Methods, devices, servers, and media for identifying the risk level of IoT SIM cards.

Abstract

This application provides a method, apparatus, server, and medium for identifying the risk level of IoT SIM card numbers. The method includes: collecting IoT SIM card data within any given time period; wherein the IoT SIM card data includes multiple IoT SIM card numbers, and extracting IoT SIM card features; inputting the IoT SIM card features into a trained risk level identification model, causing the trained risk level identification model to perform the following steps: performing matrix rank reduction processing on the IoT SIM card features to obtain low-dimensional IoT SIM card features; calculating a risk score for each IoT SIM card number based on the low-dimensional IoT SIM card features, according to the customer identifier and account identifier corresponding to each IoT SIM card number; identifying the risk level of each IoT SIM card number based on its risk score; and outputting multiple IoT SIM card numbers and their respective risk levels in descending order of risk level. This method improves the efficiency of identifying the risk level of IoT SIM card numbers.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to a method, device, server, and medium for identifying the risk level of IoT card numbers. Background Technology

[0002] In the field of the Internet of Things (IoT), the security monitoring and management of IoT cards is crucial. High-risk IoT card numbers need to be shut down to promptly curb the occurrence of risks.

[0003] Currently, existing technologies analyze the full characteristics of IoT card data to identify the risk level of IoT card numbers.

[0004] However, this method in the existing technology increases the identification time, resulting in low efficiency in identifying the risk level of IoT card numbers. Summary of the Invention

[0005] This application provides a method, apparatus, server, and medium for identifying the risk level of IoT card numbers, in order to improve the efficiency of identifying the risk level of IoT card numbers.

[0006] In a first aspect, embodiments of this application provide a method for identifying the risk level of an IoT card number, comprising: collecting IoT card data within any time period; wherein the IoT card data includes multiple IoT card numbers, and each IoT card number includes a customer identifier and an account identifier; extracting IoT card features from the IoT card data; inputting the IoT card features into a trained risk level identification model, such that the trained risk level identification model performs the following steps: performing matrix rank reduction processing on the IoT card features to obtain low-dimensional IoT card features; calculating a risk score for each IoT card number based on the low-dimensional IoT card features and according to the customer identifier and account identifier corresponding to each IoT card number; identifying the risk level of each IoT card number based on its risk score; and outputting multiple IoT card numbers and their respective risk levels in descending order of risk level.

[0007] In one possible implementation, the IoT card features are subjected to matrix rank reduction processing to obtain low-dimensional IoT card features, including: mapping the IoT card features from a four-dimensional space to a two-dimensional space to obtain low-dimensional IoT card features.

[0008] In one possible implementation, before collecting IoT card data within any given time period, the method further includes: collecting historical IoT card data, wherein the historical IoT card data includes multiple IoT card numbers; labeling the risk levels of IoT card numbers in the historical IoT card data that are considered risky, using the historical IoT card data corresponding to the labeled risk level IoT card numbers as positive samples, and using the historical IoT card data corresponding to the IoT card numbers that are not labeled as risk level as negative samples; extracting positive sample features from the positive samples and negative sample features from the negative samples; using a recursive feature elimination method to filter the positive and negative sample features to obtain a sample training feature set; and inputting the sample training feature set into the risk level identification model for iterative training to obtain a trained risk level identification model.

[0009] In one possible implementation, the sample training feature set is input into the risk level identification model for iterative training to obtain a trained risk level identification model, including: mapping the sample training feature set from a four-dimensional space to a two-dimensional space to obtain a low-dimensional sample training feature set; obtaining position coefficients based on the low-dimensional sample training feature set; and iteratively training a regression tree based on a gradient boosting decision tree algorithm using ranking learning, combining the low-dimensional sample training feature set with the position coefficients, until the number of regression trees reaches a preset value.

[0010] In one possible implementation, the formula for obtaining the position coefficients based on the training feature set of low-dimensional samples is:

[0011]

[0012] In the formula, Indicates the position coefficient. Indicates position Low-dimensional sample training features Indicates position Training features of low-dimensional samples.

