Internet of Things card anomaly detection method and system based on improved K-means algorithm

Abstract

The invention discloses an Internet of Things card anomaly detection method and system based on an improved K-means algorithm. The method comprises the following steps: S1, collecting and preprocessing feature data of an Internet of Things card; s2, performing clustering analysis on the preprocessed feature data by using an improved K-means algorithm; s3, calculating a distance threshold value of abnormal judgment according to a clustering result; and S4, judging whether the to-be-detected Internet of Things card is abnormal or not according to the threshold value. The system comprises a data preprocessing module, a clustering analysis module and an anomaly detection module. The invention aims to provide an efficient and intelligent anomaly detection method for the use behavior of the Internet of Things card through an improved K-means algorithm, and by automatically identifying the abnormal use behavior of the Internet of Things card in different application scenes, the accuracy of management and safety monitoring is improved, and malicious abuse and illegal behaviors are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of IT and software development, and in particular to an Internet of Things card anomaly detection method and system based on an improved K-means algorithm. Background Art

[0002] At present, with the rapid development of the Internet of Things business in my country, the number of IoT cards issued is also increasing rapidly. However, with the growth of the IoT card business, the management and security supervision of IoT cards are facing more severe challenges. Some lawless elements take advantage of the low tariff of IoT cards by maliciously reselling, illegally misappropriating or stealing them, and sell them as ordinary user cards for profit, or even use them to make harassing calls and send illegal text messages. This behavior not only seriously interferes with normal user business, but also brings huge economic losses to operators and users.

[0003] Existing technologies usually adopt the following solutions to identify IoT card anomalies:

[0004] 1. Detection based on historical traffic data: This technology obtains the historical traffic data of the IoT card within a period of time, identifies the abnormal traffic usage date through machine learning methods, and then clusters the traffic usage data in the period before and after the abnormal traffic usage date and obtains the cluster center. Finally, the characteristic distance between the abnormal traffic usage date and the cluster center is calculated. If the distance is greater than the preset distance threshold, it is judged as abnormal. This method only considers the use of traffic, while the actual use of IoT cards also includes text messages and voice, so it ignores the identification of other abnormal behaviors.

[0005] 2. Abnormal behavior identification based on blacklist: This technology identifies whether the IoT card is abnormal by judging whether the attributes and behaviors of the IoT card are in the identification information blacklist and access address blacklist. This method has obvious disadvantages. On the one hand, this method relies on static blacklist information and needs to be manually updated or maintained to meet the needs of real-time identification; on the other hand, this method can only detect IoT cards that are already in the blacklist, and cannot provide effective detection and protection for unknown anomalies. Summary of the invention

[0006] The present invention provides an IoT card anomaly detection method and system based on an improved K-means algorithm that is more intelligent, efficient, and adaptive to the usage characteristics of IoT cards in different scenarios, which can solve at least one of the above technical problems.

[0007] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0008] The IoT card anomaly detection method based on the improved K-means algorithm includes the following steps:

[0009] S1. Collect and preprocess the characteristic data of the IoT card;

[0010] S2, using the improved K-means algorithm to perform cluster analysis on the preprocessed feature data;

[0011] S3. Calculate the distance threshold for abnormality determination based on the clustering results;

[0012] S4. Determine whether the IoT card to be tested is abnormal or not according to the threshold value.

[0013] Furthermore, the S1 further comprises:

[0014] S11. Extract three types of key feature data from the historical data of the IoT card, including the usage of traffic, SMS and voice;

[0015] S12, checking and processing abnormal values ​​and missing values ​​in the extracted feature data;

[0016] S13, normalizing the feature data after outliers or missing values ​​are processed to eliminate the dimensional differences between different features and ensure that the influence of each feature on distance calculation is balanced during clustering;

[0017] S14. According to the application scenario of the IoT card, select a suitable time window to capture the usage pattern of the device in different time periods.

[0018] Furthermore, in S12, outliers are removed, including abnormally high values ​​and abnormally low values, missing values ​​are filled or deleted, and missing values ​​are filled with mean, median or adjacent data to ensure data integrity.

