-detected user context information; counting the quantity of to-be-detected user context information with the same terminal number and different user identification card numbers to obtain a first information quantity; and under the condition that the first information quantity exceeds a preset quantity threshold value, determining the terminal number in the to-be-detected user context information as an abnormal terminal number, and determining abnormal information based on the to-be-detected user context information. According to the invention, the technical problem that an abnormal terminal and an abnormal user identification card number cannot be identified under the condition that telephone traffic and flow are not generated is solved.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a method, device, electronic equipment and computer program product for detecting an abnormal terminal. Background Art

[0002] With economic development, people's material needs continue to grow. Many people, in pursuit of higher living standards and wealth, are exploiting this psychology to engage in unusual activities. Currently, Facetime failures are a high incidence of crimes, accounting for over 70% of all cases.

[0003] The main difficulty in its governance lies in that, compared with previous methods of committing crimes, Facetime only requires a domestic accomplice to provide an Apple ID with a mobile phone number.

[0004] During the crime, the domestic accomplice provided the Apple ID login verification code. After the foreign criminal logged in, he made a Facetime call. The traffic was only inbound traffic, and monitoring it could only monitor potential victims, not take any action.

[0005] At the same time, as an Apple ID registration card, it only needs to be able to access the Internet and use a single-stop card to commit crimes, which increases the difficulty of control.

[0006] For domestic cards, only SMS verification codes need to be received, which will not generate any calls or traffic, making it difficult to locate and trace the source. What's more, the registration SMS messages use Apple's IMassage service, which is not sent through the SMS interface, making it even more difficult to investigate.

[0007] Therefore, when a terminal only uses a SIM card (ie, a subscriber identification card number) to access a network without generating any traffic or flow, it is impossible to identify an abnormal terminal and subscriber identification card number.

[0008] Currently, no effective solution has been proposed to the above-mentioned problem of being unable to identify abnormal terminals and user identification card numbers without generating call traffic and flow. Summary of the Invention

[0009] The embodiments of the present invention provide a method, device, electronic device and computer program product for detecting abnormal terminals, so as to at least solve the technical problem of being unable to identify abnormal terminals and user identification card numbers without generating traffic and flow.

[0010] According to one aspect of an embodiment of the present invention, a method for detecting an abnormal terminal is provided, comprising: obtaining, through a core network, multiple historical user context information within a preset time period, wherein the historical user context information includes at least a terminal number and a user identification card number; determining, among the multiple historical user context information, the historical user context information whose terminal number belongs to a target terminal number category as user context information to be detected; counting the number of user context information to be detected that has the same terminal number but different user identification card numbers to obtain a first number of information; and, if the first number of information exceeds a preset number threshold, determining the terminal number in the user context information to be detected as an abnormal terminal number, and determining abnormal information based on the user context information to be detected, wherein the abnormal information includes at least an abnormal user identification card number, the abnormal user identification card number being a user identification card number in the same user context information to be detected as the abnormal terminal number.

[0011] Optionally, counting the number of the user context information to be detected with the same terminal number and different user identification card numbers to obtain the first information quantity includes: merging multiple user context information to be detected with the same terminal number to obtain user context merge information, wherein each user context merge information includes at least: the terminal number, and at least one user identification card number corresponding to the terminal number; counting the number of different user identification card numbers in the user context merge information to obtain the card number number; and determining the card number number as the first information quantity.

[0012] Optionally, the method further includes: when the quantity of the first information exceeds the preset quantity threshold, based on the user context information to be detected with the same terminal number and different user identification card numbers, identifying multiple user identification card numbers corresponding to each terminal number; identifying the number location corresponding to each user identification card number, and determining the pre-detection risk value corresponding to each user identification card number based on the preset risk value recorded in a preset risk assignment table for the number location, wherein the preset risk assignment table is used to record the correspondence between the preset risk value and the number location; based on the pre-detection risk values ​​corresponding to multiple user identification card numbers corresponding to the same terminal number, statistically calculating the risk parameters of each terminal number, wherein the risk parameters include at least: an average risk value of multiple pre-detection risk values, and a risk dispersion coefficient of multiple preset risk values; when the risk parameters meet the preset risk conditions, determining the terminal number as the abnormal terminal number, and determining the abnormal information based on the abnormal terminal number, wherein when the average risk value is greater than the preset risk value and the risk dispersion coefficient is within a preset discrete interval, it is determined that the risk parameter meets the preset risk conditions.

[0013] Optionally, the historical user context information also includes: a card insertion base station identifier, wherein the card insertion base station identifier is a unique identifier of a base station to which a terminal using the user identification card accesses. After determining, among the multiple historical user context information, the historical user context information whose terminal number belongs to a target terminal number category as user context information to be detected, the method further includes: determining the user context information to be detected having the same card insertion base station identifier and a different terminal number as pre-detection user context information belonging to a target base station identifier, wherein the card insertion base station identifier includes the target base station identifier; counting a second number of pieces of pre-detection user context information and a third number of pieces of pre-detection user context information including the abnormal terminal number; determining, when a ratio of the third number of pieces of information to the second number of pieces of information exceeds a preset ratio threshold, the target base station identifier as an abnormal base station identifier; and placing the abnormal base station identifier into the abnormal information.

[0014] Optionally, when the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, after determining that the target base station identifier is an abnormal base station identifier, the method further includes: searching for the target base station geographic information corresponding to the abnormal base station identifier among multiple preset base station geographic information recorded in the preset base station geographic information table, wherein the preset base station geographic information table is used to record the correspondence between the card-inserted base station identifier and the preset base station geographic information, and the preset base station geographic information is used to indicate the position of the base station corresponding to the card-inserted base station identifier in the geographic coordinate system.

[0015] Optionally, the historical user context information also includes: a card insertion cell index value, wherein the card insertion cell index value is a unique identifier of the communication cell accessed by the terminal using the user identification card, and the method also includes: determining the user context information to be detected including the abnormal terminal number as abnormal user context information; determining the card insertion cell index value in the abnormal user context information as the abnormal cell index value; and placing the abnormal cell index value into the abnormal information.

[0016] Optionally, after determining the insertion cell index value in the abnormal user context information as the abnormal cell index value, the method further includes: searching for the target cell geographic information corresponding to the abnormal cell index value in the multiple preset cell geographic information recorded in the preset cell geographic information table, wherein the preset cell geographic information table is used to record the correspondence between the insertion cell index value and the preset cell geographic information, and the preset cell geographic information is used to indicate the position of the communication cell corresponding to the insertion cell index value in the geographic coordinate system.

