Abnormal flow limiting method and device and abnormal flow limiting system

Abstract

The invention provides an abnormal flow limiting method and device and an abnormal flow limiting system, and the method comprises the steps: building an abnormal flow scoring standard according to user features, and carrying out the calculation according to the abnormal flow scoring standard, and obtaining the risk scores of a plurality of users; determining the user corresponding to the risk score less than the risk score threshold as a normal traffic user, and determining the user corresponding to the risk score greater than or equal to the risk score threshold as an abnormal traffic user; training a neural network model according to the user features of the normal traffic users and the user features of the abnormal traffic users to obtain an abnormal traffic detection model; and inputting the user characteristics of the new user into the abnormal flow detection model to obtain an abnormal probability, and making an adjustment strategy to limit the downlink rate of the new user when the abnormal probability is greater than or equal to a first predetermined threshold. According to the method, the problem of non-uniform network resource distribution caused by inaccurate abnormal traffic user detection in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of communication services, and in particular, to an abnormal traffic rate limiting method, device, computer-readable storage medium, computer program product, and abnormal traffic rate limiting system. Background Art

[0002] With the rapid development and popularization of mobile communication technology, users' demand for mobile broadband services is increasing day by day, and the data traffic carried by mobile networks has also increased sharply. Although this explosive growth in traffic has improved users' Internet experience, it has also brought new challenges, especially in terms of network resource allocation and management. Traditional network resource management methods, such as static threshold control and rule-based traffic management, are difficult to effectively cope with the dynamically changing network load and complex and variable user behaviors. These methods often rely on preset thresholds and rules and are difficult to adapt to the dynamic changes of network conditions in real time, which may lead to uneven resource allocation, a decline in the service quality of normal users, and losses to network operators' revenues.

[0003] When dealing with abnormal traffic in network base stations, the existing technologies mainly have the following deficiencies: it is difficult to accurately identify abnormal traffic: traditional traffic management methods are mainly based on fixed thresholds and user behavior rules, and it is difficult to discover abnormal patterns hidden in a large amount of normal traffic, especially when multi-dimensional factors such as user types, traffic volumes, resident cells, and service types are intertwined, the accuracy and comprehensiveness of abnormal traffic identification are limited; lack of intelligent optimization strategies: when abnormal traffic appears in network base stations, traditional optimization methods are often single and static, such as one-size-fits-all speed limit measures, which not only affect the user experience but also may cause unnecessary waste of network resources and cannot achieve efficient utilization of resources and optimization of the user experience.

[0004] Therefore, developing a system that can intelligently analyze user traffic, accurately identify abnormal traffic, and automatically optimize network resource allocation has important practical significance and application value for solving the resource management and user experience problems faced by current mobile networks. Summary of the Invention

[0005] The main objective of this application is to provide an abnormal traffic rate limiting method, device, computer-readable storage medium, computer program product, and abnormal traffic rate limiting system to at least solve the problem of uneven network resource allocation caused by inaccurate detection of abnormal traffic users in the prior art.

[0006] To achieve the above object, according to one aspect of the present application, there is provided a method for limiting abnormal traffic, including: establishing an abnormal traffic scoring criterion according to user characteristics, and calculating risk scores of multiple users according to the abnormal traffic scoring criterion, where the risk scores are used to evaluate the likelihood of the users' illegal use of traffic, and the user characteristics include the user type of the users, the size of the downstream service traffic, the type of the resident cell, and the type of the downstream service; determining the users corresponding to the risk scores less than the risk score threshold as normal traffic users, and determining the users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users; training a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model; inputting the user characteristics of a new user into the abnormal traffic detection model to obtain the abnormal probability of the new user, and formulating an adjustment strategy to limit the downstream rate of the new user when the abnormal probability of the new user is greater than or equal to a first predetermined threshold.

[0007] Optionally, establishing an abnormal traffic scoring criterion according to user characteristics, and calculating risk scores of multiple users according to the abnormal traffic scoring criterion, includes: obtaining a first risk score when the user type of the user is a non-ordinary mobile user, and adding the first risk score to the risk score, where the initial value of the risk score is zero; obtaining a second risk score when the size of the downstream service traffic of the user is greater than or equal to a second predetermined threshold, and adding the second risk score to the risk score; obtaining a third risk score when the type of the resident cell of the user is a village in the city or an industrial area, and adding the third risk score to the risk score; obtaining a fourth risk score when the type of the downstream service of the user is a video service or a download service, and adding the fourth risk score to the risk score; using the current risk score as the risk score of the user.

[0008] Optionally, training a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model, includes: extracting feature vectors from the user characteristics corresponding to the normal traffic users to obtain multiple first vectors, and extracting feature vectors from the user characteristics corresponding to the abnormal traffic users to obtain multiple second vectors; inputting each of the first vectors and each of the second vectors into a contrast loss function, and adjusting the parameters of the neural network model until the contrast loss function converges to obtain the abnormal traffic detection model.

