Abnormal Internet of Things number card determination method, apparatus and device, and storage medium

Abstract

The invention provides an abnormal Internet of Things number card determination method and device, equipment and a storage medium. The method comprises the following steps: firstly, based on a relational graph convolutional neural network, performing feature extraction on a pre-acquired use behavior acquisition graph of at least one Internet of Things number card to obtain graph feature information, the use behavior acquisition graph being a graph structure of use behavior records of the at least one Internet of Things number card; then, the graph feature information of each Internet of Things number card is input into a pre-trained Transform sequence model, hidden layer features corresponding to each Internet of Things number card are extracted, and the hidden layer features are behavior patterns and rules hidden in the corresponding graph feature information; and finally, according to the hidden layer feature corresponding to each Internet of Things number card, determining an abnormal Internet of Things number card. According to the method provided by the invention, the determination of the abnormal Internet of Things number card is realized, and the accuracy of determining the abnormal Internet of Things number card is improved.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things technology, and in particular to a method, device, equipment and storage medium for determining an abnormal Internet of Things number card. Background Art

[0002] IoT cards are mobile communication access services provided to IoT users based on the public IoT. They use IoT-specific number segments, support basic communication services such as SMS, wireless data, and voice through dedicated network element devices, and provide intelligent connection services such as communication connection management and terminals. In the field of IoT card anti-fraud, in order to protect the rights and interests of customers and prevent a series of fraudulent behaviors, it is necessary to identify and determine IoT cards that may have abnormalities and shut down the cards to minimize losses.

[0003] In the prior art, a lightweight gradient boosting machine (Light GBM) method is used to predict and output IoT cards that may be involved in fraud. This method uses a histogram algorithm and a decision tree with leaf node segmentation to improve the efficiency of training and prediction.

[0004] However, since the information of IoT number cards usually contains a lot of noise, the existing methods are sensitive to noise and may overfit, resulting in low accuracy in determining abnormal IoT number cards. Summary of the invention

[0005] The present application provides a method, device, equipment and storage medium for determining an abnormal Internet of Things number card, so as to solve the technical problem of low accuracy in determining abnormal Internet of Things number cards.

[0006] In a first aspect, the present application provides a method for determining an abnormal IoT card, comprising:

[0007] The relationship-based graph convolutional neural network extracts features from a pre-acquired usage behavior collection graph of at least one IoT number card to obtain graph feature information; the usage behavior collection graph is a graph structure of usage behavior records of the at least one IoT number card, and the relationship-based graph convolutional neural network is trained based on historical usage behavior collection graphs of multiple IoT number cards;

[0008] Input the graph feature information of each IoT card into a pre-trained Transformer sequence model to extract the hidden features corresponding to each IoT card; the hidden features are the behavior patterns and rules hidden in the corresponding graph feature information, and the pre-trained Transformer sequence model is trained based on the graph feature information of the historical usage behavior data of multiple IoT cards;

[0009] Abnormal IoT cards are identified based on the hidden features corresponding to each IoT card.

[0010] In one or more embodiments, the method further comprises:

[0011] For each IoT number card, pre-process the pre-acquired usage information of the IoT number card to obtain processed usage information;

[0012] Divide the preset monitoring time into multiple time windows;

[0013] In each time window, a usage behavior collection graph of the Internet of Things card is constructed based on the processed usage information.

[0014] In one or more embodiments, the relationship-based graph convolutional neural network extracts features from a pre-acquired usage behavior collection graph of at least one IoT card to obtain graph feature information, including:

[0015] For each IoT card, each node in the usage behavior collection graph of the IoT card is initialized to obtain an initialization vector corresponding to each node;

[0016] Traversing each node in the usage behavior collection graph, aggregating neighbor node information, and obtaining aggregated neighbor node information;

[0017] For each node, update the feature vector of the node according to the aggregated neighbor node information corresponding to the node and the initialization vector of the node;

[0018] Repeat the neighbor node information aggregation and feature vector update of each node multiple times to obtain the graph feature information corresponding to the Internet of Things card.

[0019] In one or more embodiments, determining an abnormal IoT number card according to the hidden layer features corresponding to each IoT number card includes:

[0020] For each IoT card, the hidden layer features of the IoT card are input into the fully connected layer for processing to obtain the processed hidden layer features;

[0021] Normalizing the processed hidden layer features to obtain normalized hidden layer features;

[0022] Probabilistically predicting the normalized hidden features to obtain the fraud probability corresponding to the IoT card;

[0023] Based on the fraud probability corresponding to each IoT number card and a preset probability threshold, the abnormal IoT number card is determined.

[0024] In one or more embodiments, determining the abnormal IoT number card based on the fraud probability corresponding to each IoT number card and a preset probability threshold includes:

[0025] For each Internet of Things card, if the fraud probability corresponding to the Internet of Things card is greater than the probability threshold, the Internet of Things card is determined as the abnormal Internet of Things card.

[0026] In one or more embodiments, for each Internet of Things card, the usage behavior collection graph of the Internet of Things card includes: information of a first Internet of Things card connected to the Internet of Things card, information of an access object of the Internet of Things card, and an association relationship between the Internet of Things card and the access object.