[0017] According to another aspect of an embodiment of the present invention, a device for detecting an abnormal terminal is provided, comprising: an acquisition module configured to acquire, through a core network, multiple historical user context information within a preset time period, wherein the historical user context information includes at least a terminal number and a user identification card number; a first determination module configured to determine, from the multiple historical user context information, the historical user context information whose terminal number belongs to a target terminal number category as user context information to be detected; a counting module configured to count the number of user context information to be detected having the same terminal number but different user identification card numbers to obtain a first number of information; and a second determination module configured to determine, if the first number of information exceeds a preset number threshold, the terminal number in the user context information to be detected as an abnormal terminal number, and to determine abnormal information based on the user context information to be detected, wherein the abnormal information includes at least an abnormal user identification card number, the abnormal user identification card number being a user identification card number in the same user context information to be detected as the abnormal terminal number.

[0018] According to another aspect of an embodiment of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned abnormal terminal detection method through the computer program.

[0019] According to another aspect of an embodiment of the present invention, a computer program product is provided, comprising computer instructions, which implement the steps of the above abnormal terminal detection method when executed by a processor.

[0020] In the above-described embodiments of the present application, even if a terminal serves only as a message receiver, it will still send user context information including at least the terminal number and the subscriber identification card number to the core network during the network access phase without generating traffic or data. The core network stores the user context information sent by each terminal as historical user context information. Since abnormal terminals need to obtain multiple verification code messages based on subscriber identification card registration, abnormal terminals may frequently switch subscriber identification cards within a short period of time. Therefore, by counting historical user context information received by the core network within a preset time period, a correspondence between terminal numbers and subscriber identification card numbers can be obtained. Furthermore, the terminal numbers of the same terminal that frequently switches subscriber identification card numbers within the preset time period can be counted to obtain the abnormal terminal number. Based on the historical user context information including the abnormal terminal number, the abnormal information is determined from the multiple historical user context information received by the core network. Thus, even when only the subscriber identification card number is used for network access without generating traffic or data, the technical effect of accurately identifying abnormal terminal numbers and abnormal subscriber identification card numbers can be achieved, thereby resolving the technical problem of being unable to identify abnormal terminals and subscriber identification card numbers without generating traffic or data. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0022] Figure 1 is a flow chart of a method for detecting abnormal terminals according to an embodiment of the present invention;

[0023] Figure 2 is a schematic diagram of a terminal accessing a core network according to an embodiment of the present invention;

[0024] Figure 3 is a schematic diagram of determining a tracking area based on a core network according to an embodiment of the present invention;

[0025] Figure 4 is a schematic diagram of communication between a terminal and a packet data network according to an embodiment of the present invention;

[0026] Figure 5 2 is a schematic diagram of an abnormal Facetime detection process based on a 5G core network UE context according to an embodiment of the present invention;

[0027] Figure 6 2 is a schematic diagram of a practical application of abnormal Facetime detection based on 5G core network UEcontext according to an embodiment of the present invention;

[0028] Figure 7 is a schematic diagram of a verification result of a detection result according to an embodiment of the present invention;

[0029] Figure 8 is a schematic diagram of a device for detecting abnormal terminals according to an embodiment of the present invention;

[0030] Figure 9 It is a structural block diagram of a computer terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] According to an embodiment of the present invention, an embodiment of a method for detecting an abnormal terminal is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] Figure 1 FIG. 1 is a flow chart of a method for detecting abnormal terminals according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0035] Step S102: acquiring, through the core network, a plurality of historical user context information within a preset time period, wherein the historical user context information includes at least: a terminal number and a user identification card number;

[0036] Step S104, among the multiple historical user context information, the historical user context information whose terminal number belongs to the target terminal number category is determined as the user context information to be detected;

[0037] Step S106, counting the number of user context information to be detected with the same terminal number but different user identification card numbers to obtain a first number of information;

[0038] Step S108: When the number of first information exceeds a preset number threshold, the terminal number in the user context information to be detected is determined as an abnormal terminal number, and abnormal information is determined based on the user context information to be detected, wherein the abnormal information at least includes: an abnormal user identification card number, and the abnormal user identification card number is a user identification card number in the same user context information to be detected as the abnormal terminal number.

[0039] In the above-described embodiments of the present application, even if a terminal serves only as a message receiver, it will still send user context information including at least the terminal number and the subscriber identification card number to the core network during the network access phase without generating traffic or data. The core network stores the user context information sent by each terminal as historical user context information. Since abnormal terminals need to obtain multiple verification code messages based on subscriber identification card registration, abnormal terminals may frequently switch subscriber identification cards within a short period of time. Therefore, by counting historical user context information received by the core network within a preset time period, a correspondence between terminal numbers and subscriber identification card numbers can be obtained. Furthermore, the terminal numbers of the same terminal that frequently switches subscriber identification card numbers within the preset time period can be counted to obtain the abnormal terminal number. Based on the historical user context information including the abnormal terminal number, the abnormal information is determined from the multiple historical user context information received by the core network. Thus, even when only the subscriber identification card number is used for network access without generating traffic or data, the technical effect of accurately identifying abnormal terminal numbers and abnormal subscriber identification card numbers can be achieved, thereby resolving the technical problem of being unable to identify abnormal terminals and subscriber identification card numbers without generating traffic or data.

[0040] In the above step S102, the terminal number is the unique identifier of the terminal, and the user identification card number is the unique card number of the SIM card inserted into the terminal. After the terminal inserts the SIM card and turns on, it will send a network access request to the core network to obtain the right to access the core network, and the user context information UEcontex can be carried in the network access request.

[0041] It's important to note that traditional mobile phones (terminals) search for base stations and establish network authentication after inserting a SIM card. However, when the phone is turned off or switched to airplane mode, there's a network exit signaling. Simply removing the SIM card eliminates this signaling. (Moving between base stations eliminates the need for re-registration because the network retains the UE Context and data.) Therefore, based on the 5G core network's UE context data, card insertion behavior can be identified by identifying the same terminal with different SIM card numbers in the registration information.

[0042] In the above step S102, the core network can receive network access requests sent by multiple terminals, thereby obtaining user context information of the multiple terminals. Then, the core network can add a receiving timestamp of the user context information to each user context information and store it to obtain historical user context information of the multiple terminals.

[0043] In the above step S102, the terminal number can be used to extract the terminal type to which the terminal belongs. Terminal numbers with different terminal types can belong to different terminal categories. Among them, the terminal types can at least include: Android terminals and Apple terminals, and the terminal number categories also include at least: Android terminal numbers and Apple terminal numbers.

[0044] Optionally, the target terminal number category may be an Apple-type terminal number.