[0009] Optionally, when the exception probability of the new user exceeds a predetermined threshold, formulating an adjustment policy to limit the downlink rate of the new user, including: formulating a plurality of the adjustment policies according to the PRB utilization rate of the user, where the adjustment policy is to prevent the user from abnormally using traffic by reducing the magnitude of the downlink rate of the user, and the PRB utilization rate is used to describe the occupancy degree of radio resources in a communication network; setting the weights of the 4G load, the 4G traffic, and the user rate; determining, according to the PRB utilization rate of the new user, the value of the downlink rate of the new user that needs to be adjusted in each of the adjustment policies to obtain the first downlink rate corresponding to each of the adjustment policies; calculating the influence degree on the 4G load, the influence degree on the 4G traffic, and the influence degree on the user rate after each of the adjustment policies adjusts the first downlink rate, and multiplying the weight of the 4G load by the influence degree on the 4G load to obtain the first weighted value corresponding to each of the adjustment policies, multiplying the weight of the 4G traffic by the influence degree on the 4G traffic to obtain the second weighted value corresponding to each of the adjustment policies, multiplying the weight of the user rate by the influence degree on the user rate to obtain the third weighted value corresponding to each of the adjustment policies, where the influence degree on the 4G load is used to describe the proportion of the reduction of the 4G load of the current base station when the downlink rate is reduced, the influence degree on the 4G traffic is used to describe the proportion of the reduction of the 4G traffic of the current base station when the downlink rate is reduced, and the influence degree on the user rate is used to describe the proportion of the increase in the rate of other users covered by the current base station when the downlink rate is reduced; adding the first weighted value, the second weighted value, and the third weighted value corresponding to each of the adjustment policies to obtain the comprehensive weighted value corresponding to each of the adjustment policies; comparing the magnitudes of the comprehensive weighted values of each of the adjustment policies, and determining the adjustment policy with the largest comprehensive weighted value as the optimal adjustment policy; adjusting the downlink rate of the user according to the optimal adjustment policy.

[0010] Optionally, a plurality of the adjustment policies are formulated according to the PRB utilization rate of the new user, including: a first adjustment policy, when the PRB utilization rate of the user is greater than 70% and less than 80%, adjusting the downlink rate to be less than 5 Mbps; when the PRB utilization rate of the user is greater than 80% and less than 90%, adjusting the downlink rate to be less than 4 Mbps; when the PRB utilization rate of the user is greater than 90% and less than 100%, adjusting the downlink rate to be less than 2 Mbps; a second adjustment policy, when the PRB utilization rate of the user is greater than 50% and less than 80%, adjusting the downlink rate to be less than 5 Mbps; when the PRB utilization rate of the user is greater than 80% and less than 90%, adjusting the downlink rate to be less than 4 Mbps; when the PRB utilization rate of the user is greater than 90% and less than 100%, adjusting the downlink rate to be less than 2 Mbps; a third adjustment policy, when the PRB utilization rate of the user is greater than 20% and less than 70%, adjusting the downlink rate to be less than 5 Mbps; when the PRB utilization rate of the user is greater than 70% and less than 80%, adjusting the downlink rate to be less than 4 Mbps; when the PRB utilization rate of the user is greater than 80% and less than 100%, adjusting the downlink rate to be less than 2 Mbps; a fourth adjustment policy, when the PRB utilization rate of the user is greater than 20% and less than 50%, adjusting the downlink rate to be less than 5 Mbps; when the PRB utilization rate of the user is greater than 50% and less than 80%, adjusting the downlink rate to be less than 4 Mbps; when the PRB utilization rate of the user is greater than 80% and less than 100%, adjusting the downlink rate to be less than 2 Mbps.

[0011] Optionally, after formulating the adjustment policy to limit the downlink rate of the new user, the method further includes: obtaining the feedback of the new user, and adjusting the adjustment policy of the new user according to the feedback.

[0012] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an abnormal traffic flow limiting device is provided, comprising: an establishment unit, used to establish an abnormal traffic scoring standard according to user characteristics, and calculate risk scores of multiple users according to the abnormal traffic scoring standard, wherein the risk score is used to evaluate the possibility of the user's illegal use of traffic, and the user characteristics include the user type of the user, the size of the downlink service traffic, the resident cell type and the downlink service type; a determination unit, used to determine the user corresponding to the risk score less than the risk score threshold as a normal traffic user, and determine the user corresponding to the risk score greater than or equal to the risk score threshold as an abnormal traffic user; a training unit, used to train a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model; a control unit, used to input the user characteristics of the new user into the abnormal traffic detection model, obtain the abnormal probability of the new user, and when the abnormal probability of the new user is greater than or equal to the first predetermined threshold, formulate an adjustment strategy to limit the downlink rate of the new user.

[0013] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the method described in any one of the devices where the computer-readable storage medium is located is controlled.

[0014] According to another aspect of the present application, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, any one of the methods described above is implemented.

[0015] According to another aspect of the present application, an abnormal traffic limiting method is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the described methods.

[0016] Applying the technical solution of the present application, in the above-mentioned abnormal traffic limiting method, it includes: establishing an abnormal traffic scoring standard according to user characteristics, and calculating risk scores of multiple users according to the above-mentioned abnormal traffic scoring standard, the above-mentioned risk score is used to evaluate the possibility of the above-mentioned users using traffic in violation of regulations, and the above-mentioned user characteristics include the user type of the above-mentioned user, the size of the downlink service traffic, the resident cell type and the downlink service type; the user corresponding to the above-mentioned risk score less than the risk score threshold is determined as a normal traffic user, and the user corresponding to the above-mentioned risk score greater than or equal to the above-mentioned risk score threshold is determined as an abnormal traffic user; the neural network model is trained according to the above-mentioned user characteristics of the above-mentioned normal traffic users and the above-mentioned user characteristics of the above-mentioned abnormal traffic users to obtain an abnormal traffic detection model; the above-mentioned user characteristics of the new user are input into the above-mentioned abnormal traffic detection model to obtain the abnormal probability of the above-mentioned new user, and when the above-mentioned abnormal probability of the above-mentioned new user is greater than or equal to the first predetermined threshold, an adjustment strategy is formulated to limit the downlink rate of the above-mentioned new user. The present application establishes an abnormal traffic scoring standard, calculates risk scores of multiple users, divides normal traffic users and abnormal traffic users according to the risk scores, and trains a neural network model with user characteristics of normal traffic users and user characteristics of abnormal traffic users to obtain an abnormal traffic detection model. When the user characteristics of a new user are input, the abnormal probability is obtained, and when the abnormal probability exceeds a predetermined threshold, the downlink rate of the new user is adjusted according to an adjustment strategy, thereby avoiding waste of network resources due to malicious use of traffic by abnormal traffic users, and solving the problem of uneven allocation of network resources caused by inaccurate detection of abnormal traffic users in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A hardware structure block diagram of a mobile terminal for executing an abnormal traffic flow limiting method provided in an embodiment of the present application is shown;

[0018] Figure 2 A schematic diagram of a flow chart of an abnormal flow limiting method provided according to an embodiment of the present application is shown;

[0019] Figure 3 A user feedback processing flow chart of an abnormal traffic flow limiting method provided according to an embodiment of the present application is shown;

[0020] Figure 4 A structural block diagram of an abnormal flow rate limiting device provided according to an embodiment of the present application is shown.