[0027] In a second aspect, the present application provides a device for determining an abnormal IoT card, including:

[0028] A first extraction module is used for performing feature extraction on a pre-acquired usage behavior collection graph of at least one IoT number card using a relationship-based graph convolutional neural network to obtain graph feature information; the usage behavior collection graph is a graph structure of usage behavior records of the at least one IoT number card, and the relationship-based graph convolutional neural network is trained based on historical usage behavior collection graphs of multiple IoT number cards;

[0029] The second extraction module is used to input the graph feature information of each IoT card into a pre-trained Transformer sequence model to extract the hidden features corresponding to each IoT card; the hidden features are the behavior patterns and rules hidden in the corresponding graph feature information, and the pre-trained Transformer sequence model is trained based on the graph feature information of the historical usage behavior data of multiple IoT cards;

[0030] The determination module is used to determine abnormal IoT number cards based on the hidden layer features corresponding to each IoT number card.

[0031] In one or more embodiments, the first extraction module is further configured to:

[0032] For each IoT number card, pre-process the pre-acquired usage information of the IoT number card to obtain processed usage information;

[0033] Divide the preset monitoring time into multiple time windows;

[0034] In each time window, a usage behavior collection graph of the Internet of Things card is constructed based on the processed usage information.

[0035] In one or more embodiments, the relationship-based graph convolutional neural network performs feature extraction on a pre-acquired usage behavior collection graph of at least one IoT card to obtain graph feature information, and the first extraction module is specifically used to:

[0036] For each IoT card, each node in the usage behavior collection graph of the IoT card is initialized to obtain an initialization vector corresponding to each node;

[0037] Traversing each node in the usage behavior collection graph, aggregating neighbor node information, and obtaining aggregated neighbor node information;

[0038] For each node, update the feature vector of the node according to the aggregated neighbor node information corresponding to the node and the initialization vector of the node;

[0039] Repeat the neighbor node information aggregation and feature vector update of each node multiple times to obtain the graph feature information corresponding to the Internet of Things card.

[0040] In one or more embodiments, the determining module is specifically configured to:

[0041] For each IoT card, the hidden layer features of the IoT card are input into the fully connected layer for processing to obtain the processed hidden layer features;

[0042] Normalizing the processed hidden layer features to obtain normalized hidden layer features;

[0043] Probabilistically predicting the normalized hidden features to obtain the fraud probability corresponding to the IoT card;

[0044] Based on the fraud probability corresponding to each IoT number card and a preset probability threshold, the abnormal IoT number card is determined.

[0045] In one or more embodiments, the abnormal IoT number card is determined based on the fraud probability corresponding to each IoT number card and a preset probability threshold, and the determination module is specifically used to:

[0046] For each Internet of Things card, if the fraud probability corresponding to the Internet of Things card is greater than the probability threshold, the Internet of Things card is determined as the abnormal Internet of Things card.

[0047] In one or more embodiments, for each Internet of Things card, the usage behavior collection graph of the Internet of Things card includes: Internet of Things card information connected to the Internet of Things card, access object information of the Internet of Things card, and the association relationship between the Internet of Things card and the access object.

[0048] In a third aspect, the present application provides an electronic device, including:

[0049] a processor, and a memory communicatively connected to the processor;

[0050] The memory stores computer-executable instructions;

[0051] The processor executes the computer-executable instructions stored in the memory to implement the method described in the first aspect and any one of the embodiments above.

[0052] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the above-mentioned first aspect and any one of the embodiments.

[0053] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, is used to implement a method for determining an abnormal Internet of Things card as described in the first aspect and various possible implementations of the first aspect.

[0054] The present application provides a method, device, equipment and storage medium for determining abnormal Internet of Things number cards. The method first extracts features from a pre-acquired usage behavior collection graph of at least one Internet of Things number card based on a relational graph convolutional neural network to obtain graph feature information; then, the graph feature information of each Internet of Things number card is input into a pre-trained Transformer sequence model to extract the hidden features corresponding to each Internet of Things number card; finally, the abnormal Internet of Things number card is determined based on the hidden features corresponding to each Internet of Things number card. In the above method, at least one Internet of Things number card usage behavior collection graph is pre-constructed, and a relation-based graph convolutional neural network can be used to extract local features of nodes and edges from the usage behavior collection graph to obtain graph feature information. The graph feature information can better describe the usage behavior of the Internet of Things number card and help subsequent models extract more meaningful sequence features. Afterwards, the Transformer sequence model is used for sequence modeling, which can effectively capture the behavior changes of the Internet of Things number card at different times, extract the contextual information of the behavior changes, and form the hidden features of each Internet of Things number card. Finally, the hidden features corresponding to each IoT card are compared with the hidden features under the normal behavior mode to determine the abnormal IoT card. The graph features extracted by the relationship-based graph convolutional neural network and the sequence modeling capability of Transformer can efficiently and accurately identify abnormal IoT cards. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0056] Figure 1 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 1 ;

[0057] Figure 2 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 2 ;

[0058] Figure 3 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 3 ;

[0059] Figure 4 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 4 ;

[0060] Figure 5 A schematic diagram of the structure of a device for determining an abnormal IoT number card provided in an embodiment of the present application;

[0061] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0062] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0063] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0064] First, the terms used in this application are explained:

[0065] Relational graph convolutional network (R-GCN): refers to an extended graph convolutional neural network that effectively solves the modeling problem of multi-relational graphs by introducing the concept of relational types into traditional graph convolutional neural networks. R-GCN can process complex graph structure data and is particularly suitable for tasks that require consideration of multiple relational types, such as knowledge graphs, social networks, and the Internet of Things.