[0019] Furthermore, the S1 further comprises:

[0020] S21. Set an initial K value range K min To K max , and perform multiple K-means clustering on the IoT card feature data, and use different K values ​​for each clustering. The clustering process uses the standard K-means algorithm and performs the following operations:

[0021] S211, randomly select K initial cluster centers;

[0022] S212, calculating the distance from each data point to the cluster center, and classifying it to the nearest cluster center;

[0023] S213, updating the center point of each cluster to the mean of all points in the cluster;

[0024] S214, repeating S212 and S213 until the cluster centers converge or a preset number of iterations is reached;

[0025] S22. For each clustering result of K value, the corresponding Davies-Bouldin index is calculated. The Davies-Bouldin index is used to measure the compactness and separation of clusters. The calculation formula is:

[0026]

[0027] in:

[0028] DBI stands for Davies-Bouldin index;

[0029] σ m Represents the average radius of the mth cluster, that is, the average distance from the data points within the cluster to the center;

[0030] σ n Represents the average radius of the nth cluster, that is, the average distance from the data points within the cluster to the center;

[0031] d(C m , C n ) represents the distance between the mth and nth cluster centers;

[0032] S23, according to the Davies-Bouldin index of different K values, selecting the K value corresponding to the minimum DBI value as the optimal K value;

[0033] S24. Based on the optimal K value selected in S23 as the target K value, K-means clustering is re-executed to cluster the feature data of the IoT card into K categories to form K clusters, each of which represents a feature pattern of an application scenario.

[0034] Furthermore, the S3 further includes:

[0035] S31. Calculate the distance from the point in the cluster to the cluster center. For each IoT card i, calculate the Euclidean distance from the point to the center of the cluster to which it belongs. The calculation formula is:

[0036]

[0037] S32, calculate the average value d and standard deviation σ of the distance between the points in the cluster and the cluster center d ;

[0038] S33, determine the abnormality judgment threshold T based on the average value and standard deviation:

[0039]

[0040] Among them, k is an empirical coefficient, which can be 1.5-3, indicating that the distance between the abnormal IoT card and the normal cluster center exceeds the normal range.

[0041] Furthermore, the S4 further comprises:

[0042] S41. For a certain IoT card to be tested, extract its feature data and calculate its distance d to the nearest cluster center. test :

[0043]

[0044] S42, compare distance d test With threshold T, if d test >T, the IoT card is judged to have abnormal behavior and is an abnormal card. If d test ≤T, it is determined that the IoT card has no abnormal behavior and is a normal card.

[0045] The IoT card anomaly detection system based on the improved K-means algorithm is applicable to the IoT card anomaly detection method based on the improved K-means algorithm, including:

[0046] A data preprocessing module, which is used to perform preprocessing operations on the usage data of the three types of characteristic data of the IoT card to ensure that different characteristic data are analyzed at the same scale;

[0047] A cluster analysis module, which is used to combine the K-means algorithm with the DBI index to form an improved K-means algorithm, automatically optimize the K value based on the improved K-means algorithm, and select the optimal number of clusters;

[0048] The anomaly detection module is used to calculate the mean and standard deviation of the distance from the IoT card in each cluster to the cluster center, and set a threshold T based on the calculation result to determine whether the usage behavior of the IoT card to be tested is normal or abnormal.

[0049] Furthermore, the three types of characteristic data of the IoT card include traffic, text messages and voice. The IoT card is allocated to corresponding clusters according to the three types of characteristic data of the IoT card, and each cluster represents a certain usage mode or scenario feature of the IoT card.

[0050] Furthermore, the preprocessing operations of the data preprocessing module at least include data collection, missing value filling and data standardization.

[0051] Furthermore, the judgment criteria of the anomaly detection module are: taking each IoT card in the cluster as training data, setting a threshold T based on these training data, for the IoT card to be tested, if the mean and standard deviation of the distance between the IoT card to be tested and the nearest cluster center exceed the threshold T, then it is determined that the usage behavior of the IoT card to be tested is abnormal, and the IoT card to be tested is an abnormal card; conversely, if it does not exceed the threshold T, then it is determined that the usage behavior of the IoT card to be tested is normal, and the IoT card to be tested is a normal card.

[0052] The beneficial effects of the present invention are embodied in:

[0053] 1. Anomaly detection based on improved K-means algorithm: K-means clustering algorithm is used to analyze the characteristic data of IoT card traffic, SMS, voice, etc., and Davies-Bouldin Index (DBI) is used to automatically optimize the K value and dynamically adjust the number of clusters, which improves the accuracy and adaptability of anomaly detection. By determining a reasonable number of clusters, more accurate anomaly detection can be achieved.