[0021] The above drawings include the following reference numerals:

[0022] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. Detailed implementation manners

[0023] It should be noted that, without conflict, the embodiments in the present application and the features in the embodiments may be combined with each other. The present application will be described in detail below with reference to the drawings and in conjunction with the embodiments.

[0024] In order to enable those skilled in the art of the present technology to better understand the solution of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and do not necessarily need to describe a specific order or sequence. It should be understood that such data used can be interchanged under appropriate circumstances for the embodiments of the present application described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0026] For the convenience of description, some nouns or terms related to the embodiments of the present application are described below:

[0027] PRB utilization rate: An index for measuring the utilization degree of physical resource blocks (PRBs). A PRB is the basic unit in a wireless communication system and is used to transmit data and control signaling.

[0028] As introduced in the background art, the accuracy of abnormal traffic identification in the prior art is limited. To solve this technical problem, embodiments of the present application provide an abnormal traffic rate limiting method, device, computer-readable storage medium, computer program product, and abnormal traffic rate limiting system.

[0029] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention.

[0030] The method embodiments provided in the embodiments of the present application can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a mobile terminal as an example, Figure 1The following is a block diagram of the hardware structure of a mobile terminal for an abnormal traffic flow limiting method according to an embodiment of the present invention. As Figure 1 shown, the mobile terminal may include one or more ( Figure 1 only one is shown in the figure) processors 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Among them, the above-mentioned mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those of ordinary skill in the art can understand that Figure 1 the structure shown is only illustrative and does not limit the structure of the above-mentioned mobile terminal. For example, the mobile terminal may further include more or fewer components than Figure 1 shown in the figure, or have a different configuration from Figure 1 shown in the figure.

[0031] The memory 104 can be used to store computer programs. For example, software programs and modules of application software, such as the computer program corresponding to an abnormal traffic flow limiting method in an embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implements the above method. The memory 104 may include a high-speed random access memory, and may further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some instances, the memory 104 may further include a memory remotely disposed relative to the processor 102, and these remote memories can be connected to the mobile terminal through a network. Examples of the above network include, but are not limited to, the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one instance, the transmission device 106 includes a network adapter (Network Interface Controller, abbreviated as NIC), which can be connected to other network devices through a base station and thus communicate with the Internet. In one instance, the transmission device 106 may be a radio frequency (Radio Frequency, abbreviated as RF) module, which is used to communicate with the Internet wirelessly.

[0032] In this embodiment, an abnormal traffic flow limiting method running on a mobile terminal, a computer terminal, or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from that here.

[0033] Figure 2 FIG. 1 is a flow chart of a method for executing abnormal flow limiting according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0034] Step S201, establishing an abnormal traffic scoring standard according to user characteristics, and calculating risk scores of multiple users according to the abnormal traffic scoring standard, the risk scores are used to assess the possibility of the users using traffic in violation of regulations, the user characteristics include the user type of the user, the size of downlink service traffic, the resident cell type and the downlink service type;

[0035] Specifically, an abnormal traffic scoring standard is constructed, that is, a set of detailed scoring criteria is designed to score the risks of network users. The scoring standard combines the key characteristics of users, including but not limited to the user type, the size of their downlink business traffic, the type of resident cell, and the downlink business type, to quantify the abnormal traffic risks of network users in an all-round way. Through the application of this scoring standard, the risk score of each network user can be calculated. The risk score is directly related to the possibility of the user's illegal use of network resources, forming an accurate quantification of the user's traffic usage behavior. By quantifying the risk score, it can automatically identify potential illegal users without manual investigation one by one, which greatly improves the efficiency of abnormal traffic detection and provides a basis for the subsequent establishment of an abnormal traffic detection model.

[0036] Step S202, determining users corresponding to the risk scores less than the risk score threshold as normal traffic users, and determining users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users;

[0037] Specifically, by setting a clear risk score threshold as a distinction standard, for those users whose risk scores are less than the preset risk score threshold after the abnormal traffic score standard is calculated, the system automatically identifies them as normal traffic users, indicating that these users' behavior in using network resources is in line with the norm and do not show a tendency to violate regulations. On the contrary, for those users whose risk scores reach or exceed the risk score threshold, they are identified as abnormal traffic users by the system, and these users are more likely to use illegal traffic and cause unexpected burdens on network resources.

[0038] Step S203, training a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model;

[0039] Specifically, by utilizing the different user characteristics exhibited by normal traffic users and abnormal traffic users, the neural network model is deeply trained to construct a high-precision abnormal traffic detection model. By mining and comparing the differential information of the two types of users in terms of user type, the magnitude of downstream service traffic, the type of resident cell, and the type of downstream service, as the dataset for model training, the model can learn the key feature patterns for distinguishing normal and abnormal traffic. After this training stage, the model can not only automatically extract features from the data but also generalize based on the learned patterns, that is, accurately judge the abnormal traffic for unseen user data.