[0066] Transformer sequence model: refers to a deep learning architecture based on the self-attention mechanism. It captures the global dependency of the sequence by calculating the relationship between each position in the input sequence. It can better handle long-distance dependencies and improve the training and prediction efficiency of the model.

[0067] Self-Attention: refers to an attention mechanism that associates different positions of a single sequence to calculate the representation of the same sequence. The self-attention mechanism can explicitly capture the relationship between any two elements in the sequence, regardless of the distance between the two elements.

[0068] Secondly, the technical background technology involved in this application is described as follows:

[0069] The IoT card is a mobile communication access service provided to IoT users based on the public IoT. It uses IoT-specific number segments, supports basic communication services such as SMS, wireless data and voice through dedicated network element devices, and provides intelligent connection services such as communication connection management and terminals. In the field of IoT card anti-fraud, in order to protect the rights and interests of customers and prevent a series of fraudulent behaviors, it is necessary to predict IoT cards that may have abnormalities and shut down the cards to minimize losses. Traditional rule-based IoT card parsing methods often require the selection of several features. The effectiveness of the model depends on the quality of the features. The defined features are usually highly subjective and one-sided, and cannot meet the needs of increasingly complex actual scenarios.

[0070] In the prior art, the traditional rule matching method is used to determine abnormal IoT number cards by selecting several features, or the Light Gradient Boosting Machine (LightGBM) method is used to predict and output IoT number cards that may be involved in fraud. This method uses a histogram algorithm and a decision tree with leaf node segmentation to improve the efficiency of training and prediction.

[0071] However, the features defined by traditional methods are usually highly subjective and one-sided, and cannot meet the needs of increasingly complex practical scenarios. The LightGBM method is sensitive to the large amount of noise carried in the information of IoT cards, and overfitting may occur. The existing technical methods have the problem of low accuracy in determining abnormal IoT cards.

[0072] The method for determining abnormal IoT number cards provided in the present application is intended to solve the above technical problems of the prior art. The inventive concept of the present application is as follows: Analyze the usage behavior of at least one IoT number card, firstly model the original usage behavior of the IoT number card based on a certain graph structure to obtain a usage behavior collection graph, and then use a relationship-based graph convolutional neural network to learn the pre-acquired usage behavior collection graph to extract graph feature information, which can better describe the usage behavior of the IoT number card; then further input the graph feature information into the Transformer sequence model to capture the relationship between the usage behaviors, obtain the hidden features corresponding to each IoT number card, and compare them with the hidden features of the normal usage behaviors, so as to discover the hidden abnormal usage behaviors and further determine the abnormal IoT number cards. The combination of relationship-based graph convolutional neural network and Transformer can extract fine-grained features from complex usage behavior collection graphs, and can effectively identify potential anomalies, thereby improving the accuracy of determining abnormal IoT number cards.

[0073] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0074] Figure 1 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 1 .like Figure 1 As shown, the method for determining an abnormal IoT card includes the following steps:

[0075] S110, using a relationship-based graph convolutional neural network, extracting features from a pre-acquired usage behavior collection graph of at least one IoT card to obtain graph feature information;

[0076] The usage behavior collection graph is a graph structure of usage behavior records of at least one IoT card, and the relationship-based graph convolutional neural network is trained based on historical usage behavior collection graphs of multiple IoT cards;

[0077] In this step, first, a usage behavior collection graph of at least one Internet of Things card is obtained to obtain a graph data structure. Based on a relationship-based graph convolutional neural network, learning is performed on the usage behavior collection graph of at least one Internet of Things card, and feature extraction is performed on the usage behavior collection graph of the Internet of Things card to obtain graph feature information that can describe the usage behavior information of at least one Internet of Things card.

[0078] Exemplarily, the graph feature information is used to describe the usage behavior information of each IoT card in detail. Each IoT card can be used as a node in the usage behavior collection graph, and a multi-layer graph convolution operation can be performed through a graph convolutional neural network. Based on the behavior and relationship information of the IoT card, the feature representation of at least one IoT card is learned from local to global, including the edge features and node features of the usage behavior collection graph, and these features are recorded as graph feature information.

[0079] In one possible implementation, for each Internet of Things card, the usage behavior collection graph of the Internet of Things card includes: information of the first Internet of Things card connected to the Internet of Things card, access object information of the Internet of Things card, and the association relationship between the Internet of Things card and the access object.

[0080] In a possible implementation, the first Internet of Things number card information connected to the Internet of Things number card may include: a unique identifier of the first Internet of Things number card (which may be the number of the first Internet of Things number card), activation information of the first Internet of Things number card (whether the number card is in an activated state), and location information of the first Internet of Things number card (the geographical location to which the number card belongs);

[0081] The access object information of the IoT card may include: the first IoT card accessed, the website information accessed, the location information accessed, the log information accessed, etc.;

[0082] The association relationship between the IoT card and the access object may include: roaming relationship, dial-up relationship, network connection relationship, data transmission relationship, etc.