[0045] It should be noted that this application is mainly aimed at the Facetime service of Apple terminals, and detects the behavior of a single terminal frequently registering for the Facetime service. Since the Facetime service needs to be registered based on the user identification card number, and the terminal needs to receive the registration information of the user identification card number, before performing the specific detection steps, the terminal number can be classified according to the terminal number category to which it belongs, and the terminal number belonging to the target terminal number category can be determined. The historical user context information including the terminal number is then used as the user context information to be detected, and then further detection is performed. This can reduce the amount of user context information that needs to be detected and improve detection efficiency.

[0046] As an optional example, in the Facetime business, Apple will verify whether the terminal is inserted with a card (that is, whether the SIM card is inserted). Therefore, in order to more conveniently register AppleIDs in large quantities, a small number of terminals are usually used to match a large number of mobile phone cards (that is, SIM cards) for registration. Therefore, during the registration process, it is necessary to constantly change the mobile phone cards and provide login verification codes for different AppleIDs.

[0047] Figure 2 Schematic diagram of a terminal accessing a core network according to an embodiment of the present invention. Figure 2 As shown, the terminal performs RRC (Radio Resource Control) control through NR (Radio Access Technology New Radio).

[0048] It should be noted that RRC controls the connection between the terminal UE and the base station gNB and is responsible for configuring and controlling other layers of the access network protocol stack.

[0049] It should be noted that RRC-IDLE—>modem low power consumption state only periodically monitors the control signals sent by the network side, and the network side does not allocate time and frequency resources.

[0050] It should be noted that RRC-CONNECTED is a high-power modem state, transmitting data or waiting for data. The network side allocates dedicated time and frequency resources on a specific channel.

[0051] It should be noted that RRC-INACTIVE—>modem low power consumption state and modem high power consumption state have both, with low control plane latency (Context), high system capacity (small packet long link), low terminal power consumption (DRX / PAGE / CSR), and less signaling overhead (RNA / Context).

[0052] Figure 3 FIG. 1 is a schematic diagram of determining a tracking area based on a core network according to an embodiment of the present invention. Figure 3 As shown, based on the core network structure, the tracking area, registration area and wireless notification area can be determined.

[0053] It should be noted that TA-Tracking Area, UE range at the core network level, and AMF management are inherited from 4G.

[0054] It should be noted that RA-Registration Area, the UE location range from the core network perspective, is a TA list, directly associated with the registration management module, managed by the AMF, and used for CN paging.

[0055] It should be noted that RNA, or Radio Notification Area, is the UE location range from the access network's perspective. It is managed by the gNB and is used for RAN paging in the RRC-INACTIVE state. Generally, a subset of the TA remains consistent with the TA.

[0056] Figure 4 FIG. 1 is a schematic diagram of communication between a terminal and a packet data network according to an embodiment of the present invention. Figure 4 As shown, the specific steps include:

[0057] Step S401, N2-NG is established.

[0058] Step S402: Air interface-SRB / RRC establishment.

[0059] Step S403: N1-NAS is established.

[0060] Step S404, registering the management path (authentication), as shown by the blue line.

[0061] Step S405, session management path (surfing the Internet), as shown by the red line.

[0062] Step S406: N3-GTPU is established.

[0063] Step S407: air interface-DRB / RRC reconfiguration.

[0064] As an optional embodiment, counting the number of user context information to be detected that has the same terminal number but different user identification card numbers to obtain the first information quantity includes: merging multiple user context information to be detected that has the same terminal number to obtain user context merge information, wherein each user context merge information includes at least: a terminal number and at least one user identification card number corresponding to the terminal number; counting the number of different user identification card numbers in the user context merge information to obtain the card number number; and determining the card number number as the first information quantity.

[0065] In the above embodiment of the present application, when counting the number of user context information to be detected with the same terminal number but different user identification card numbers, multiple user context information to be detected with the same terminal number can be merged to obtain user context merge information, and then the number of different user identification card numbers can be counted in the user context merge information, and the number of card numbers with different user identification card numbers can be counted. Since the number of card numbers and the first information number can both represent the number of behaviors of the same terminal using different user identification card numbers to register for network access, the number of card numbers can be used as the first information number, and then based on the first information number, the behavior of the same terminal using multiple different user identification card numbers to register can be identified.

[0066] Optionally, the terminal number and the user identification card number in the same historical user context information (or the user context information to be detected) are terminal numbers and user identification card numbers that have a corresponding relationship.

[0067] As an optional embodiment, the method also includes: when the amount of first information exceeds a preset quantity threshold, based on the context information of the user to be detected with the same terminal number and different user identification card numbers, identifying multiple user identification card numbers corresponding to each terminal number; identifying the number location corresponding to each user identification card number, and determining the pre-detection risk value corresponding to each user identification card number based on the preset risk value recorded in the preset risk assignment table for the number location, wherein the preset risk assignment table is used to record the correspondence between the preset risk value and the number location; based on the pre-detection risk values ​​corresponding to multiple user identification card numbers corresponding to the same terminal number, statistically calculating the risk parameters of each terminal number, wherein the risk parameters include at least: the average risk value of multiple pre-detection risk values, and the risk dispersion coefficient of multiple preset risk values; when the risk parameters meet the preset risk conditions, determining the terminal number as an abnormal terminal number, and determining abnormal information based on the abnormal terminal number, wherein when the average risk value is greater than the preset risk value and the risk dispersion coefficient is within the preset discrete interval, determining that the risk parameter meets the preset risk conditions.

[0068] In the above embodiment of the present application, each user identification card number has a corresponding number location, and user identification card numbers in different number locations have different risk levels. For example, a certain number location has more user identification card numbers that perform abnormal registrations, while a certain number location has fewer user identification card numbers that perform abnormal registrations. Therefore, according to the abnormal registration behavior in historical abnormal registration events, a different pre-detection risk value can be assigned to each number location, and a preset risk assignment table can be formed. Then, when identifying abnormal terminals (that is, determining abnormal terminal numbers), risk assessment can be performed on multiple user identification card numbers corresponding to the same terminal number based on the preset risk assignment table to obtain the risk parameters of the terminal number. According to the risk parameters, the abnormal terminal number can be identified more accurately.

[0069] As an optional embodiment, the historical user context information also includes: a card insertion base station identifier, wherein the card insertion base station identifier is a unique identifier of the base station to which the terminal using the user identification card accesses. After determining, among multiple historical user context information, the historical user context information whose terminal number belongs to the target terminal number category as the user context information to be detected, the method also includes: determining the user context information to be detected with the same card insertion base station identifier but different terminal numbers as pre-detection user context information belonging to the target base station identifier, wherein the card insertion base station identifier includes the target base station identifier; counting the second information quantity of the pre-detection user context information and the third information quantity of the pre-detection user context information including the abnormal terminal number; when the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, determining the target base station identifier as an abnormal base station identifier; and placing the abnormal base station identifier into the abnormal information.