[0040] Step S204: Input the above user characteristics of the new user into the above abnormal traffic detection model to obtain the abnormal probability of the new user. When the abnormal probability of the new user is greater than or equal to the first predetermined threshold, formulate an adjustment strategy to limit the downstream rate of the new user.

[0041] Specifically, after obtaining the abnormal traffic detection model, input the user characteristics of the new user into the abnormal traffic detection model. The abnormal traffic detection model can then determine whether the new user is an abnormal user based on the user characteristics of the new user. Its unique user attributes, including user type, the magnitude of downstream service traffic, the type of resident cell, and the type of downstream service, will be collected in real time and input into the pre-trained abnormal traffic detection model for in-depth analysis. The model can quickly calculate the abnormal traffic behavior probability of the new user, that is, the risk level of the new user's possible display of illegal traffic usage during network usage. If this abnormal probability value reaches or exceeds the set first predetermined threshold, the system automatically determines that the new user has an abnormal traffic risk, and then formulates and executes an adjustment strategy to precisely control the magnitude of the downstream rate of the new user, thereby avoiding potential abuse of network resources.

[0042] Through this embodiment, in the above-mentioned abnormal traffic limiting method, an abnormal traffic scoring standard is established according to user characteristics, and risk scores of multiple users are calculated according to the above-mentioned abnormal traffic scoring standard, the above-mentioned risk score is used to evaluate the possibility of the above-mentioned user's illegal use of traffic, and the above-mentioned user characteristics include the user type of the above-mentioned user, the size of the downlink service traffic, the resident cell type and the downlink service type; the user corresponding to the above-mentioned risk score less than the risk score threshold is determined as a normal traffic user, and the user corresponding to the above-mentioned risk score greater than or equal to the above-mentioned risk score threshold is determined as an abnormal traffic user; the neural network model is trained according to the above-mentioned user characteristics of the above-mentioned normal traffic users and the above-mentioned user characteristics of the above-mentioned abnormal traffic users to obtain an abnormal traffic detection model; the above-mentioned user characteristics of the new user are input into the above-mentioned abnormal traffic detection model to obtain the abnormal probability of the above-mentioned new user, and when the above-mentioned abnormal probability of the above-mentioned new user is greater than or equal to the first predetermined threshold, an adjustment strategy is formulated to limit the downlink rate of the above-mentioned new user. The present application establishes an abnormal traffic scoring standard, calculates risk scores of multiple users, divides normal traffic users and abnormal traffic users according to the risk scores, and trains a neural network model with user characteristics of normal traffic users and user characteristics of abnormal traffic users to obtain an abnormal traffic detection model. When the user characteristics of a new user are input, the abnormal probability is obtained, and when the abnormal probability exceeds a predetermined threshold, the downlink rate of the new user is adjusted according to an adjustment strategy, thereby avoiding waste of network resources due to malicious use of traffic by abnormal traffic users, and solving the problem of uneven allocation of network resources caused by inaccurate detection of abnormal traffic users in the prior art.

[0043] In order to establish an abnormal traffic scoring standard to perform risk scoring on users, in an optional implementation, the abnormal traffic scoring standard is established according to user characteristics, and risk scores of multiple users are calculated according to the abnormal traffic scoring standard. The above step S201 includes:

[0044] Step S2011, when the user type of the user is a non-ordinary mobile user, obtaining a first risk score, and adding the first risk score to the risk score, where the initial value of the risk score is zero;

[0045] Specifically, when it is recognized that the type of a certain user does not belong to the regular individual users of network operators, that is, the user belongs to the category of non-ordinary mobile users. Non-ordinary mobile users include, but are not limited to, Internet of Things card users, enterprise-level users, and wireless broadband users. When the feature of being a non-ordinary mobile user is detected, the user will be assigned a specific first risk score, which reflects that non-ordinary mobile users may show a higher tendency of abnormal traffic behavior compared to ordinary users. Subsequently, this first risk score will be accumulated into the user's risk score, and the initial set value of each user's risk score is zero.

[0046] Step S2012, when the size of the downstream service traffic of the above user is greater than or equal to the second predetermined threshold, obtain a second risk score and accumulate the second risk score into the risk score;

[0047] Specifically, when it is monitored that the scale of the downstream service traffic of a certain user within a certain period reaches or exceeds the second predetermined threshold, this indicates that the user may be performing tasks with high traffic demands, such as high-definition video stream transmission, large file downloads, etc., thus imposing significant pressure on network resources. At this time, the system will assign a second risk score to the user, which quantifies the contribution of the user's high-traffic behavior to the potential abnormal risk of the network. Subsequently, this second risk score will be accumulated into the user's risk score for comprehensively evaluating the risk level of their network behavior.

[0048] Step S2013, when the above user's above resident cell type is a village in the city or an industrial area, obtain a third risk score and accumulate the third risk score into the risk score;

[0049] Specifically, when it is recognized that the resident cell of a certain user is a specific type of area such as a village in the city or an industrial area, the system will assign a third risk score to the user, which reflects the possible abnormal traffic risk patterns in the specific cell type. Due to the dense population or device distribution and high-frequency data interaction requirements in villages in the city and industrial areas, they often become high-frequency locations for abnormal traffic activities. Subsequently, the system will accumulate the third risk score into the user's risk score, further enriching the considerations for risk assessment and enabling it to comprehensively analyze the combined effects of user behavior and their surrounding environment.

[0050] Step S2014, when the above user's above downstream service type is a video service or a download service, obtain a fourth risk score and accumulate the fourth risk score into the risk score;

[0051] Specifically, the downstream service type is regarded as a key indicator for detecting user data consumption. When the system monitors that the downstream service type of a user is mainly video service or download service, it indicates that the user may be frequently accessing resource-intensive services, such as high-definition video streams, large file transfers, etc., which have high requirements for network bandwidth and resources. Based on this, the system assigns a fourth risk score to the user, which quantifies the impact degree of video services and download services on the potential abnormal traffic risk of the network. Subsequently, this score is accumulated into the user's risk score, thus forming an abnormal traffic risk assessment system that comprehensively considers the user's service type.