[0083] Exemplarily, the website access information of the IoT card may be a cloud service platform, application interface, database platform, etc.; the accessed location information may be the location in the positioning service, etc.; the accessed log information may be the status log of the IoT card or the behavior log generated by connecting with other access objects.

[0084] S120, inputting the graph feature information of each IoT number card into a pre-trained Transformer sequence model to extract the hidden layer features corresponding to each IoT number card;

[0085] Among them, the hidden features are the behavioral patterns and rules hidden in the corresponding graph feature information. The pre-trained Transformer sequence model is trained based on the graph feature information of the historical usage behavior data of multiple IoT number cards.

[0086] In this step, the graph feature information of each IoT card is converted into the form of a time series. The graph feature information containing the usage behavior of each IoT card is sequence modeled by pre-training the Transformer sequence model to capture the dependency relationship of the IoT card usage behavior at different times in the time series, and extract the hidden features corresponding to each IoT card.

[0087] Exemplarily, the hidden features corresponding to each IoT card include behavioral patterns and rules hidden in the time series, which can reflect the behavioral change trends and periodic behavioral characteristics of each IoT card during use. For example, in the time series, the IoT card will periodically access the same access object.

[0088] In one possible implementation, the graph feature information of the historical usage behavior data is converted into a time series form and input into the Transformer sequence model. Through the self-attention mechanism, all positions in the time series are considered at the same time, and various hidden features in the time series, such as long-term trends, periodic changes, etc., are learned. The usage behavior of the IoT card input into the model in the specified time series is predicted by training through supervised learning or unsupervised learning. The prediction is compared with the actual usage behavior of the IoT card in the specified time series, and the parameters of the Transformer sequence model are adjusted and optimized according to the comparison results.

[0089] S130. Determine abnormal Internet of Things number cards based on the hidden features corresponding to each Internet of Things number card.

[0090] In this step, based on the usage behavior characteristics of each IoT card reflected by the latent features corresponding to the IoT card, the IoT card whose usage behavior characteristics obviously deviate from the historical usage behavior characteristics is determined as an abnormal IoT card.

[0091] In one possible implementation, an abnormal IoT card may be one whose usage behavior does not conform to the regularity of its usage behavior within a fixed time period. For example, an IoT card visits the W website five times a week, and within a certain week, it visits the W website fifty times. In this case, the IoT card is an abnormal IoT card.

[0092] An abnormal IoT card may also be one whose usage behavior does not conform to its changing trend. For example, the usage time of an IoT card gradually decreases, but within a certain period of time, the usage time of the IoT card suddenly and continuously surges and maintains a gradually increasing trend, then it is determined to be an abnormal IoT card.

[0093] The method for determining an abnormal IoT card provided in the embodiment of the present application first extracts features from a pre-acquired usage behavior collection graph of at least one IoT card based on a relationship-based graph convolutional neural network to obtain graph feature information, wherein the usage behavior collection graph is a graph structure of usage behavior records of at least one IoT card, and the relationship-based graph convolutional neural network is trained based on the historical usage behavior collection graphs of multiple IoT cards; then, the graph feature information of each IoT card is input into a pre-trained Transformer sequence model to extract the hidden layer features corresponding to each IoT card, wherein the hidden layer features are the behavior patterns and laws hidden in the corresponding graph feature information, and the pre-trained Transformer sequence model is trained based on the graph feature information of the historical usage behavior data of multiple IoT cards; finally, the abnormal IoT card is determined based on the hidden layer features corresponding to each IoT card. In this embodiment, a usage behavior collection graph of at least one IoT card is pre-constructed, and a relationship-based graph convolutional neural network can be used to extract local features of nodes and edges from the usage behavior collection graph to obtain graph feature information, and the graph feature information can be better described based on the graph feature information, and help subsequent models extract more meaningful sequence features. Afterwards, the Transformer sequence model is used for sequence modeling, which can effectively capture the behavior changes of IoT cards at different times, extract the contextual information of the behavior changes, and form the hidden features of each IoT card. Finally, the hidden features corresponding to each IoT card are compared with the hidden features under the normal behavior mode to identify abnormal IoT cards. The graph features extracted by the relationship-based graph convolutional neural network and the sequence modeling capability of the Transformer can efficiently and accurately identify abnormal IoT cards.

[0094] Based on the above embodiments, Figure 2 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 2 .like Figure 2 As shown, the method for determining an abnormal IoT card also includes the following steps:

[0095] S210: For each Internet of Things card, pre-process the pre-acquired usage information of the Internet of Things card to obtain processed usage information.

[0096] In this step, usage information is obtained in advance for each IoT card. The content and format of the usage information of each IoT card may be different. It is necessary to preprocess the pre-acquired usage information of the IoT card to obtain usage information in a unified format, that is, the processed usage information.

[0097] In a possible implementation, the pre-acquired usage information of the IoT card may be original usage information obtained from different data sources, which can reflect the usage behavior of the IoT card, including the access object of the IoT card and the behavior oriented to the access object, for example, sending text messages to other IoT cards;

[0098] Preprocessing the usage information of the Internet of Things number card can include classifying and recording the usage information according to the specific time of use of the Internet of Things number card, usage behavior type, access object type, etc., where the usage type can include SMS, roaming, data access, etc. Afterwards, the missing data in the usage information can be filled or directly deleted, and the formats of different usage information contents can be converted. For example, the time format can be unified into the standard format of "year-month-day hour-minute-second".