[0013] Secondly, embodiments of this application provide an IoT card number risk level identification device, comprising:

[0014] The data acquisition module is used to collect IoT card data within any given time period; the IoT card data includes multiple IoT card numbers, where each IoT card number includes a customer identifier and an account identifier;

[0015] The extraction module is used to extract IoT card features from IoT card data;

[0016] The input module is used to input IoT card features into the trained risk level identification model, so that the trained risk level identification model can perform the following steps;

[0017] The input module includes:

[0018] The acquisition unit is used to perform matrix rank reduction processing on the IoT card features to obtain low-dimensional IoT card features.

[0019] The calculation unit is used to calculate the risk score of each IoT card number based on the characteristics of the low-dimensional IoT card and according to the customer identifier and account identifier corresponding to each IoT card number;

[0020] The identification unit is used to identify the risk level of each IoT card number based on the risk score of each IoT card number;

[0021] The output unit is used to output multiple IoT card numbers and their respective risk levels in descending order of risk level, based on the risk level of each IoT card number.

[0022] In one possible implementation, the acquisition unit is used to map the IoT card features from a four-dimensional space to a two-dimensional space to obtain low-dimensional IoT card features.

[0023] Thirdly, embodiments of this application provide a server, including: a memory and a processor;

[0024] The memory stores computer-executed instructions;

[0025] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0026] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0027] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0028] The IoT card number risk level identification method, device, server, and medium provided in this application embodiment perform matrix rank reduction processing on IoT card features using a trained risk level identification model to obtain low-dimensional IoT card features. Since IoT card numbers under customers and accounts often have certain correlations, a risk score is calculated for each IoT card number based on the customer identifier and account identifier corresponding to each IoT card number. By using low-dimensional IoT card features, the number of features involved in the calculation is reduced. Combined with identifying the risk level of IoT card numbers at the customer and account dimensions, the time for calculating risk scores is reduced, thereby improving the efficiency of identifying the risk level of IoT card numbers. Attached Figure Description

[0029] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0030] Figure 1 A schematic diagram illustrating a scenario for the method of identifying the risk level of an IoT card number provided in an embodiment of this application;

[0031] Figure 2 A flowchart illustrating the method for identifying the risk level of an IoT card number provided in this application embodiment;

[0032] Figure 3 A schematic diagram of the structure of the IoT card number risk level identification device provided in the embodiments of this application;

[0033] Figure 4 This is a schematic diagram of the server structure provided in an embodiment of this application.

[0034] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0035] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0036] Figure 1 This is a schematic diagram illustrating a scenario for the method of identifying the risk level of an IoT card number provided in an embodiment of this application. Figure 1As shown, the specific application scenarios of this application include: receiving device 101, processor 102 and display device 103.

[0037] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the method for identifying the risk level of IoT card numbers. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0038] In the specific implementation process, the receiving device 101 can be an input / output interface or a communication interface, used to collect IoT card data within any time period.

[0039] The processor 102 can process IoT card data within any time period to obtain the risk level of each IoT card number.

[0040] Display device 103 can be used to display the risk level of each IoT card number.

[0041] It should be understood that the aforementioned processor can be implemented by reading instructions from memory and executing those instructions, or it can be implemented through chip circuitry.

[0042] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0043] In the field of the Internet of Things (IoT), the security monitoring and control of IoT SIM cards is crucial. High-risk IoT SIM cards need to be shut down to promptly prevent risks from occurring. Currently, existing technologies analyze the full characteristics of IoT SIM card data to identify the risk level of each SIM card. However, this method increases the identification time, resulting in low efficiency in identifying the risk level of IoT SIM cards.

[0044] To address the aforementioned technical problems, this application proposes the following technical concept: Considering that analyzing all features of IoT card data would increase identification time, the inventors conceived of performing matrix rank reduction processing on IoT card features using a trained risk level identification model to obtain low-dimensional IoT cards, thereby reducing the number of features involved in the calculation; furthermore, since IoT card numbers under customers and accounts often have a certain correlation, the risk level of IoT card numbers can be identified at the customer and account dimensions according to the customer identifier and account identifier corresponding to each IoT card number, reducing identification time and thus improving the efficiency of identifying the risk level of IoT card numbers.