[0052] Step S2015, use the current above-mentioned risk score as the above-mentioned risk score of the above-mentioned user.

[0053] Specifically, when the system completes the comprehensive analysis of all relevant features (user type, size of downstream service traffic, type of resident cell, downstream service type) of a user within a specific time window, and calculates an accumulated risk score based on these features, the current risk score is determined as the user's final risk score. This process ensures the real-time and accuracy of the risk score, reflecting the potential risk of the user's current network behavior.

[0054] In a specific embodiment, when the user type is a non-ordinary mobile user, the first risk score is 50 points; for users with a downstream service traffic size of more than 1000G in the current month, the second risk score is 30 points, and for each additional 100G, the second risk score increases by one point, with no upper limit; for users whose resident cell type is a village in the city or an industrial area, the third risk score is 30 points, and for users whose downstream service type is video service or download service, the fourth risk score is 30 points. Then, add the first risk score, the second risk score, the third risk score, and the fourth risk score to obtain the user's risk score. The risk score threshold is set to 50, that is, when the risk score of this user is greater than or equal to 50, this user is determined as an abnormal traffic user. The above first risk score, second risk score, third risk score, fourth risk score, and risk score threshold can be automatically adjusted according to the actual region or scenario.

[0055] In order to obtain an abnormal traffic detection model to detect abnormal traffic users, in an optional implementation manner, train a neural network model according to the above-mentioned user characteristics of normal traffic users and the above-mentioned user characteristics of abnormal traffic users to obtain an abnormal traffic detection model. The above step S203 includes:

[0056] Step S2031, extract feature vectors from the above-mentioned user characteristics corresponding to the above-mentioned normal traffic users to obtain multiple first vectors, and extract feature vectors from the above-mentioned user characteristics corresponding to the above-mentioned abnormal traffic users to obtain multiple second vectors;

[0057] Specifically, the user feature data of users identified as normal traffic users is deeply processed, and through algorithms, it is converted into a series of high-dimensional first vectors, each of which contains the key network feature information of the corresponding user. And the feature vectors of the data of abnormal traffic users are extracted to generate a series of second vectors, which also contain the key feature information of abnormal users in network activities. This process provides data preparation for the establishment of subsequent abnormal traffic detection models.

[0058] Step S2032: Input each of the above-mentioned first vectors and each of the above-mentioned second vectors into the contrast loss function, and adjust the parameters of the above-mentioned neural network model until the above-mentioned contrast loss function converges, thereby obtaining the above-mentioned abnormal traffic detection model.

[0059] Specifically, the first vectors extracted from normal traffic users and the second vectors extracted from abnormal traffic users are used as training data and input into the contrast loss function. The contrast loss function is a loss function specifically used to measure the similarity or difference between two inputs. In the field of abnormal traffic identification, it is used to enhance the model's ability to distinguish normal and abnormal traffic. By calculating the distance or similarity between the first vector and the second vector through the contrast loss function, and using this information as a feedback signal, the system dynamically adjusts the internal parameters of the neural network model. This process is repeatedly executed until the contrast loss function reaches a converged state, that is, the model can stably distinguish normal and abnormal traffic users and no longer makes large adjustments to the parameters. Finally, an optimized and trained abnormal traffic detection model is obtained, which can accurately identify abnormal traffic users based on user feature vectors.

[0060] In order to restrict the traffic of abnormal traffic users, in an optional implementation manner, when the abnormal probability of the above-mentioned new user exceeds a predetermined threshold, an adjustment strategy is formulated to restrict the downlink rate of the above-mentioned new user. The above-mentioned step S204 includes:

[0061] Step S2041: Formulate multiple above-mentioned adjustment strategies according to the PRB utilization rate of the above-mentioned user. The above-mentioned adjustment strategy is to prevent the above-mentioned user from abnormally using traffic by reducing the magnitude of the above-mentioned user's downlink rate. The PRB utilization rate is used to describe the occupancy degree of wireless resources in a communication network;

[0062] Specifically, based on the real-time monitoring of the user's PRB utilization rate, multiple adjustment strategies are formulated to dynamically adjust the user's downlink rate according to the user's current PRB utilization rate, effectively suppressing the excessive consumption of abnormal traffic and maintaining the healthy operation of the network. That is, when it is detected that the PRB utilization rate of a certain user rises abnormally, indicating that the user's network activities may cause excessive pressure on system resources, the system will enable the corresponding adjustment strategy, that is, reduce the user's downlink rate, thereby limiting the user's data transmission speed, reducing the occupancy of shared network resources, and preventing the performance of the entire network from deteriorating due to the abnormal behavior of individual users.

[0063] Step S2042: Set the weights of the 4G load, 4G traffic, and user rate.

[0064] Step S2043: Determine the value of the downlink rate that needs to be adjusted for the new user in each of the above adjustment strategies according to the above PRB utilization rate of the new user, and obtain the first downlink rate corresponding to each of the above adjustment strategies.

[0065] Step S2044: Calculate the influence degrees on the 4G load, 4G traffic, and user rate after each of the above adjustment strategies adjusts the first downlink rate, multiply the weight of the 4G load by the influence degree of the 4G load to obtain the first weighted value corresponding to each of the above adjustment strategies, multiply the weight of the 4G traffic by the influence degree of the 4G traffic to obtain the second weighted value corresponding to each of the above adjustment strategies, multiply the weight of the user rate by the influence degree of the user rate to obtain the third weighted value corresponding to each of the above adjustment strategies. The influence degree of the 4G load is used to describe the proportion of the reduction of the 4G load of the current base station when the downlink rate is reduced, the influence degree of the 4G traffic is used to describe the proportion of the reduction of the 4G traffic of the current base station when the downlink rate is reduced, and the influence degree of the user rate is used to describe the proportion of the increase in the rates of other users covered by the current base station when the downlink rate is reduced.