[0070] In the above embodiment of the present application, the historical user context information also includes: the card insertion base station identifier. After determining the abnormal terminal number, the base station to which the abnormal terminal number is concentratedly accessed can be further determined based on the user context information to be detected used to determine the abnormal terminal number, and the abnormal base station identifier of the base station can be obtained, and then the abnormal base station identifier is put into the abnormal information report. Subsequently, the concentrated activity area of ​​the abnormal terminal number can be further locked based on the abnormal information.

[0071] It should be noted that the user context information to be detected is determined based on the historical user context information. Therefore, when the historical user context information includes the card-inserted base station identifier, the user context information to be detected also includes the card-inserted base station identifier.

[0072] As an optional embodiment, when the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, after determining that the target base station identifier is an abnormal base station identifier, the method also includes: searching for the target base station geographic information corresponding to the abnormal base station identifier among multiple preset base station geographic information recorded in the preset base station geographic information table, wherein the preset base station geographic information table is used to record the correspondence between the card-inserted base station identifier and the preset base station geographic information, and the preset base station geographic information is used to indicate the position of the base station corresponding to the card-inserted base station identifier in the geographic coordinate system.

[0073] In the above embodiment of the present application, by querying the target base station geographic information corresponding to the abnormal base station identifier through the preset base station geographic information table, the geographical location where the abnormal terminal numbers appear in a concentrated manner can be determined, thereby facilitating the tracking of the geographical location where the abnormal terminal numbers are located.

[0074] As an optional embodiment, the historical user context information also includes: a card insertion cell index value, wherein the card insertion cell index value is a unique identifier of the communication cell accessed by the terminal using the user identification card, and the method also includes: determining the user context information to be detected including the abnormal terminal number as abnormal user context information; determining the card insertion cell index value in the abnormal user context information as the abnormal cell index value; and placing the abnormal cell index value into the abnormal information.

[0075] In the above embodiment of the present application, the historical user context information also includes: an insertion cell index value. After determining the abnormal terminal number, the communication cell to which the abnormal terminal number accesses can be further determined based on the user context information to be detected used by the abnormal terminal number, and the abnormal cell index value of the communication cell can be obtained. The abnormal cell index value is then put into the abnormal information report, and the communication behavior of the abnormal terminal number can be further managed based on the abnormal cell index value.

[0076] It should be noted that the user context information to be detected is determined based on the historical user context information. Therefore, when the historical user context information includes the inserted cell index value, the user context information to be detected also includes the inserted cell index value.

[0077] As an optional embodiment, after determining the insertion cell index value in the abnormal user context information as the abnormal cell index value, the method also includes: searching for the target cell geographic information corresponding to the abnormal cell index value in the multiple preset cell geographic information recorded in the preset cell geographic information table, wherein the preset cell geographic information table is used to record the correspondence between the insertion cell index value and the preset cell geographic information, and the preset cell geographic information is used to indicate the position of the communication cell corresponding to the insertion cell index value in the geographic coordinate system.

[0078] In the above embodiment of the present application, by querying the target cell geographic information corresponding to the abnormal cell index value through the preset cell geographic information table, the geographical area where the abnormal terminal number set is located can be determined, thereby facilitating tracking of the geographical area where the abnormal terminal number is located.

[0079] As an optional example, the terminal may be a mobile terminal, which switches the accessed communication cell during the movement. For example, during the movement of the terminal, the terminal will switch from a certain communication cell to a communication cell adjacent to the communication cell. Therefore, in the historical user context information stored in the core network, there may be historical user context information with the same terminal number and the same user identification card number, but different card insertion cell index values ​​or card insertion base station identifiers. Then, when it is determined that the terminal number is an abnormal terminal number and the user identification card number is an abnormal user identification card number, the historical user context information with different card insertion cell index values ​​or card insertion base station identifiers can be clustered to determine the main activity base station or communication cell of the abnormal terminal number or abnormal user identification card number, so that the abnormal terminal number or abnormal user identification card number can be managed and tracked more accurately.

[0080] The present invention also provides an optional embodiment, which provides a method for detecting abnormal Facetime based on the 5G core network UE context. From a social engineering perspective, it uses the NAS layer registration request carried by the RRCSetupComplete signaling in the RRC link established between the terminal and the base station (gNB) to analyze the registration authentication data of the UE context to discover the Facetime terminal, card number and location.

[0081] Figure 5 FIG. 1 is a schematic diagram of an abnormal Facetime detection process based on 5G core network UEcontext according to an embodiment of the present invention. Figure 5 As shown, the steps include:

[0082] Step S51: Data collection.

[0083] Specifically, the UEcontext data of the past week (i.e., historical user context information) is obtained through the 5G core network SEQ, and the terminal number (IMEI), card insertion number / registration number (i.e., user identification card number SIM_IN), card insertion time / registration time (Time_In), card insertion cell index value (Area_IN), and card insertion base station ID (i.e., card insertion base station identifier gNB_IN) are obtained.

[0084] Step S52: Data screening.

[0085] Specifically, the parsed data is matched and filtered out using the Apple terminal number (i.e., the terminal number IMEI_APPLE belonging to the target terminal category) as a unique identifier. The total number of different card insertion numbers / registration numbers (SIM_IN) appearing on the same terminal within the time window Δt of normal working hours (i.e., the first information quantity Sum) is then calculated, and cluster analysis is performed on the same card insertion area index value (Area_IN).

[0086] Step S53: Data purification.

[0087] Specifically, within a time window Δt, all card insertion numbers / registration numbers (SIM_IN) registered by the terminal with the first information quantity Sum greater than a certain value are counted and put into the operator number segment query library to match the province to which they belong.

[0088] Among them, provinces are assigned values ​​according to the fraud risk areas:

[0089] 1 point: Province A, Province B, Province C.

[0090] 2 points: Province D, Province E, Province F, Province G, Province H, Province I, Province J, Province K, Province L, Province M, and Province N.

[0091] 5 points: Province O, Province P, Province Q, Province R, Province S, Province T, and Province U.

[0092] 10 points: Province V, Province W, Province X, Province Y, and Province Z.

[0093] Optionally, calculate the average risk value α and dispersion coefficient θ of the screened fraudulent terminals, as well as the risk value of the base station to which the terminal is connected

[0094] Step S54: Data output.

[0095] As an alternative example, Figure 5 As shown, for the above step S53, the following steps are also included:

[0096] Step S531, check whether the terminal number (IMEI) field in the matching statistical data is equal to the Apple terminal number (IMEI_APPLE), and discard it if not.

[0097] Step S532: Based on step S531, the total number of different card insertion numbers / registration numbers (SIM_IN) appearing on the same terminal within the time window Δt of the normal working period (ie, the first information quantity Sum) is calculated. Δt is generally set to 9:00-17:00.