[0045] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0046] Figure 2 A flowchart illustrating the method for identifying the risk level of an IoT card number provided in this application embodiment is shown below. Figure 2 As shown, the method includes:

[0047] S201: Collect IoT card data within any time period; where the IoT card data includes multiple IoT card numbers, and each IoT card number includes a customer identifier and an account identifier.

[0048] Optionally, the IoT card data for any given time period can be all the IoT card data for that day, including but not limited to real-time call detail records, data traffic, SMS data, and billing information.

[0049] S202: Extract IoT card features from IoT card data.

[0050] Optionally, features relevant to risk assessment can be extracted from IoT SIM card data. These features include, but are not limited to, call frequency, data usage patterns, SMS volume, and device location changes.

[0051] Optionally, the extracted IoT card features can be standardized to ensure they have the same scale and range. Standardization methods include mean normalization and Z-score standardization.

[0052] S203: Input the IoT card features into the trained risk level identification model, so that the trained risk level identification model performs the following steps.

[0053] Specifically, step S203 includes S2031~S2034:

[0054] S2031: Perform matrix rank reduction processing on the IoT card features to obtain low-dimensional IoT card features.

[0055] Specifically, IoT card features are mapped from a four-dimensional space to a two-dimensional space to obtain low-dimensional IoT card features.

[0056] In this embodiment, in the first linear layer of the trained risk level identification model, the high-dimensional four-dimensional tensor s=[d1,d2,d3,d4] is transformed into a two-dimensional tensor t=[d1,d2] by matrix rank reduction. This means that the high-dimensional feature space is compressed, reducing the number and complexity of features.

[0057] S2032: Based on the characteristics of low-dimensional IoT cards, calculate the risk score for each IoT card number according to the customer identifier and account identifier corresponding to each IoT card number.

[0058] Optionally, there are 5 risk scores: 4, 3, 2, 1, and 0.

[0059] In this embodiment, the risk score of the IoT card number is calculated based on the characteristics of the low-dimensional IoT card, under the dimensions of customer and account.

[0060] S2033: Identify the risk level of each IoT card number based on its risk score.

[0061] In this embodiment, a risk score corresponds to a risk level. Scores 4, 3, 2, 1, and 0 correspond to mobile phone usage, track segmentation, phone switching, SIM card separation, and high-frequency calling, respectively.

[0062] Among the issues mentioned, the following are possible causes: Mobile phone use: IoT SIM cards are designed for IoT devices and cannot be used on mobile phones; Interruption: Signal interruption or instability can cause IoT devices to malfunction; Device switching: IoT SIM cards are usually bound to specific devices, and switching devices may cause device authentication problems, affecting normal connection and use; SIM card / device separation: IoT devices typically require an IoT SIM card to function properly. If the SIM card / device is separated, the device may not function correctly; High-frequency calls: IoT SIM cards are generally not used for voice calls. If high-frequency calls occur, it may indicate that the IoT SIM card has been misused or stolen.

[0063] S2034: Based on the risk level of each IoT card number, output multiple IoT card numbers and the risk level of each IoT card number in descending order of risk level.

[0064] In this embodiment, the higher the score, the higher the risk level. IoT card numbers with higher risk levels are output first, along with their respective risk grades.

[0065] Optionally, the risk level of the IoT card number can be output to the security monitoring platform for early warning and for relevant personnel to shut down.

[0066] In summary, by performing matrix rank reduction processing on IoT card features using a trained risk level identification model, low-dimensional IoT card features are obtained. Since IoT card numbers under customers and accounts often exhibit certain correlations, a risk score is calculated for each IoT card number based on its corresponding customer and account identifiers. By using low-dimensional IoT card features, the number of features involved in the calculation is reduced. Combined with the identification of IoT card number risk levels at the customer and account dimensions, the time required to calculate risk scores is reduced, thereby improving the efficiency of identifying IoT card number risk levels.

[0067] Based on the above embodiments, this embodiment describes the training process of the risk level identification model, as detailed below:

[0068] S301: Collect historical IoT card data, which includes multiple IoT card numbers.

[0069] In this embodiment, historical IoT card data is collected from multiple IoT terminals under the Spark framework. This includes real-time streaming data and offline data, including but not limited to real-time streaming call detail records, real-time streaming location data, and offline attribute data.