[0066] Step S2045: Add the first weighted value, the second weighted value, and the third weighted value corresponding to each of the above adjustment strategies to obtain the comprehensive weighted value corresponding to each of the above adjustment strategies.

[0067] Step S2046: Compare the magnitudes of the comprehensive weighted values of each of the above adjustment strategies, and determine the adjustment strategy with the largest comprehensive weighted value as the optimal adjustment strategy.

[0068] Step S2047: Adjust the downlink rate of the user according to the optimal adjustment strategy.

[0069] Specifically, by setting the weights of 4G load, 4G traffic, and user rate, the priorities of different network performance metrics in resource allocation are clarified. According to the specific situation of the PRB utilization rate of new users, the adjustment values corresponding to the first downlink rate in each adjustment strategy are determined, aiming to adjust the user data transmission speed by means of speed limit. When evaluating the impacts of these strategies, the specific impact degrees on 4G load, 4G traffic, and user rate are calculated and multiplied by the corresponding weights to obtain the first, second, and third weighted values of each strategy. By adding these weighted values, the comprehensive weighted value of each strategy is obtained, which reflects the comprehensive benefit of the strategy in meeting the multi-objective optimization requirements. Finally, the system selects the strategy with the highest comprehensive weighted value as the best adjustment strategy and adjusts the downlink rate of new users accordingly, achieving the dynamic optimal allocation of network resources.

[0070] To enable those skilled in the art to more clearly understand the calculation process of adjusting the downlink rate according to the PRB utilization rate of new users, the following will detail the calculation process in combination with specific embodiments.

[0071] S1: Set the weight values. Set the weight of 4G load to 50%, the weight of 4G traffic to 30%, and the weight of user rate to 20%.

[0072] S2: Determine the preliminary adjusted downlink rate value. For example, if the PRB utilization rate of a certain user within a specific time is 85%, the system, according to the preset adjustment strategy, initially determines three candidate values for reducing the user's downlink rate based on the value of the user's PRB utilization rate in each adjustment strategy. Taking adjustment strategies a, b, and c as examples: Strategy a: When the user's PRB utilization rate is 85%, adjust the downlink rate to 3 Mbps; Strategy b: When the user's PRB utilization rate is 85%, adjust the downlink rate to 4 Mbps; Strategy c: When the user's PRB utilization rate is 85%, adjust the downlink rate to 5 Mbps.

[0073] S3: Calculate the impact degree. Calculate the impact degrees of each adjustment strategy on 4G load, 4G traffic, and user rate after executing the above three adjustment strategies. This calculation is based on historical data and model prediction. For example:

[0074] After executing Strategy a: 4G load drops by 15%, 4G traffic drops by 12%, and the rate of other users increases by 10%.

[0075] After executing Strategy b: 4G load drops by 12%, 4G traffic drops by 10%, and the rate of other users increases by 8%.

[0076] After executing Strategy c: 4G load drops by 10%, 4G traffic drops by 8%, and the rate of other users increases by 6%.

[0077] S4: Calculate the weighted values. The first weighted value of strategy a is: 50% * 15% = 7.5%. The second weighted value of strategy a is: 30% * 12% = 3.6%. The third weighted value of strategy a is: 20% * 10% = 2%. The comprehensive weighted value of strategy a is: 7.5% + 3.6% + 2% = 13.1%. According to the above method, the comprehensive weighted value of strategy b is calculated to be 10.8%, and the comprehensive weighted value of strategy c is 8.8%.

[0078] S5: Determine the optimal adjustment strategy. By comparing the comprehensive weighted values of the above three strategies, it can be seen that the comprehensive weighted value of strategy a is the highest, at 13.1%. Therefore, strategy a is determined as the optimal adjustment strategy.

[0079] S6: Adjust the downlink rate. According to the optimal adjustment strategy a, the system adjusts the downlink rate of this user (the user with a PRB utilization rate of 85%) to 3 Mbps to achieve the best network resource optimization effect.

[0080] In order to reasonably limit the traffic of abnormal traffic users, in an optional implementation manner, multiple above-mentioned adjustment strategies are formulated according to the PRB utilization rate of the above-mentioned new users. The above step S2041 includes:

[0081] Step S20411, the first adjustment strategy. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 70% and less than 80%, adjust the above-mentioned downlink rate to be less than 5 Mbps. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 80% and less than 90%, adjust the above-mentioned downlink rate to be less than 4 Mbps. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 90% and less than 100%, adjust the above-mentioned downlink rate to be less than 2 Mbps.

[0082] Step S20412, the second adjustment strategy. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 50% and less than 80%, adjust the above-mentioned downlink rate to be less than 5 Mbps. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 80% and less than 90%, adjust the above-mentioned downlink rate to be less than 4 Mbps. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 90% and less than 100%, adjust the above-mentioned downlink rate to be less than 2 Mbps.

[0083] Step S20413, the third adjustment strategy. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 20% and less than 70%, adjust the above-mentioned downlink rate to be less than 5 Mbps. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 70% and less than 80%, adjust the above-mentioned downlink rate to be less than 4 Mbps. When the above-mentioned PRB utilization rate of the above-mentioned user is greater than 80% and less than 100%, adjust the above-mentioned downlink rate to be less than 2 Mbps.