[0098] Step S533: Based on step S532, terminals with a total number (i.e., the first information number Sum) greater than 10 are screened out. All of their card insertion numbers / registration numbers (SIM_IN) are entered into the operator number segment query database and matched to their provinces. Scores are assigned based on 1, 2, 5, and 10, and their average risk value α and dispersion coefficient θ are calculated and sorted. The card insertion numbers / registration numbers (SIM_IN) with an average risk value α greater than 3 and a dispersion coefficient 1<θ<5 are output. The output result is the Facetime fraud card.

[0099] Step S534, based on step S533, records the index value (Area_IN) of the cell connected to the terminal with an average risk value α>3 and a dispersion coefficient 1<θ<5, calculates the risk value β of the base station of the cell where the current terminal is located, and records the top 3 base stations in β as black base stations for later analysis.

[0100] The above embodiment of the present application collects registration and authentication data of user terminals and base stations in the 5G core network as the network entry point. Based on the coverage of the TA-tracking area and the longitude and latitude coordinates of the base station in the RA-registration area, the regional positioning of the registered terminal is achieved. The Reestablishment and Resume mechanisms in the RRC process are used to distinguish between normal users and fraudulent behaviors. Assisted by data clustering and number segment library matching, high-risk fraudulent number cards, terminals, and dens can be discovered.

[0101] Figure 6 FIG. 1 is a schematic diagram of a practical application of abnormal Facetime detection based on 5G core network UEcontext according to an embodiment of the present invention. Figure 6 As shown, based on the above technical solution provided by this application, the inspection results obtained from its actual application are as follows:

[0102] 1. At the base station location of Fuzhou XXX Hotel, there are 8 Apple terminals suspected of Facetime fraud.

[0103] The models are (IPHONE 7PLUS (A1661), IPHONE 6 (A1586), IPHONE 13 (A2634), IPHONEXS MAX (A1921), IPHONE 8PLUS (A1864)), all of which are old single-SIM phones.

[0104] Within 3 days, a PHONE 6 terminal involved 12 SIM cards:

[0105] 13329324099、17345896159、17393256185、17749548828、17759975593、17793441138、18000778117、18004365427、18025735095、18978160396、19185779658、19945181938.

[0106] The remaining terminals include 12 IPHONE 7PLUS SIM cards, 8 IPHONE 13 SIM cards, and 8 IPHONE XS MAX SIM cards.

[0107] Figure 7 is a schematic diagram of a verification result of a detection result according to an embodiment of the present invention, such as Figure 7 As shown, through the accuracy of the group traceability verification method, it can be verified that the technical solution provided by this application can accurately detect abnormal terminal numbers and abnormal user identification card numbers.

[0108] The above technical solution provided by this application monitors the necessary operations involved in the fraud process based on the signaling data of the 5G core network, solving the problem that the traditional traffic side cannot track and trace the source of overseas inbound traffic, and also solves the pain point that criminals are difficult to detect when there is no call or traffic. At the same time, based on the result analysis of signaling data, it can avoid mistaken killings and distinguish the normal behavior of normal users. At the same time, through the above technical solution of this application, what is actually achieved is the discovery of the behavior of large-scale transactions of Internet accounts, which can ensure that even if criminals change their fraud methods in the future, such as reselling FacetimeID to reselling other accounts, it will still be effective.

[0109] According to an embodiment of the present invention, an embodiment of a device for detecting abnormal terminals is also provided. It should be noted that the device for detecting abnormal terminals can be used to execute the method for detecting abnormal terminals in an embodiment of the present invention, and the method for detecting abnormal terminals in an embodiment of the present invention can be executed in the device for detecting abnormal terminals.

[0110] Figure 8 is a schematic diagram of a detection device for abnormal terminals according to an embodiment of the present invention, such as Figure 8As shown, the apparatus may include: an acquisition module 82, configured to acquire, through a core network, multiple historical user context information within a preset time period, wherein the historical user context information includes at least a terminal number and a user identification card number; a first determination module 84, configured to determine, from the multiple historical user context information, historical user context information whose terminal number belongs to a target terminal number category as user context information to be detected; a counting module 86, configured to count the number of user context information to be detected having the same terminal number but different user identification card numbers to obtain a first number of information; and a second determination module 88, configured to determine, if the first number of information exceeds a preset number threshold, the terminal number in the user context information to be detected as an abnormal terminal number, and to determine abnormal information based on the user context information to be detected, wherein the abnormal information includes at least an abnormal user identification card number, which is a user identification card number in the same user context information to be detected as the abnormal terminal number.

[0111] It should be noted that the acquisition module 82 in this embodiment can be used to execute step S102 in the embodiment of the present application, the first determination module 84 in this embodiment can be used to execute step S104 in the embodiment of the present application, the statistics module 86 in this embodiment can be used to execute step S106 in the embodiment of the present application, and the second determination module 88 in this embodiment can be used to execute step S108 in the embodiment of the present application. The examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments.

[0112] In the above-described embodiments of the present application, even if a terminal serves only as a message receiver, it will still send user context information including at least the terminal number and the subscriber identification card number to the core network during the network access phase without generating traffic or data. The core network stores the user context information sent by each terminal as historical user context information. Since abnormal terminals need to obtain multiple verification code messages based on subscriber identification card registration, abnormal terminals may frequently switch subscriber identification cards within a short period of time. Therefore, by counting historical user context information received by the core network within a preset time period, a correspondence between terminal numbers and subscriber identification card numbers can be obtained. Furthermore, the terminal numbers of the same terminal that frequently switches subscriber identification card numbers within the preset time period can be counted to obtain the abnormal terminal number. Based on the historical user context information including the abnormal terminal number, the abnormal information is determined from the multiple historical user context information received by the core network. Thus, even when only the subscriber identification card number is used for network access without generating traffic or data, the technical effect of accurately identifying abnormal terminal numbers and abnormal subscriber identification card numbers can be achieved, thereby resolving the technical problem of being unable to identify abnormal terminals and subscriber identification card numbers without generating traffic or data.

[0113] As an optional embodiment, the statistical module includes: a merging unit, used to merge multiple user context information to be detected with the same terminal number to obtain user context merge information, wherein each user context merge information includes at least: a terminal number, and at least one user identification card number corresponding to the terminal number; a statistical unit, used to count the number of different user identification card numbers in the user context merge information to obtain the number of card numbers; and a determination unit, used to determine the number of card numbers as the first information quantity.