[0070] S302: Label the risk level of IoT card numbers in historical IoT card data, and use the historical IoT card data corresponding to IoT card numbers with labeled risk level as positive samples, and use the historical IoT card data corresponding to IoT card numbers without labeled risk level as negative samples.

[0071] In this embodiment, IoT SIM card numbers identified as risky in historical IoT SIM card data are labeled with 5 levels (label=4, 3, 2, 1, 0), corresponding to mobile phone usage, track interruption, device replacement, SIM card separation, and high-frequency calls, respectively. The labeled IoT SIM card data is saved to HDFS. The sample format is as follows:

[0072]

[0073] In this embodiment, to balance the sample dataset, an oversampling method is used to perform SMOTE (Synthetic Minority Over-sampling Technique) oversampling on the minority class samples. SMOTE oversampling increases the number of minority class samples by synthesizing new minority class samples, thereby improving the model's ability to identify the minority class. The majority class samples are randomly downsampled to reduce the number of majority class samples and prevent the model from becoming overly biased towards the majority class. The ratio of positive to negative samples is a preset ratio, optionally 1:5.

[0074] S303: Extract positive sample features from positive samples and extract negative sample features from negative samples.

[0075] S304: The recursive feature elimination method is used to filter positive and negative sample features to obtain a sample training feature set.

[0076] Among them, recursive feature elimination (RFE) is used to eliminate redundancy among features and select the optimal feature. Starting from all features, the least important features are gradually deleted until a predetermined number of features is reached or other stopping conditions are met.

[0077] Specifically, a regression model is selected, such as linear regression, ridge regression, or Lasso regression. For example, a model supporting L1 regularization, such as Lasso regression, is used. The feature selection process using RFE is as follows: a Lasso regression model is trained using positive and negative sample features. The importance of each feature is evaluated based on the model coefficients, and the least important features are eliminated. One or more features are eliminated at a time until a predetermined number of features is reached or other stopping conditions are met.

[0078] Optionally, an L1 regularization term can be added to the regression model, with the loss function being:

[0079]

[0080] The loss function consists of two parts: the loss term and the loss term.

[0081]

[0082] And the L1 regularization part:

[0083]

[0084] In the formula, n is the number of samples. It is the target value of the feature of the i-th sample. It is the j-th feature value of the i-th sample. It is the regression coefficient. is the regularization parameter, and p is the number of positive and negative sample features.

[0085] In this embodiment, the regularization parameter is adjusted by methods such as cross-validation to balance the complexity and fitting ability of the regression model, thereby filtering positive and negative sample features.

[0086] S305: Input the sample training feature set into the risk level identification model for iterative training to obtain a trained risk level identification model.

[0087] Specifically, the sample training feature set is mapped from a four-dimensional space to a two-dimensional space to obtain a low-dimensional sample training feature set; position coefficients are obtained based on the low-dimensional sample training feature set; and a gradient boosting decision tree algorithm based on ranking learning is used to iteratively train a regression tree based on the low-dimensional sample training feature set and the position coefficients until the number of regression trees reaches a preset value.

[0088] In this embodiment, the formula for obtaining the position coefficients based on the low-dimensional sample training feature set is as follows:

[0089]

[0090] In the formula, Indicates the position coefficient. Indicates position Low-dimensional sample training features Indicates position Training features of low-dimensional samples.

[0091] In this embodiment, the training process is as follows:

[0092]

[0093]

[0094]

[0095]

[0096] Specifically, calculate NDCG(original), which is the original normalized loss-reduction cumulative gain. Here, DCG is the loss-reduction cumulative gain, and IDCG is the ideal loss-reduction cumulative gain. represents the absolute value of the difference between the original NDCG and the NDCG after swapping the positions of i and j; K represents the position coefficient, that is, the mean value of different positions of i and j is taken as the position coefficient, which is used to assist in training a regression tree. Using the mean value of two position changes can reduce the number of parameters during the regression retraining process and improve the training efficiency of the regression tree; λ is used to train a regression tree for the labels. That is, for all labels j, if label(i)>label(j), then accumulate , if label(i)<label(j), then subtract .