[0084] Step S20414, the fourth adjustment strategy. When the PRB utilization rate of the above user is greater than 20% and less than 50%, adjust the above downstream rate to be less than 5 Mbps. When the PRB utilization rate of the above user is greater than 50% and less than 80%, adjust the above downstream rate to be less than 4 Mbps. When the PRB utilization rate of the above user is greater than 80% and less than 100%, adjust the above downstream rate to be less than 2 Mbps.

[0085] Specifically, by defining a multi-level dynamic adjustment strategy based on the user's PRB utilization rate, and according to different PRB utilization rate threshold ranges, the downstream rate of the user is intelligently limited in a hierarchical manner. The aim is to balance network resource allocation, optimize network efficiency, and at the same time ensure the service quality of users under different network loads, so as to achieve precise control of abnormal traffic and overall improvement of network performance. The above strategy is based on real-time monitoring of the PRB utilization rate, which can accurately identify the degree of network resource tension. Through hierarchical rate limiting, effective control of users with abnormal traffic is achieved. The four adjustment strategies each have their own focuses and can be flexibly adjusted according to different scenarios and user behaviors. By limiting the downstream rate of users with abnormal traffic through the above four adjustment strategies, more network resources are released to other users, thereby improving the network experience of normal users and reducing user complaints caused by network congestion, especially during peak network hours, enabling it to respond quickly, maintain network stability, and avoid excessive consumption of resources. After obtaining the abnormal traffic situation, the DPI service identification technology is used for service identification. When it is identified that it is not a malicious behavior, no adjustment is made to it, and when it is identified as a malicious behavior, the corresponding adjustment is made according to the above method.

[0086] To avoid restricting incorrect users with abnormal traffic, in an optional implementation manner, after formulating an adjustment strategy to limit the downstream rate of the above new user, the above method further includes:

[0087] Step S301, obtain the feedback of the above new user, and adjust the above adjustment strategy of the above new user according to the above feedback.

[0088] Specifically, obtaining user feedback aims to obtain the actual experience and opinions of users on the adjustment strategy. This mechanism provides a bridge for interaction between users and network operators. When a user is identified as a user with abnormal traffic and their downstream rate is adjusted accordingly, collect the user's feedback, which includes but is not limited to the perception of network speed changes, the understanding of rate limiting measures, and the evaluation of overall service satisfaction. The feedback can reveal the actual effect of the adjustment strategy, including whether it effectively alleviates network load, whether it has a negative impact on the user experience, and whether it is necessary to make secondary adjustments or optimizations to the current strategy.

[0089] Figure 3FIG. 1 is a flowchart of user feedback processing of an abnormal flow limiting method according to an embodiment of the present application. Figure 3 As shown in the figure, after adjusting the customer's downlink rate, some customers will report the situation to the customer service center, and the customer service center will judge whether the adjusted user uses traffic maliciously. If the customer service center determines through analysis that the user does not use traffic maliciously, that is, his traffic usage behavior is within the normal range, but the flow limiting mechanism is triggered due to specific conditions, then the customer service center will take measures to restore the user's normal downlink rate to ensure that the user experience is not unreasonably disturbed. If the customer service center determines that the user does use traffic maliciously, the customer service will recommend some suitable services to the customer to prevent the customer from exceeding the limit on traffic usage.

[0090] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0091] The embodiment of the present application also provides an abnormal flow rate limiting device. It should be noted that an abnormal flow rate limiting device of the embodiment of the present application can be used to execute an abnormal flow rate limiting method provided by the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0092] The following introduces an abnormal flow rate limiting device provided in an embodiment of the present application.

[0093] Figure 4 is a structural block diagram of an abnormal flow limiting device according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0094] The establishment unit 10 is used to establish an abnormal traffic scoring standard according to user characteristics, and calculate risk scores of multiple users according to the abnormal traffic scoring standard, wherein the risk scores are used to evaluate the possibility of the user's illegal use of traffic, and the user characteristics include the user type of the user, the size of the downlink service traffic, the resident cell type and the downlink service type;

[0095] Specifically, an abnormal traffic scoring criterion is constructed, that is, a set of detailed scoring guidelines are designed to perform risk scoring on network users. This scoring criterion combines the key features of users, including but not limited to user types, the magnitude of downstream service traffic, resident cell types, and downstream service types, to quantify the abnormal traffic risks of network users in all aspects. By applying this scoring criterion, the risk score of each network user can be calculated. This risk score is directly related to the likelihood of users' illegal use of network resources, forming a precise quantification of users' traffic usage behaviors. By quantifying the risk scores, potential illegal users can be automatically identified without manual screening one by one, greatly improving the efficiency of abnormal traffic detection and providing a basis for establishing an abnormal traffic detection model in the future.

[0096] A determination unit 20 is configured to determine users corresponding to the risk scores less than the risk score threshold as normal traffic users and users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users.

[0097] Specifically, by setting a clear risk score threshold as a discrimination criterion, for users who have been calculated by the abnormal traffic scoring criterion, those with risk scores less than this preset risk score threshold are automatically identified by the system as normal traffic users, indicating that their behaviors in using network resources conform to the norm and do not show a tendency of illegal use. On the contrary, for those users whose risk scores reach or exceed the risk score threshold, they are identified by the system as abnormal traffic users, and these users have a relatively high possibility of using illegal traffic, imposing an unexpected burden on network resources.

[0098] A training unit 30 is configured to train a neural network model based on the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model.

[0099] Specifically, the neural network model is deeply trained by using the different user characteristics exhibited by normal traffic users and abnormal traffic users to construct a high-precision abnormal traffic detection model. By mining and comparing the differential information of the two types of users in terms of user types, the magnitude of downstream service traffic, resident cell types, and downstream service types as the dataset for model training, the model can learn the key feature patterns for distinguishing normal and abnormal traffic. After this training stage, the model can not only automatically extract features from the data but also generalize based on the learned patterns, that is, accurately judge the abnormal traffic of unseen user data.