[0054] 2. Multi-dimensional feature data input: Based on the multi-dimensional features of IoT cards in different application scenarios, including but not limited to traffic, SMS, and voice usage, multi-dimensional feature data such as traffic, SMS, and voice are integrated for clustering to establish a feature model of normal usage behavior, thereby improving the model's adaptability to complex scenarios. It does not rely on historical rules or manually set fixed thresholds, and solves the defects of traditional methods that are limited to a single data dimension or fixed rules.

[0055] 3. Abnormal determination mechanism: By calculating the distance between the IoT card to be tested and the cluster center, the distance threshold is used to determine whether the IoT card is abnormal. This avoids the lag of existing technologies that rely on historical data or blacklists, and achieves more flexible abnormality detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0057] Figure 1 It is a flow chart of an abnormality detection method for an Internet of Things card according to an embodiment of the present invention.

[0058] Figure 2 It is a flowchart of the operation process of the method for detecting anomalies of an Internet of Things card according to an embodiment of the present invention.

[0059] Figure 3 It is a schematic diagram of an IoT card anomaly detection system according to an embodiment of the present invention.

[0060] Figure 4It is a functional module diagram of the Internet of Things card anomaly detection system according to an embodiment of the present invention.

[0061] Figure 5 It is a structural block diagram of a computer device according to an embodiment of the present invention.

[0062] The components in the accompanying drawings are marked as follows: 1. Data preprocessing module; 2. Cluster analysis module; 3. Anomaly detection module. DETAILED DESCRIPTION

[0063] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. In the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0064] It should be noted that the meaning of “and / or” appearing in the full text includes three parallel solutions. Taking “A and / or B” as an example, it includes Solution A, Solution B, or a solution in which both A and B are satisfied.

[0065] It should be noted that those skilled in the art can understand that all or part of the steps implemented in the embodiments of the present invention can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using hardware, it can be implemented in whole or in part in the form of purchasing standard parts or modified parts. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0066] It should be noted that in this application: K-means algorithm is an iterative clustering analysis algorithm, the core idea of ​​which is to divide n objects in a data set into K clusters so that the sum of the distances from each object to the center (or mean point, centroid) of its cluster is minimized. The Davies-Bouldin index (DBI), also known as the classification accuracy index, is an indicator for evaluating the quality of clustering algorithms.

[0067] See also Figure 1 The embodiment of the present invention provides an IoT card anomaly detection method based on an improved K-means algorithm, comprising the following steps:

[0068] S1. Collect and preprocess the characteristic data of the IoT card;

[0069] S2, using the improved K-means algorithm to perform cluster analysis on the preprocessed feature data;

[0070] S3. Calculate the distance threshold for abnormality determination based on the clustering results;

[0071] S4. Determine whether the IoT card to be tested is abnormal or not according to the threshold value.

[0072] The present invention aims to provide an efficient and intelligent anomaly detection method for the use behavior of IoT cards through an improved K-means algorithm. By automatically identifying abnormal use behaviors of IoT cards in different application scenarios, the accuracy of management and security monitoring can be improved, and malicious abuse and violations can be reduced.

[0073] In this embodiment, the S1 further includes:

[0074] S11. Extract three types of key feature data from the historical data of the IoT card, including the usage of traffic, SMS and voice;

[0075] S12, checking and processing abnormal values ​​and missing values ​​in the extracted feature data;

[0076] S13, normalizing the feature data after outliers or missing values ​​are processed to eliminate the dimensional differences between different features and ensure that the influence of each feature on distance calculation is balanced during clustering;

[0077] S14. According to the application scenario of the IoT card, select an appropriate time window, such as data from the past 6 months, to capture the usage patterns of the device in different time periods.

[0078] In this application, the Z-score standardization method is used for normalization;

[0079] The Z-score method standardizes data based on the mean and standard deviation of the original data. The processed data has a mean of 0 and a variance of 1, which conforms to the standard normal distribution and is dimensionless. Its main purpose is to unify data of different magnitudes into the same magnitude and use the calculated Z-score value to measure them uniformly, ensuring comparability between data. The formula is as follows:

[0080]

[0081] Among them, x represents the original data, μ represents the mean value of the original data, σ represents the standard deviation of the original data, and x normalization Represents normalized data.

[0082] In this embodiment, in S12, outliers are removed, including abnormally high values ​​and abnormally low values, and missing values ​​are supplemented or deleted.

[0083] The abnormal values ​​can be error records of traffic, SMS or voice;

[0084] For missing values, you can use the mean, median, or adjacent data to fill in the missing values ​​to ensure data integrity. In this application, the mean value is used for filling.