[0114] As an optional embodiment, the device further includes: a first identification submodule for identifying, when the amount of first information exceeds a preset threshold, multiple user identification card numbers corresponding to each terminal number based on the context information of users to be detected with the same terminal number but different user identification card numbers; a second identification submodule for identifying the number location corresponding to each user identification card number, and determining, based on the preset risk value recorded in a preset risk assignment table for the number location, a pre-detection risk value corresponding to each user identification card number, wherein the preset risk assignment table is used to record the correspondence between the preset risk value and the number location; a first statistics submodule for counting the risk parameters of each terminal number based on the pre-detection risk values ​​corresponding to the multiple user identification card numbers corresponding to the same terminal number, wherein the risk parameters include at least: an average risk value of the multiple pre-detection risk values ​​and a risk dispersion coefficient of the multiple preset risk values; and a first determination submodule for determining the terminal number as an abnormal terminal number if the risk parameter meets the preset risk condition, and determining abnormal information based on the abnormal terminal number, wherein the risk parameter is determined to meet the preset risk condition if the average risk value is greater than the preset risk value and the risk dispersion coefficient is within a preset discrete interval.

[0115] As an optional embodiment, the historical user context information also includes: a card insertion base station identifier, wherein the card insertion base station identifier is a unique identifier of the base station to which the terminal using the user identification card is connected, and the device also includes: a second determination submodule, which is used to determine, from multiple historical user context information, historical user context information whose terminal number belongs to the target terminal number category as the user context information to be detected, and then determine the user context information to be detected with the same card insertion base station identifier but different terminal numbers as pre-detection user context information belonging to the target base station identifier, wherein the card insertion base station identifier includes the target base station identifier; a second counting submodule, which is used to count the second information quantity of the pre-detection user context information and the third information quantity of the pre-detection user context information including the abnormal terminal number; a third determination submodule, which is used to determine that the target base station identifier is an abnormal base station identifier when the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold; and a first adding submodule, which is used to add the abnormal base station identifier to the abnormal information.

[0116] As an optional embodiment, the device also includes: a first search submodule, which is used to determine that the target base station identifier is an abnormal base station identifier when the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, and then search for the target base station geographic information corresponding to the abnormal base station identifier among the multiple preset base station geographic information recorded in the preset base station geographic information table, wherein the preset base station geographic information table is used to record the correspondence between the card-inserted base station identifier and the preset base station geographic information, and the preset base station geographic information is used to indicate the position of the base station corresponding to the card-inserted base station identifier in the geographic coordinate system.

[0117] As an optional embodiment, the historical user context information also includes: a card insertion cell index value, wherein the card insertion cell index value is a unique identifier of the communication cell accessed by the terminal using the user identification card, and the device also includes: a fourth determination submodule, used to determine the user context information to be detected including the abnormal terminal number as abnormal user context information; a fifth determination submodule, used to determine the card insertion cell index value in the abnormal user context information as the abnormal cell index value; and a second adding submodule, used to add the abnormal cell index value to the abnormal information.

[0118] As an optional embodiment, the device also includes: a second search submodule, which is used to search for the target cell geographic information corresponding to the abnormal cell index value in the multiple preset cell geographic information recorded in the preset cell geographic information table after determining the inserted cell index value in the abnormal user context information as the abnormal cell index value, wherein the preset cell geographic information table is used to record the correspondence between the inserted cell index value and the preset cell geographic information, and the preset cell geographic information is used to indicate the position of the communication cell corresponding to the inserted cell index value in the geographic coordinate system.

[0119] An embodiment of the present invention may provide an electronic device, which may be a computer terminal, and the computer terminal may be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal may also be replaced by a terminal device such as a mobile terminal.

[0120] Optionally, in this embodiment, the computer terminal may be located in at least one network device among a plurality of network devices of a computer network.

[0121] In this embodiment, the computer terminal may execute program code for the following steps in the abnormal terminal detection method: obtaining, through a core network, multiple historical user context information within a preset time period, wherein the historical user context information includes at least a terminal number and a user identification card number; determining, from the multiple historical user context information, historical user context information whose terminal number belongs to a target terminal number category as user context information to be detected; counting the number of user context information to be detected having the same terminal number but different user identification card numbers to obtain a first number of information; and, if the first number of information exceeds a preset number threshold, determining the terminal number in the user context information to be detected as an abnormal terminal number, and determining abnormal information based on the user context information to be detected, wherein the abnormal information includes at least an abnormal user identification card number, which is a user identification card number in the same user context information to be detected as the abnormal terminal number.

[0122] Figure 9 is a structural block diagram of a computer terminal according to an embodiment of the present invention, such as Figure 9 As shown, the computer terminal 90 may include: one or more (only one is shown in the figure) processors 92 and a memory 94.

[0123] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal terminal detection method and device in the embodiments of the present invention. The processor executes the software programs and modules stored in the memory to perform various functional applications and data processing, thereby implementing the abnormal terminal detection method described above. The memory can include high-speed random access memory and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory can further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal 90 via a network. Examples of the aforementioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0124] The processor can call information and applications stored in the memory through a transmission device to perform the following steps: obtaining, through a core network, multiple historical user context information within a preset time period, wherein the historical user context information includes at least a terminal number and a user identification card number; determining, from the multiple historical user context information, historical user context information whose terminal number belongs to a target terminal number category as user context information to be detected; counting the number of user context information to be detected having the same terminal number but different user identification card numbers to obtain a first number of information; and, if the first number of information exceeds a preset number threshold, determining the terminal number in the user context information to be detected as an abnormal terminal number, and determining abnormal information based on the user context information to be detected, wherein the abnormal information includes at least an abnormal user identification card number, which is a user identification card number in the same user context information to be detected as the abnormal terminal number.

[0125] Optionally, the processor may also execute the program code of the following steps: merging multiple user context information to be detected with the same terminal number to obtain user context merge information, wherein each user context merge information includes at least: a terminal number, and at least one user identification card number corresponding to the terminal number; counting the number of different user identification card numbers in the user context merge information to obtain the number of card numbers; and determining the number of card numbers as the first information number.

[0126] Optionally, the processor may also execute the program code of the following steps: when the quantity of the first information exceeds a preset quantity threshold, based on the context information of the user to be detected with the same terminal number and different user identification card numbers, identify multiple user identification card numbers corresponding to each terminal number; identify the number location corresponding to each user identification card number, and determine the pre-detection risk value corresponding to each user identification card number based on the preset risk value recorded in the preset risk assignment table for the number location, wherein the preset risk assignment table is used to record the correspondence between the preset risk value and the number location; based on the pre-detection risk values ​​corresponding to multiple user identification card numbers corresponding to the same terminal number, calculate the risk parameters of each terminal number, wherein the risk parameters include at least: the average risk value of multiple pre-detection risk values, and the risk dispersion coefficient of multiple preset risk values; when the risk parameters meet the preset risk conditions, determine the terminal number as an abnormal terminal number, and determine abnormal information based on the abnormal terminal number, wherein, when the average risk value is greater than the preset risk value and the risk dispersion coefficient is within the preset discrete interval, determine that the risk parameters meet the preset risk conditions.