[0099] For example, the content of the usage information of IoT card A obtained in advance is "In T m When IoT card A sends a text message to IoT card B, the usage information of IoT card A after processing is "Time: T m ; Access object type: IoT card B; Usage type: SMS".

[0100] S220: Divide the preset monitoring time into multiple time windows.

[0101] In this step, the usage information of the Internet of Things card within the time period is monitored during the preset monitoring time, and the monitoring time is divided into multiple time windows of the same size according to the preset division size.

[0102] In one possible implementation, the monitoring time range is first clarified, including the monitoring start time and end time. The size of the time window is set according to actual needs. The preset monitoring time can be divided into fixed-size time windows, or the window size can be dynamically adjusted according to the data volume or specific conditions.

[0103] Exemplarily, the preset monitoring time is divided into fixed-size time windows, with the start time of the monitoring time being T0 and the end time being T N , the size of the time window is T, if the usage time of an IoT card is T m , then the condition T0+m×T=T is satisfied m , where m is the window parameter related to the IoT card.

[0104] S230. In each time window, a usage behavior collection graph of the Internet of Things card is constructed based on the processed usage information.

[0105] In this step, within each time window, based on the processed usage information of the current time window and the previous time window, the first Internet of Things card information connected to the Internet of Things card, the access object information of the Internet of Things card, and the association between the Internet of Things card and the access object in the usage information are constructed in the form of triples to obtain a usage behavior collection graph of the Internet of Things card.

[0106] In a possible implementation, the access object of the IoT card is used as a node of the usage behavior collection graph, the node corresponding to the access object is connected according to the association relationship between the IoT card and the access object, and the content attached to the node or relationship is used as the attribute of the usage behavior collection graph structure. The constructed usage behavior collection graph of the IoT card can be stored in a graph database, and the usage behavior collection graph of the IoT card can be stored and managed in the form of a graph structure (nodes, relationships, attributes).

[0107] For example, each IoT card usage behavior collection graph consists of a triple<V,E,M> The set V represents the set of IoT cards that are connected to the current IoT card in each time window, the set E represents the set of objects accessed by the IoT card (such as website information, location information, log information, etc.), and the set M represents the correspondence between the IoT card and the accessed objects.

[0108] The method for determining abnormal IoT number cards provided in the embodiment of the present application pre-processes the usage information of the IoT number cards acquired in advance for each IoT number card to obtain the processed usage information, and then divides the preset monitoring time into multiple time windows. In each time window, a usage behavior collection graph of the IoT number card is constructed based on the processed usage information. In this embodiment, by pre-processing the usage information of the IoT number card acquired in advance, the content and format of the usage information are standardized to facilitate further analysis. At the same time, the preset monitoring time is divided into multiple time windows, so that the usage behavior information of the IoT number card in different time periods can be accurately obtained. In each time window, a usage behavior collection graph of the IoT number card is constructed based on the processed usage information. The complex usage information of the IoT number card is clearly represented in the form of a graph structure, which can help analyze and determine abnormal IoT number cards.

[0109] Based on the above embodiments, Figure 3 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 3 .like Figure 3 As shown, a possible implementation of the above step S110 also includes the following steps:

[0110] S310. For each IoT card, initialize each node in the usage behavior collection graph of the IoT card to obtain an initialization vector corresponding to each node.

[0111] In this step, each IoT number card corresponds to each node in the usage behavior collection graph, initializes each node, maps the information of the IoT number card of each node into a vector of fixed dimension, and obtains the initialization vector corresponding to each node as the initial representation of each node.

[0112] In one possible implementation, the method for initializing each node in the usage behavior collection graph of the Internet of Things number card can be to initialize it based on the specific usage behavior, that is, according to the usage behavior information contained in the usage behavior collection graph of each Internet of Things number card, a dimensionality reduction method or a clustering method is used to map the usage behavior of the Internet of Things number card corresponding to each node to a low-dimensional space to obtain the initialization vector corresponding to each node.

[0113] S320 , traverse each node in the usage behavior collection graph, aggregate neighbor node information, and obtain aggregated neighbor node information.

[0114] In this step, each node in the usage behavior collection graph is first traversed. Each node has neighbor nodes connected to it. The information of the neighbor nodes of each node is aggregated to obtain the aggregated neighbor node information.

[0115] Exemplarily, the neighbor node may be the access object of the Internet of Things number card corresponding to each node in the usage behavior collection graph, and the edge connecting each node to the neighbor node may be the association relationship between the Internet of Things number card and the access object.

[0116] In one possible implementation, each node aggregates neighbor nodes by summing the neighbor nodes, that is, directly adding the feature vectors of all neighbor nodes; averaging the neighbor nodes, that is, calculating the average value of all neighbor nodes; or performing weighted summation of the neighbor nodes, that is, setting weights to perform weighted summation of the neighbor nodes, where the weights can be obtained by learning the edges of different graph structures using a graph convolutional neural network.

[0117] S330: For each node, update the feature vector of the node according to the aggregated neighbor node information corresponding to the node and the initialization vector of the node.