[0085] See also Figure 2 In this embodiment, S1 further includes:

[0086] S21. Set an initial K value range K min To K max , considering the three-dimensional features, this application sets K min =3, K max =9, and perform multiple K-means clustering on the IoT card feature data, and use different K values ​​for each clustering. The clustering process uses the standard K-means algorithm and performs the following operations:

[0087] S211, randomly select K initial cluster centers;

[0088] S212, calculating the distance from each data point to the cluster center, and classifying it to the nearest cluster center;

[0089] S213, updating the center point of each cluster to the mean of all points in the cluster;

[0090] S214, repeating S212 and S213 until the cluster centers converge or a preset number of iterations is reached;

[0091] S22. For each clustering result of K value, the corresponding Davies-Bouldin index (DBI) is calculated. The Davies-Bouldin index is used to measure the compactness and separation of clusters. The calculation formula is:

[0092]

[0093] in:

[0094] DBI stands for Davies-Bouldin index;

[0095] σ m Represents the average radius of the mth cluster, that is, the average distance from the data points within the cluster to the center;

[0096] σ n Represents the average radius of the nth cluster, that is, the average distance from the data points within the cluster to the center;

[0097] d(C m , C n ) represents the distance between the mth and nth cluster centers;

[0098] The smaller the DBI value, the better the clustering effect. Conversely, the larger the DBI value, the worse the clustering effect.

[0099] S23, according to the Davies-Bouldin index of different K values, selecting the K value corresponding to the minimum DBI value as the optimal K value;

[0100] This K value can ensure that the clustering results achieve the best clustering effect when the intra-class distance is minimized and the inter-class distance is maximized;

[0101] S24. Based on the optimal K value selected in S23 as the target K value, K-means clustering is re-executed to cluster the feature data of the IoT card into K categories to form K clusters, each of which represents a feature pattern of an application scenario.

[0102] See also Figure 2 In this embodiment, S3 further includes:

[0103] S31. Calculate the distance from the point in the cluster to the cluster center. For each IoT card i, calculate the Euclidean distance from the point to the center of the cluster to which it belongs. The calculation formula is:

[0104]

[0105] S32, calculate the average value d and standard deviation σ of the distance between the points in the cluster and the cluster center d ;

[0106] S33, determine the abnormality judgment threshold T based on the average value and standard deviation:

[0107]

[0108] Among them, k is an empirical coefficient, which can be 1.5-3, indicating that the distance between the abnormal IoT card and the normal cluster center exceeds the normal range.

[0109] In this application, an improved K-means algorithm is introduced. This method does not need to set a fixed number of clusters, but gives a range and automatically analyzes the most appropriate number of clusters through the algorithm. When using multiple dimensional data such as traffic, SMS and voice as input, this method can adapt to different IoT card application scenarios, reasonably divide different usage modes, and is suitable for handling variable and complex application environments.

[0110] See also Figure 2 In this embodiment, S4 further includes:

[0111] S41. For a certain IoT card to be tested, extract its feature data and calculate its distance d to the nearest cluster center. test :

[0112]

[0113] S42, compare distance d test With threshold T, if d test >T, the IoT card is judged to have abnormal behavior and is an abnormal card. If d test ≤T, it is determined that the IoT card has no abnormal behavior and is a normal card.

[0114] In this application, a more flexible and data-driven anomaly judgment standard is provided through the method of "judging anomalies based on distance thresholds". This method is more flexible and can adapt to different application scenarios and specific data distributions, avoiding the shortcomings of insensitivity to anomalies in general algorithm detection.

[0115] See also Figure 3-Figure 4 The embodiment of the present invention further provides an IoT card anomaly detection system based on an improved K-means algorithm, which is applicable to the IoT card anomaly detection method based on an improved K-means algorithm, and includes:

[0116] A data preprocessing module 1, which is used to perform a preprocessing operation on the usage data of the three types of characteristic data of the Internet of Things card to ensure that different characteristic data are analyzed at the same scale;

[0117] Cluster analysis module 2, the cluster analysis module 2 is used to combine the K-means algorithm with the DBI index to form an improved K-means algorithm, automatically optimize the K value based on the improved K-means algorithm, and select the optimal number of clusters;

[0118] The anomaly detection module 3 is used to calculate the mean and standard deviation of the distance from the IoT card in each cluster to the cluster center, and set a threshold T based on the calculation result to determine whether the usage behavior of the IoT card to be tested is normal or abnormal.