[0097] At each leaf node of the regression tree, the score is output through the second-order derivative of the predicted lambda. Based on this, all scores are calculated according to the training features of the low-dimensional samples, that is, α×λ, where α is the learning rate. Then, the results of the IoT card numbers under the customer identifier and account identifier are screened using this score, and the benchmark NDCG of the IoT card numbers under each new customer identifier and account identifier is calculated. Based on this, the above training process is repeated to form a forest until the number of regression trees reaches the setting of the training parameters.

[0098] In summary, on the one hand, the sample training feature set is mapped from a four-dimensional space to a two-dimensional space, reducing the amount of features involved in the calculation; on the other hand, by taking the mean value of different positions of i and j as the position coefficient to assist in training a regression tree, using the mean value of two position changes can significantly reduce the number of parameters during the regression retraining process and improve the training efficiency of the regression tree; on the other hand, the second-order derivative can provide more information about the rate of change of the function. Compared with the first-order derivative, it can more accurately reflect the change trend of the model under the current parameters and improve the convergence speed of the model.

[0099] Figure 3 is a schematic structural diagram of the identification device for the risk level of IoT card numbers provided by the embodiment of the present application. As Figure 3 shown, the identification device for the risk level of IoT card numbers provided in this embodiment includes: a collection module 301, an extraction module 302, and an input module 303. The input module 303 includes an acquisition unit 3031, a calculation unit 3032, an identification unit 3033, and an output unit 303).

[0100] The collection module 301 is used to collect IoT card data within any time period; the IoT card data includes multiple IoT card numbers, and each IoT card number includes a customer identifier and an account identifier; ]>

[0101] The extraction module 302 is used to extract IoT card features from the IoT card data;

[0102] The input module 303 is used to input IoT card features into the trained risk level identification model, so that the trained risk level identification model performs the following steps;

[0103] The input module 303 includes:

[0104] The acquisition unit 3031 is used to perform matrix rank reduction processing on the IoT card features to obtain low-dimensional IoT card features.

[0105] The calculation unit 3032 is used to calculate the risk score of each IoT card number based on the characteristics of the low-dimensional IoT card and according to the customer identifier and account identifier corresponding to each IoT card number.

[0106] The identification unit 3033 is used to identify the risk level of each IoT card number based on the risk score of each IoT card number;

[0107] The output unit 3034 is used to output multiple IoT card numbers and the risk level of each IoT card number in descending order of risk level, based on the risk level of each IoT card number.

[0108] In one possible implementation, the acquisition unit 3031 is specifically used to: map the IoT card features from a four-dimensional space to a two-dimensional space to obtain low-dimensional IoT card features.

[0109] In one possible implementation, the IoT card number risk level identification device further includes: a training module for collecting historical IoT card data, wherein the historical IoT card data includes multiple IoT card numbers; labeling the risk levels of IoT card numbers in the historical IoT card data that are at risk, using the historical IoT card data corresponding to the labeled IoT card numbers as positive samples, and using the historical IoT card data corresponding to the IoT card numbers without labeled risk levels as negative samples; extracting positive sample features from the positive samples and negative sample features from the negative samples; using a recursive feature elimination method to filter the positive and negative sample features to obtain a sample training feature set; and inputting the sample training feature set into the risk level identification model for iterative training to obtain a trained risk level identification model.

[0110] In one possible implementation, the training module is further configured to map the sample training feature set from a four-dimensional space to a two-dimensional space to obtain a low-dimensional sample training feature set; obtain position coefficients based on the low-dimensional sample training feature set; and iteratively train a regression tree based on the gradient boosting decision tree algorithm of ranking learning, combining the position coefficients with the low-dimensional sample training feature set, until the number of regression trees reaches a preset value.

[0111] In one possible implementation, the formula for obtaining the position coefficients based on the training feature set of low-dimensional samples is:

[0112]

[0113] In the formula, Indicates the position coefficient. Indicates position Low-dimensional sample training features Indicates position Training features of low-dimensional samples.