[0118] In this step, for each node, the aggregated neighbor node information corresponding to the node and the node's initialization vector are combined, and the node's feature vector is updated according to the node feature update rule.

[0119] In one possible implementation, in each layer of the graph convolutional neural network, a node updates its own feature vector by aggregating information from its neighboring nodes. The specific node feature update rule formula is as follows:

[0120]

[0121] in, Represents the characteristics of the current node itself after the update, Represents the characteristics of the input neighbor nodes, Represents the input characteristics of the current node. is the weight matrix of the relationship features between the current node and its neighboring nodes, W0 is the weight matrix of the current node itself, represents the set of neighbor nodes of node i under the relationship r∈R, C i,r represents the regularization constant parameter, and σ represents the activation function.

[0122] Exemplarily, the weight matrix of the node can be obtained by learning the structure and node information of the IoT card usage behavior collection graph through a graph convolutional neural network. The edges connecting the nodes are different, and the corresponding association relationship between the IoT card and the access object is different, and the learned weights are also different.

[0123] S340. Repeat the aggregation of neighbor node information and the update of the feature vector of each node multiple times to obtain the graph feature information corresponding to the Internet of Things card.

[0124] In this step, by repeatedly aggregating neighbor node information and updating the feature vector of each node, each repetition will further integrate more neighbor node information, improve the quality of node feature representation, and finally obtain the graph feature information of the IoT number card corresponding to each node after the feature vector is updated.

[0125] In a possible implementation, for each node, the information of its neighboring nodes is aggregated, and the feature vector of the node is updated until all nodes are updated.

[0126] The method for determining abnormal Internet of Things number cards provided in the embodiment of the present application is to initialize each node in the usage behavior collection graph of the Internet of Things number card for each Internet of Things number card, and obtain the initialization vector corresponding to each node; then, traverse each node in the usage behavior collection graph, aggregate neighbor node information, and obtain aggregated neighbor node information; then for each node, according to the aggregated neighbor node information corresponding to the node and the node's initialization vector, update the node's feature vector; finally, repeat the neighbor node information aggregation and the feature vector update of each node multiple times to obtain the graph feature information corresponding to the Internet of Things number card. In this embodiment, by aggregating the neighbor node information, more information related to the neighbor node can be integrated into each node in the usage behavior collection graph, and by updating the feature vector of the node, the feature representation of the node can be enriched. Then, by repeating the neighbor node information aggregation and the feature vector update of each node multiple times, the structural information of the usage behavior collection graph, that is, the relationship between nodes, can be effectively learned, which is conducive to the subsequent further determination of abnormal Internet of Things number cards.

[0127] Based on the above embodiments, Figure 4 Schematic diagram of the process of determining an abnormal IoT card provided in the embodiment of the present application Figure 4 .like Figure 4 As shown, a possible implementation of the above step S130 also includes the following steps:

[0128] S410: For each IoT card, the hidden layer features of the IoT card are input into the fully connected layer for processing to obtain the processed hidden layer features.

[0129] In this step, for each IoT card, the hidden features reflect the long-term behavioral change trend and periodic behavioral characteristics of the IoT card. The hidden features are input into the fully connected layer for processing. The fully connected layer reduces or reorganizes the hidden features to obtain more compact high-dimensional features, which are the processed hidden features.

[0130] In one possible implementation, the hidden feature is a vector, and the hidden features of the IoT card are input into the fully connected layer for processing, including: the fully connected layer linearly transforms the input hidden features through a weight matrix, and configures different weights for different parts of the hidden features. The output of each layer in the fully connected layer is the weighted sum of the output of the previous layer; then, after the linear change, an activation function is used to introduce nonlinearity to help learn a more complex hidden feature representation.

[0131] S420, normalizing the processed hidden layer features to obtain normalized hidden layer features.

[0132] In this step, in order to further analyze the behavioral characteristics of the IoT card based on the processed hidden layer features, the hidden layer features are normalized and converted into representations within a specific range, which is beneficial for subsequent processing.

[0133] In a possible implementation, an activation function is introduced to normalize the processed hidden layer features so that each feature becomes consistent at different scales.

[0134] Exemplarily, the activation function may be a softmax activation function, which converts the processed hidden feature vector output by the fully connected layer into a probability distribution, in which the probability value of each element is between 0 and 1, and the sum of the probability values ​​of all elements is 1.

[0135] S430. Perform probability prediction on the normalized hidden layer features to obtain the fraud probability corresponding to the IoT card.

[0136] In this step, the possibility of fraud involving the IoT card can be analyzed based on the normalized hidden features. By learning the hidden features, analyzing the possible abnormal hidden features and making probability predictions, the corresponding probability of fraud involving the IoT card can be obtained.

[0137] In one possible implementation, the normalized hidden features can be probabilistically predicted through a probability prediction model, the hidden features of each IoT card can be probabilistically modeled, and abnormal hidden features can be distinguished from normal hidden features. When abnormal hidden features appear, it indicates that the IoT card may be involved in fraud, and the possibility of fraud is intuitively represented by the probability value of fraud.

[0138] Exemplarily, the probability prediction model can be the output layer of a neural network model, a logistic regression model, etc.

[0139] S440. Determine abnormal IoT number cards based on the fraud probability corresponding to each IoT number card and a preset probability threshold.