[0119] In the present invention, on the one hand, an improvement on the algorithm is proposed, and an improved K-means algorithm is adopted to optimize the K value through the DBI index to ensure that the clustering effect is more accurate and more intelligent than the traditional method; on the other hand, multi-dimensional data input is adopted to integrate multi-dimensional feature data such as traffic, text messages, and voice for clustering, thereby improving the adaptability of the model to complex scenarios; on the other hand, an anomaly detection mechanism is used to judge abnormal behavior using a distance threshold, thereby avoiding the lag of relying on historical data or blacklists, and detection is more flexible.

[0120] See also Figure 3-Figure 4 In this embodiment, the three types of characteristic data of the IoT card include traffic, SMS and voice. The IoT card is assigned to a corresponding cluster according to the three types of characteristic data of the IoT card, and each cluster represents a certain usage mode or scenario feature of the IoT card;

[0121] The preprocessing operation of the data preprocessing module 1 at least includes data collection, missing value filling and data standardization;

[0122] The judgment standard of the anomaly detection module 3 is: taking each IoT card in the cluster as training data, setting a threshold T based on these training data, for the IoT card to be tested, if the mean and standard deviation of the distance between the IoT card to be tested and the nearest cluster center exceed the threshold T, then it is determined that the usage behavior of the IoT card to be tested is abnormal, and the IoT card to be tested is an abnormal card; conversely, if it does not exceed the threshold T, then it is determined that the usage behavior of the IoT card to be tested is normal, and the IoT card to be tested is a normal card.

[0123] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the above method.

[0124] See also Figure 5 An embodiment of the present invention further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0125] The embodiment of the present invention further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the steps of the above method.

[0126] It is understandable that the system, device and storage medium provided in the embodiments of the present invention correspond to the method provided in the embodiments of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above methods.

[0127] In summary, the present invention proposes an efficient and intelligent anomaly detection method for the use behavior of the Internet of Things card, specifically:

[0128] 1. Algorithm optimization: This paper adopts an improved K-means clustering algorithm, uses the Davies-Bouldin index (DBI) to automatically optimize the K value, dynamically adjusts the number of clusters, and improves the accuracy and adaptability of anomaly detection. This automated detection method based on machine learning has the advantage of being more advanced and intelligent in IoT card management;

[0129] 2. Multi-dimensional data feature clustering: The present invention can establish a model based on the actual usage of the card by clustering the three-dimensional feature data of traffic, SMS and voice of the IoT card. It does not rely on historical rules or manually set fixed thresholds, and solves the defects of traditional methods that are limited to a single data dimension or fixed rules.

[0130] 3. Dynamic detection mechanism: Different from the static blacklist or simple traffic analysis in the prior art, the present invention proposes an anomaly detection method based on distance threshold. By calculating the distance between the card and the cluster center in real time and setting a reasonable threshold, it can effectively adapt to different application scenarios, provide a real-time and dynamic anomaly identification method, and make detection more flexible and accurate.

[0131] It should be understood that the examples and implementation modes described herein are for illustrative purposes only and are not intended to limit the present invention. Those skilled in the art may make various modifications or changes based on the examples and implementation modes. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. The IoT card anomaly detection method based on the improved K-means algorithm is characterized by: The following steps are involved: S1. Collect and preprocess the characteristic data of the IoT card; S2, using the improved K-means algorithm to perform cluster analysis on the preprocessed feature data; S3. Calculate the distance threshold for abnormality determination based on the clustering results; S4. Determine whether the IoT card to be tested is abnormal or not according to the threshold value.

2. The method for detecting anomalies of an Internet of Things card based on an improved K-means algorithm as claimed in claim 1, characterized in that: Said S1 further comprises: S11. Extract three types of key feature data from the historical data of the IoT card, including the usage of traffic, SMS and voice; S12, checking and processing abnormal values ​​and missing values ​​in the extracted feature data; S13, normalizing the feature data after outliers or missing values ​​are processed to eliminate the dimensional differences between different features and ensure that the influence of each feature on distance calculation is balanced during clustering; S14. According to the application scenario of the IoT card, select a suitable time window to capture the usage pattern of the device in different time periods.

3. The method for detecting anomalies of an Internet of Things card based on an improved K-means algorithm as claimed in claim 2, characterized in that: In S12, outliers are removed, including abnormally high values ​​and abnormally low values, missing values ​​are filled or deleted, and missing values ​​are filled with mean, median or adjacent data to ensure data integrity.