[0114] The IoT card number risk level identification device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0115] Figure 4 This is a schematic diagram of the server structure provided in an embodiment of this application. Figure 4 As shown, the server provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the server also includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0116] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0117] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0118] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0119] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0120] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0121] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0122] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0123] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0124] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0125] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0126] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0127] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0128] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0130] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for identifying the risk level of an IoT card number, characterized in that, Applied to servers, including: Collect IoT card data within any given time period; wherein the IoT card data includes multiple IoT card numbers, and each IoT card number includes a customer identifier and an account identifier; Extract IoT card features from the IoT card data; The IoT card features are input into a trained risk level identification model. This model is obtained by iteratively training a regression tree based on a low-dimensional sample training feature set and location coefficients until the number of regression trees reaches a preset value. The formula for obtaining the location coefficients based on the low-dimensional sample training feature set is as follows: In the formula, Represents the position coefficient, taken as... and The mean value at different locations is used as the location coefficient. Indicates position Low-dimensional sample training features Indicates position Low-dimensional sample training features; The trained risk level identification model then performs the following steps: The IoT card features are subjected to matrix rank reduction processing to obtain low-dimensional IoT card features; Based on the low-dimensional IoT card characteristics, a risk score is calculated for each IoT card number according to the customer identifier and the account identifier corresponding to each IoT card number; Based on the risk score of each IoT card number, the risk level of each IoT card number is identified; Based on the risk level of each IoT SIM card number, output the multiple IoT SIM card numbers and their respective risk levels in descending order of risk level.

2. The method according to claim 1, characterized in that, The matrix rank reduction processing of the IoT card features to obtain low-dimensional IoT card features includes: The IoT card features are mapped from a four-dimensional space to a two-dimensional space to obtain low-dimensional IoT card features.

3. The method according to claim 1 or 2, characterized in that, Before collecting IoT card data within any time period, the process also includes: Collect historical IoT card data, wherein the historical IoT card data includes multiple IoT card numbers; The risk level of IoT card numbers with risks in the historical IoT card data is marked. The historical IoT card data corresponding to the IoT card numbers with marked risk levels is used as positive samples, and the historical IoT card data corresponding to the IoT card numbers without marked risk levels is used as negative samples. Extract positive sample features from the positive samples and extract negative sample features from the negative samples; A recursive feature elimination method is used to filter the positive sample features and the negative sample features to obtain a sample training feature set; The sample training feature set is input into the risk level identification model for iterative training to obtain a trained risk level identification model.

4. The method according to claim 3, characterized in that, The step of inputting the sample training feature set into the risk level identification model for iterative training to obtain a trained risk level identification model includes: The sample training feature set is mapped from a four-dimensional space to a two-dimensional space to obtain a low-dimensional sample training feature set; The position coefficients are obtained by training a feature set based on low-dimensional samples; The gradient boosting decision tree algorithm based on ranking learning trains a feature set based on low-dimensional samples, and iteratively trains a regression tree by combining the position coefficients until the number of regression trees reaches a preset value.

5. A device for identifying the risk level of an Internet of Things (IoT) card number, characterized in that, Applied to servers, including: The data acquisition module is used to collect IoT card data within any time period; wherein the IoT card data includes multiple IoT card numbers, and each IoT card number includes a customer identifier and an account identifier; The extraction module is used to extract IoT card features from the IoT card data; The input module is used to input the IoT card features into a trained risk level identification model. The trained risk level identification model is obtained by iteratively training a regression tree based on a low-dimensional sample training feature set and location coefficients until the number of regression trees reaches a preset value. The formula for obtaining the location coefficients based on the low-dimensional sample training feature set is as follows: In the formula, Represents the position coefficient, taken as... and The mean value at different locations is used as the location coefficient. Indicates position Low-dimensional sample training features Indicates position Low-dimensional sample training features; The trained risk level identification model then performs the following steps; The input module includes: The acquisition unit is used to perform matrix rank reduction processing on the IoT card features to obtain low-dimensional IoT card features. The calculation unit is used to calculate the risk score of each IoT card number based on the low-dimensional IoT card characteristics, according to the customer identifier and the account identifier corresponding to each IoT card number; The identification unit is used to identify the risk level of each IoT card number based on the risk score of each IoT card number; The output unit is used to output the multiple IoT card numbers and the risk level of each IoT card number in descending order of risk level, according to the risk level of each IoT card number.

6. The apparatus according to claim 5, characterized in that, The acquisition unit is used to map the IoT card features from a four-dimensional space to a two-dimensional space to obtain low-dimensional IoT card features.

7. A server, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-4.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-4.

Images