[0140] In this step, a probability threshold for the probability of fraud involving an IoT card is pre-set to distinguish between normal and abnormal IoT cards. The probability of fraud involving each IoT card is compared with the preset probability threshold, and the abnormal IoT card is determined based on the comparison result.

[0141] Exemplarily, the fraud probability corresponding to each IoT number card is compared with a preset probability threshold. The result of the comparison may be that the fraud probability corresponding to each IoT number card is greater than the preset probability threshold, or it may be less than or equal to the preset probability threshold.

[0142] In a possible implementation, step S440 may include the following implementation: for each Internet of Things card, if the fraud probability corresponding to the Internet of Things card is greater than the probability threshold, the Internet of Things card is determined to be an abnormal Internet of Things card.

[0143] Exemplarily, the preset probability threshold is 0.7, the probability of fraud involving IoT card X is 0.8, the probability of fraud involving IoT card Y is 0.65, and the probability of fraud involving IoT card Z is 0.7. Among them, the probability of fraud involving physical network card X is 0.8, which is greater than the preset probability threshold of 0.7, then IoT card X is determined to be an abnormal IoT card.

[0144] The method for determining abnormal Internet of Things number cards provided in the embodiment of the present application, for each Internet of Things number card, inputs the hidden layer features of the Internet of Things number card into the fully connected layer for processing to obtain the processed hidden layer features; then the processed hidden layer features are normalized to obtain the normalized hidden layer features; then the normalized hidden layer features are probability predicted to obtain the fraud probability corresponding to the Internet of Things number card; finally, based on the fraud probability corresponding to each Internet of Things number card and the preset probability threshold, the abnormal Internet of Things number card is determined. In this embodiment, the more complex behavior patterns and relationships in the hidden layer features of the Internet of Things number card are captured by the fully connected layer, the expression ability of the hidden layer features is improved, thereby improving the accuracy of the prediction of the fraud probability of the Internet of Things number card; the hidden layer features are standardized by normalization processing to avoid the adverse effects of the scale differences between different hidden layer features on the prediction of the fraud probability of the Internet of Things number card; by presetting the probability threshold, the fraud probability of the Internet of Things number card is compared with the preset probability threshold, and it can be accurately judged whether the Internet of Things number card is abnormal.

[0145] Based on the above embodiments, the following are device embodiments involved in this application:

[0146] Figure 5 This is a schematic diagram of the structure of the device for determining an abnormal IoT card provided in an embodiment of the present application. Figure 5 As shown, the abnormal IoT card determination device 500 includes:

[0147] The first extraction module 510 is used for performing feature extraction on a pre-acquired usage behavior collection graph of at least one IoT card using a relationship-based graph convolutional neural network to obtain graph feature information; the usage behavior collection graph is a graph structure of usage behavior records of at least one IoT card, and the relationship-based graph convolutional neural network is obtained by training based on historical usage behavior collection graphs of multiple IoT cards;

[0148] The second extraction module 520 is used to input the graph feature information of each IoT card into a pre-trained Transformer sequence model to extract the hidden features corresponding to each IoT card; the hidden features are the behavior patterns and rules hidden in the corresponding graph feature information, and the pre-trained Transformer sequence model is trained based on the graph feature information of the historical usage behavior data of multiple IoT cards;

[0149] The determination module 530 is used to determine abnormal Internet of Things number cards based on the hidden layer features corresponding to each Internet of Things number card.

[0150] In an optional embodiment, the first extraction module 510 is further configured to:

[0151] For each IoT card, pre-process the usage information of the IoT card obtained in advance to obtain the processed usage information;

[0152] Divide the preset monitoring time into multiple time windows;

[0153] In each time window, a usage behavior collection graph of the IoT card is constructed based on the processed usage information.

[0154] In an optional embodiment, a relation-based graph convolutional neural network is used to extract features from a pre-acquired usage behavior collection graph of at least one IoT card to obtain graph feature information. The first extraction module 510 is specifically used to:

[0155] For each IoT card, each node in the usage behavior collection graph of the IoT card is initialized to obtain the initialization vector corresponding to each node;

[0156] Traverse each node in the usage behavior collection graph, aggregate neighbor node information, and obtain aggregated neighbor node information;

[0157] For each node, update the node's feature vector according to the aggregated neighbor node information corresponding to the node and the node's initialization vector;

[0158] Repeat the aggregation of neighbor node information and the update of the feature vector of each node multiple times to obtain the graph feature information corresponding to the IoT card.

[0159] In an optional embodiment, the determination module 530 is specifically configured to:

[0160] For each IoT card, the hidden layer features of the IoT card are input into the fully connected layer for processing to obtain the processed hidden layer features;

[0161] Normalizing the processed hidden layer features to obtain normalized hidden layer features;

[0162] Perform probability prediction on the normalized hidden features to obtain the fraud probability corresponding to the IoT card;

[0163] Based on the fraud probability corresponding to each IoT card and the preset probability threshold, abnormal IoT cards are determined.

[0164] In an optional embodiment, based on the fraud probability corresponding to each IoT number card and a preset probability threshold, an abnormal IoT number card is determined, and the determination module 530 is specifically used to:

[0165] For each IoT card, if the fraud probability corresponding to the IoT card is greater than the probability threshold, the IoT card will be determined as an abnormal IoT card.