4. The method for detecting anomalies of an Internet of Things card based on an improved K-means algorithm as claimed in claim 1, characterized in that: Said S1 further comprises: S21. Set an initial K value range K min To K max , and perform multiple K-means clustering on the IoT card feature data, and use different K values ​​for each clustering. The clustering process uses the standard K-means algorithm and performs the following operations: S211, randomly select K initial cluster centers; S212, calculating the distance from each data point to the cluster center, and classifying it to the nearest cluster center; S213, updating the center point of each cluster to the mean of all points in the cluster; S214, repeating S212 and S213 until the cluster centers converge or a preset number of iterations is reached; S22. For each clustering result of K value, the corresponding Davies-Bouldin index is calculated. The Davies-Bouldin index is used to measure the compactness and separation of clusters. The calculation formula is: in: DBI stands for Davies-Bouldin index; σ m Represents the average radius of the mth cluster, that is, the average distance from the data points within the cluster to the center; σ n Represents the average radius of the nth cluster, that is, the average distance from the data points within the cluster to the center; d(C m , C n ) represents the distance between the mth and nth cluster centers; S23, according to the Davies-Bouldin index of different K values, selecting the K value corresponding to the minimum DBI value as the optimal K value; S24. Based on the optimal K value selected in S23 as the target K value, K-means clustering is re-executed to cluster the feature data of the IoT card into K categories to form K clusters, each of which represents a feature pattern of an application scenario.

5. The method for detecting anomalies of an Internet of Things card based on an improved K-means algorithm as claimed in claim 4, characterized in that: The S3 further comprises: S31. Calculate the distance from the point in the cluster to the cluster center. For each IoT card i, calculate the Euclidean distance from the point to the center of the cluster to which it belongs. The calculation formula is: S32, calculate the average distance between the points in the cluster and the cluster center and standard deviation σ d ; S33, determine the abnormality judgment threshold T based on the average value and standard deviation: Among them, k is an empirical coefficient, which can be 1.5-3, indicating that the distance between the abnormal IoT card and the normal cluster center exceeds the normal range.

6. The method for detecting anomalies of an Internet of Things card based on an improved K-means algorithm as claimed in claim 1, characterized in that: The S4 further comprises: S41. For a certain IoT card to be tested, extract its feature data and calculate its distance d to the nearest cluster center. test : S42, compare distance d test With threshold T, if d test >T, the IoT card is judged to have abnormal behavior and is an abnormal card. If d test ≤T, it is determined that the IoT card has no abnormal behavior and is a normal card.

7. The IoT card anomaly detection system based on the improved K-means algorithm is applicable to the IoT card anomaly detection method based on the improved K-means algorithm as claimed in any one of claims 1 to 6, characterized in that: include: A data preprocessing module (1), the data processing module (1) is used to perform a preprocessing operation on the usage data of three types of characteristic data of the Internet of Things card to ensure that different characteristic data are analyzed at the same scale; A cluster analysis module (2), wherein the cluster analysis module (2) is used to combine the K-means algorithm with the DBI index to form an improved K-means algorithm, automatically optimize the K value based on the improved K-means algorithm, and select the optimal number of clusters; The anomaly detection module (3) is used to calculate the mean and standard deviation of the distance from the Internet of Things card in each cluster to the cluster center, and to set a threshold T based on the calculation result to determine whether the usage behavior of the Internet of Things card to be tested is normal or abnormal.

8. The IoT card anomaly detection system based on the improved K-means algorithm as claimed in claim 7, characterized in that: The three types of characteristic data of the IoT card include traffic, text messages and voice. The IoT card is assigned to corresponding clusters according to the three types of characteristic data of the IoT card. Each cluster represents a certain usage mode or scenario feature of the IoT card.

9. The IoT card anomaly detection system based on the improved K-means algorithm as claimed in claim 7, characterized in that: The preprocessing operation of the data preprocessing module (1) at least includes data collection, missing value filling and data standardization.

10. The IoT card anomaly detection system based on the improved K-means algorithm as claimed in claim 7, characterized in that: The judgment standard of the abnormality detection module (3) is: taking each IoT card in the cluster as training data, setting a threshold value T based on the training data; for the IoT card to be tested, if the mean and standard deviation of the distance between the IoT card to be tested and the nearest cluster center exceed the threshold value T, then it is determined that the usage behavior of the IoT card to be tested is abnormal, and the IoT card to be tested is an abnormal card; otherwise, if it does not exceed the threshold value T, then it is determined that the usage behavior of the IoT card to be tested is normal, and the IoT card to be tested is a normal card.

Images