[0127] Optionally, the historical user context information also includes: a card insertion base station identifier, wherein the card insertion base station identifier is a unique identifier of the base station to which the terminal using the user identification card is connected. The above-mentioned processor can also execute the program code of the following steps: determining the user context information to be detected with the same card insertion base station identifier and different terminal numbers as pre-detection user context information belonging to the target base station identifier, wherein the card insertion base station identifier includes the target base station identifier; counting the second information quantity of the pre-detection user context information and the third information quantity of the pre-detection user context information including the abnormal terminal number; when the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, determining that the target base station identifier is an abnormal base station identifier; and putting the abnormal base station identifier into the abnormal information.

[0128] Optionally, the above-mentioned processor can also execute the program code of the following steps: searching for the target base station geographic information corresponding to the abnormal base station identifier among the multiple preset base station geographic information recorded in the preset base station geographic information table, wherein the preset base station geographic information table is used to record the correspondence between the card-inserted base station identifier and the preset base station geographic information, and the preset base station geographic information is used to indicate the position of the base station corresponding to the card-inserted base station identifier in the geographic coordinate system.

[0129] Optionally, the historical user context information also includes: a card insertion cell index value, wherein the card insertion cell index value is a unique identifier of the communication cell accessed by the terminal using the user identification card. The above-mentioned processor can also execute the program code of the following steps: determining the user context information to be detected including the abnormal terminal number as abnormal user context information; determining the card insertion cell index value in the abnormal user context information as the abnormal cell index value; and putting the abnormal cell index value into the abnormal information.

[0130] Optionally, the above-mentioned processor can also execute the program code of the following steps: searching for the target cell geographic information corresponding to the abnormal cell index value among the multiple preset cell geographic information recorded in the preset cell geographic information table, wherein the preset cell geographic information table is used to record the correspondence between the inserted cell index value and the preset cell geographic information, and the preset cell geographic information is used to indicate the position of the communication cell corresponding to the inserted cell index value in the geographic coordinate system.

[0131] In the above-described embodiments of the present application, even if a terminal serves only as a message receiver, it will still send user context information including at least the terminal number and the subscriber identification card number to the core network during the network access phase without generating traffic or data. The core network stores the user context information sent by each terminal as historical user context information. Since abnormal terminals need to obtain multiple verification code messages based on subscriber identification card registration, abnormal terminals may frequently switch subscriber identification cards within a short period of time. Therefore, by counting historical user context information received by the core network within a preset time period, a correspondence between terminal numbers and subscriber identification card numbers can be obtained. Furthermore, the terminal numbers of the same terminal that frequently switches subscriber identification card numbers within the preset time period can be counted to obtain the abnormal terminal number. Based on the historical user context information including the abnormal terminal number, the abnormal information is determined from the multiple historical user context information received by the core network. Thus, even when only the subscriber identification card number is used for network access without generating traffic or data, the technical effect of accurately identifying abnormal terminal numbers and abnormal subscriber identification card numbers can be achieved, thereby resolving the technical problem of being unable to identify abnormal terminals and subscriber identification card numbers without generating traffic or data.

[0132] It can be understood by those skilled in the art that Figure 9 The structure shown is for illustration only, and the computer terminal may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a handheld computer, a mobile Internet device (MID), a PAD, or other terminal devices. Figure 9 It does not limit the structure of the above electronic device. For example, the computer terminal 90 may also include Figure 9 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 9 Different configurations shown.

[0133] A person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a computer program. The computer program can be stored in a non-volatile medium. The non-volatile storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0134] The embodiment of the present invention further provides a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the abnormal terminal detection method provided in the above embodiment.

[0135] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0136] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: obtaining, through the core network, multiple historical user context information within a preset time period, wherein the historical user context information includes at least: a terminal number and a user identification card number; determining, among the multiple historical user context information, historical user context information whose terminal number belongs to a target terminal number category as user context information to be detected; counting the number of user context information to be detected with the same terminal number but different user identification card numbers to obtain a first information quantity; when the first information quantity exceeds a preset quantity threshold, determining the terminal number in the user context information to be detected as an abnormal terminal number, and determining abnormal information based on the user context information to be detected, wherein the abnormal information includes at least: an abnormal user identification card number, which is a user identification card number in the same user context information to be detected as the abnormal terminal number.

[0137] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: merging multiple user context information to be detected with the same terminal number to obtain user context merge information, wherein each user context merge information includes at least: a terminal number, and at least one user identification card number corresponding to the terminal number; counting the number of different user identification card numbers in the user context merge information to obtain the number of card numbers; and determining the number of card numbers as the first information number.

[0138] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: when the amount of first information exceeds a preset number threshold, based on the context information of the user to be detected with the same terminal number and different user identification card numbers, identifying multiple user identification card numbers corresponding to each terminal number; identifying the number location corresponding to each user identification card number, and determining the pre-detection risk value corresponding to each user identification card number based on the preset risk value recorded in the preset risk assignment table for the number location, wherein the preset risk assignment table is used to record the correspondence between the preset risk value and the number location; based on the pre-detection risk values ​​corresponding to multiple user identification card numbers corresponding to the same terminal number, respectively, counting the risk parameters of each terminal number, wherein the risk parameters include at least: an average risk value of multiple pre-detection risk values, and a risk dispersion coefficient of multiple preset risk values; when the risk parameters meet the preset risk conditions, determining the terminal number as an abnormal terminal number, and determining abnormal information based on the abnormal terminal number, wherein when the average risk value is greater than the preset risk value and the risk dispersion coefficient is within the preset discrete interval, determining that the risk parameter meets the preset risk conditions.

[0139] Optionally, in this embodiment, the historical user context information also includes: a card insertion base station identifier, wherein the card insertion base station identifier is a unique identifier of a base station to which a terminal using a user identification card is connected, and the non-volatile storage medium is configured to store program code for executing the following steps: determining the user context information to be detected with the same card insertion base station identifier and a different terminal number as pre-detection user context information belonging to a target base station identifier, wherein the card insertion base station identifier includes a target base station identifier; counting a second information quantity of the pre-detection user context information and a third information quantity of the pre-detection user context information including an abnormal terminal number; when a ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, determining that the target base station identifier is an abnormal base station identifier; and placing the abnormal base station identifier into the abnormal information.

[0140] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: searching for the target base station geographic information corresponding to the abnormal base station identifier among multiple preset base station geographic information recorded in the preset base station geographic information table, wherein the preset base station geographic information table is used to record the correspondence between the card-inserted base station identifier and the preset base station geographic information, and the preset base station geographic information is used to indicate the position of the base station corresponding to the card-inserted base station identifier in the geographic coordinate system.