[0166] In an optional embodiment, for each Internet of Things card, the usage behavior collection graph of the Internet of Things card includes: the first Internet of Things card information connected to the Internet of Things card, the access object information of the Internet of Things card, and the association relationship between the Internet of Things card and the access object.

[0167] Based on the above embodiments, Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6 As shown, the electronic device 600 includes: a processor 610, a memory 620 and a bus 630;

[0168] The memory 620 is used to store computer-executable instructions of the processor 610;

[0169] The processor 610 is configured to execute the technical solution of any of the aforementioned method embodiments by executing computer execution instructions.

[0170] Optionally, the memory 620 may be independent or integrated with the processor 610 .

[0171] Optionally, the memory 620 may include a random access memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0172] The bus 630 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the drawings of the present application, but this does not mean that there is only one bus or one type of bus.

[0173] The above-mentioned processor can be a general-purpose processor, including a central processing unit CPU, a network processor (NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0174] The electronic device is used to execute the technical solution of any of the aforementioned method embodiments, and its implementation principle and technical effect are similar and will not be repeated here.

[0175] An embodiment of the present application also provides a computer-readable storage medium on which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the technical solution provided by any of the above method embodiments.

[0176] An embodiment of the present application also provides a computer program product, including a computer program, which includes computer instructions stored in a computer-readable storage medium. When the computer program is executed by a processor, it is used to implement the technical solution provided by any of the above method embodiments.

[0177] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0178] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0179] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0180] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0181] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0182] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0183] In the above embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0184] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0185] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for determining an abnormal IoT card, characterized in that: include: The relationship-based graph convolutional neural network extracts features from a pre-acquired usage behavior collection graph of at least one IoT number card to obtain graph feature information; the usage behavior collection graph is a graph structure of usage behavior records of the at least one IoT number card, and the relationship-based graph convolutional neural network is trained based on historical usage behavior collection graphs of multiple IoT number cards; Input the graph feature information of each IoT card into a pre-trained Transformer sequence model to extract the hidden features corresponding to each IoT card; the hidden features are the behavior patterns and rules hidden in the corresponding graph feature information, and the pre-trained Transformer sequence model is trained based on the graph feature information of the historical usage behavior data of multiple IoT cards; Abnormal IoT cards are identified based on the hidden features corresponding to each IoT card.

2. The method according to claim 1, characterized in that The method further comprises: For each IoT number card, pre-process the pre-acquired usage information of the IoT number card to obtain processed usage information; Divide the preset monitoring time into multiple time windows; In each time window, a usage behavior collection graph of the Internet of Things card is constructed based on the processed usage information.

3. The method according to claim 1 or 2, characterized in that: The relationship-based graph convolutional neural network extracts features from at least one pre-acquired usage behavior collection graph of an IoT card to obtain graph feature information, including: For each IoT card, each node in the usage behavior collection graph of the IoT card is initialized to obtain an initialization vector corresponding to each node; Traversing each node in the usage behavior collection graph, aggregating neighbor node information, and obtaining aggregated neighbor node information; For each node, update the feature vector of the node according to the aggregated neighbor node information corresponding to the node and the initialization vector of the node; Repeat the neighbor node information aggregation and feature vector update of each node multiple times to obtain the graph feature information corresponding to the Internet of Things card.

4. The method according to claim 1, characterized in that: The determining of abnormal IoT number cards according to the hidden layer features corresponding to each IoT number card includes: For each IoT card, the hidden layer features of the IoT card are input into the fully connected layer for processing to obtain the processed hidden layer features; Normalizing the processed hidden layer features to obtain normalized hidden layer features; Probabilistically predicting the normalized hidden features to obtain the fraud probability corresponding to the IoT card; Based on the fraud probability corresponding to each IoT number card and a preset probability threshold, the abnormal IoT number card is determined.

5. The method according to claim 4, characterized in that The determining of the abnormal IoT number card based on the fraud probability corresponding to each IoT number card and a preset probability threshold includes: For each Internet of Things card, if the fraud probability corresponding to the Internet of Things card is greater than the probability threshold, the Internet of Things card is determined as the abnormal Internet of Things card.

6. The method according to any one of claims 1 or 2, characterized in that: For each Internet of Things card, the usage behavior collection graph of the Internet of Things card includes: information of the first Internet of Things card connected to the Internet of Things card, access object information of the Internet of Things card, and the association relationship between the Internet of Things card and the access object.

7. A device for determining an abnormal IoT card, characterized in that: include: A first extraction module is used for performing feature extraction on a pre-acquired usage behavior collection graph of at least one IoT number card using a relationship-based graph convolutional neural network to obtain graph feature information; the usage behavior collection graph is a graph structure of usage behavior records of the at least one IoT number card, and the relationship-based graph convolutional neural network is trained based on historical usage behavior collection graphs of multiple IoT number cards; The second extraction module is used to input the graph feature information of each IoT card into a pre-trained Transformer sequence model to extract the hidden features corresponding to each IoT card; the hidden features are the behavior patterns and rules hidden in the corresponding graph feature information, and the pre-trained Transformer sequence model is trained based on the graph feature information of the historical usage behavior data of multiple IoT cards; The determination module is used to determine abnormal IoT number cards based on the hidden layer features corresponding to each IoT number card.

8. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images