[0141] Optionally, in this embodiment, the historical user context information also includes: a card insertion cell index value, wherein the card insertion cell index value is a unique identifier of the communication cell accessed by the terminal using the user identification card, and the non-volatile storage medium is configured to store program code for executing the following steps: determining the user context information to be detected including the abnormal terminal number as abnormal user context information; determining the card insertion cell index value in the abnormal user context information as the abnormal cell index value; and placing the abnormal cell index value into the abnormal information.

[0142] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: searching for target cell geographic information corresponding to the abnormal cell index value among multiple preset cell geographic information recorded in the preset cell geographic information table, wherein the preset cell geographic information table is used to record the correspondence between the inserted cell index value and the preset cell geographic information, and the preset cell geographic information is used to indicate the position of the communication cell corresponding to the inserted cell index value in the geographic coordinate system.

[0143] An embodiment of the present invention further provides a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, the steps of the abnormal terminal detection method provided in the above embodiment are implemented.

[0144] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0145] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0146] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0147] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0148] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0149] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a non-volatile storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned non-volatile storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code.

[0150] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal terminals, characterized in that: include: Acquire multiple historical user context information within a preset time period through the core network, wherein the historical user context information at least includes: a terminal number and a user identification card number; Among the plurality of historical user context information, the historical user context information whose terminal number belongs to the target terminal number category is determined as the user context information to be detected; Counting the number of the to-be-detected user context information with the same terminal number and different user identification card numbers to obtain a first number of information; When the first information quantity exceeds a preset quantity threshold, the terminal number in the user context information to be detected is determined as an abnormal terminal number, and abnormal information is determined based on the user context information to be detected, wherein the abnormal information at least includes: an abnormal user identification card number, and the abnormal user identification card number is a user identification card number in the same user context information to be detected as the abnormal terminal number.

2. The method according to claim 1, characterized in that Counting the number of the to-be-detected user context information with the same terminal number and different user identification card numbers to obtain the first information number includes: Merging the plurality of user context information to be detected with the same terminal number to obtain user context merge information, wherein each user context merge information at least includes: the terminal number, and at least one user identification card number corresponding to the terminal number; Counting the number of different user identification card numbers in the user context merge information to obtain the number of card numbers; The card number quantity is determined as the first information quantity.

3. The method according to claim 1, characterized in that The method further comprises: In the case where the quantity of the first information exceeds the preset quantity threshold, based on the context information of the to-be-detected user with the same terminal number and different user identification card numbers, identifying a plurality of user identification card numbers corresponding to each terminal number; Identify the number location corresponding to each user identification card number, and determine the pre-detection risk value corresponding to each user identification card number based on the preset risk value recorded in the preset risk assignment table for the number location, wherein the preset risk assignment table is used to record the corresponding relationship between the preset risk value and the number location; Based on the pre-detection risk values ​​respectively corresponding to the multiple user identification card numbers corresponding to the same terminal number, the risk parameters of each terminal number are counted, wherein the risk parameters at least include: an average risk value of the multiple pre-detection risk values, and a risk dispersion coefficient of the multiple preset risk values; When the risk parameter meets the preset risk condition, the terminal number is determined as the abnormal terminal number, and the abnormal information is determined based on the abnormal terminal number, wherein, when the average risk value is greater than the preset risk value and the risk dispersion coefficient is within the preset discrete interval, it is determined that the risk parameter meets the preset risk condition.

4. The method according to claim 1, characterized in that: The historical user context information further includes: a card insertion base station identifier, wherein the card insertion base station identifier is a unique identifier of a base station to which a terminal using the user identification card accesses, and after determining the historical user context information whose terminal number belongs to a target terminal number category as the user context information to be detected among the multiple historical user context information, the method further includes: Determine the user context information to be detected with the same card insertion base station identifier and different terminal numbers as pre-detection user context information belonging to the target base station identifier, wherein the card insertion base station identifier includes the target base station identifier; Counting the second information quantity of the pre-detection user context information and the third information quantity of the pre-detection user context information including the abnormal terminal number; When the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, determining that the target base station identifier is an abnormal base station identifier; The abnormal base station identifier is placed in the abnormal information.

5. The method according to claim 4, characterized in that When the ratio of the third information quantity to the second information quantity exceeds a preset ratio threshold, after determining that the target base station identifier is an abnormal base station identifier, the method further includes: Among the multiple preset base station geographic information recorded in the preset base station geographic information table, search for the target base station geographic information corresponding to the abnormal base station identifier, wherein the preset base station geographic information table is used to record the correspondence between the card-insertion base station identifier and the preset base station geographic information, and the preset base station geographic information is used to indicate the position of the base station corresponding to the card-insertion base station identifier in the geographic coordinate system.

6. The method according to claim 1, characterized in that The historical user context information further includes: a card insertion cell index value, wherein the card insertion cell index value is a unique identifier of a communication cell accessed by a terminal using the user identification card, and the method further includes: Determine the user context information to be detected including the abnormal terminal number as abnormal user context information; Determine the card insertion cell index value in the abnormal user context information as the abnormal cell index value; The abnormal cell index value is put into the abnormal information.

7. The method according to claim 6, characterized in that After determining the card insertion cell index value in the abnormal user context information as the abnormal cell index value, the method further includes: Among the multiple preset cell geographic information recorded in the preset cell geographic information table, search for the target cell geographic information corresponding to the abnormal cell index value, wherein the preset cell geographic information table is used to record the correspondence between the insertion cell index value and the preset cell geographic information, and the preset cell geographic information is used to indicate the position of the communication cell corresponding to the insertion cell index value in the geographic coordinate system.

8. A device for detecting abnormal terminals, characterized in that: include: An acquisition module, configured to acquire a plurality of historical user context information within a preset period through a core network, wherein the historical user context information at least includes: a terminal number and a user identification card number; A first determining module is used to determine, among the plurality of historical user context information, the historical user context information whose terminal number belongs to the target terminal number category as the user context information to be detected; A statistics module, used for counting the number of the to-be-detected user context information with the same terminal number and different user identification card numbers, to obtain a first number of information; The second determination module is used to determine the terminal number in the user context information to be detected as an abnormal terminal number when the number of the first information exceeds a preset number threshold, and determine abnormal information based on the user context information to be detected, wherein the abnormal information at least includes: an abnormal user identification card number, and the abnormal user identification card number is a user identification card number in the same user context information to be detected as the abnormal terminal number.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is configured to execute the abnormal terminal detection method according to any one of claims 1 to 7 through the computer program.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the abnormal terminal detection method described in any one of claims 1 to 7 are implemented.

Images