[0100] The control unit 40 is configured to input the user characteristics of the new user into the abnormal traffic detection model, obtain the abnormal probability of the new user, and formulate an adjustment strategy to limit the downlink rate of the new user when the abnormal probability of the new user is greater than or equal to the first predetermined threshold.

[0101] Specifically, after obtaining the abnormal traffic detection model, the user characteristics of the new user are input into the abnormal traffic detection model. The abnormal traffic detection model can determine whether the new user is an abnormal user according to the user characteristics of the new user. Its specific user attributes, including user type, the size of the downlink service traffic, the type of the resident cell, and the type of the downlink service, will be collected in real time and input into the pre-trained abnormal traffic detection model for in-depth analysis. The model can quickly calculate the abnormal traffic behavior probability of the new user, that is, the risk degree of the new user's possible illegal traffic use during the network usage process. If the abnormal probability value reaches or exceeds the set first predetermined threshold, the system automatically determines that the new user has an abnormal traffic risk, and then formulates and executes an adjustment strategy to accurately control the size of the downlink rate of the new user, so as to avoid potential abuse of network resources.

[0102] Through this embodiment, in the above abnormal traffic throttling device, a building unit is configured to establish an abnormal traffic scoring criterion according to user characteristics, and calculate risk scores of multiple users according to the abnormal traffic scoring criterion. The risk scores are used to evaluate the likelihood of the users' illegal use of traffic. The user characteristics include the user type of the users, the size of the downstream service traffic, the type of the resident cell, and the type of the downstream service. A determining unit is configured to determine the users corresponding to the risk scores less than a risk score threshold as normal traffic users, and determine the users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users. A training unit is configured to train a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model. A control unit is configured to input the user characteristics of a new user into the abnormal traffic detection model to obtain the abnormal probability of the new user, and formulate an adjustment strategy to limit the downstream rate of the new user when the abnormal probability of the new user is greater than or equal to a first predetermined threshold. Through establishing an abnormal traffic scoring criterion, calculating risk scores of multiple users, dividing normal traffic users and abnormal traffic users according to the risk scores, training a neural network model with the user characteristics of normal traffic users and the user characteristics of abnormal traffic users to obtain an abnormal traffic detection model, obtaining an abnormal probability when inputting the user characteristics of a new user, and adjusting the downstream rate of the new user according to an adjustment strategy when the abnormal probability exceeds a predetermined threshold, the present application avoids waste of network resources caused by malicious use of traffic by abnormal traffic users, and solves the problem of uneven network resource allocation caused by inaccurate detection of abnormal traffic users in the prior art.

[0103] In order to establish an abnormal traffic scoring criterion to score the risk of users, in an alternative embodiment, an abnormal traffic scoring criterion is established according to user characteristics, and risk scores of multiple users are calculated according to the abnormal traffic scoring criterion. The building unit includes:

[0104] A first building module is configured to obtain a first risk score and accumulate the first risk score to the risk score when the user type of the user is a non-ordinary mobile user. The initial value of the risk score is zero;

[0105] Specifically, when it is recognized that the type of a certain user does not belong to the regular individual users of network operators, that is, the user belongs to the category of non-ordinary mobile users. Non-ordinary mobile users include, but are not limited to, Internet of Things card users, enterprise-level users, and wireless broadband users. When the feature of being a non-ordinary mobile user is detected, the user will be assigned a specific first risk score, which reflects that non-ordinary mobile users may show a higher tendency of abnormal traffic behavior compared to ordinary users. Subsequently, this first risk score will be accumulated into the user's risk score, and the initial setting value of each user's risk score is zero.

[0106] A second establishment module, configured to obtain a second risk score and accumulate the second risk score into the risk score when the size of the downlink service traffic of the above user is greater than or equal to a second predetermined threshold.

[0107] Specifically, when it is monitored that the scale of the downlink service traffic of a certain user within a certain period reaches or exceeds the second predetermined threshold, this indicates that the user may be performing tasks with high traffic demands, such as high-definition video stream transmission, large file download, etc., thus imposing a significant pressure on network resources. At this time, the system will assign a second risk score to the user, which quantifies the contribution degree of the user's high-traffic behavior to the potential abnormal risk of the network. Subsequently, this second risk score will be accumulated into the user's risk score for comprehensively evaluating the risk level of their network behavior.

[0108] A third establishment module, configured to obtain a third risk score and accumulate the third risk score into the risk score when the above user's above resident cell type is a village in the city or an industrial park.

[0109] Specifically, when it is recognized that the resident cell of a certain user is a specific type of area such as a village in the city or an industrial park, the system will assign a third risk score to the user, which reflects the possible abnormal traffic risk patterns in the specific cell type. Due to the dense population or equipment distribution and high-frequency data interaction requirements in villages in the city and industrial parks, they often become high-frequency locations for abnormal traffic activities. Subsequently, the system will accumulate the third risk score into the user's risk score, further enriching the consideration factors for risk assessment and enabling it to comprehensively analyze the combined influence of user behavior and their surrounding environment.

[0110] A fourth establishment module, configured to obtain a fourth risk score and accumulate the fourth risk score into the risk score when the above user's above downlink service type is a video service or a download service.

[0111] Specifically, the downstream service type is regarded as a key metric for detecting user data consumption. When the system monitors that the downstream service type of a user is mainly video service or download service, it indicates that the user may be frequently accessing resource-intensive services, such as high-definition video streams, large file transfers, etc., which have high requirements for network bandwidth and resources. Based on this, the system assigns a fourth risk score to the user, which quantifies the impact degree of video services and download services on the potential abnormal traffic risk of the network. Subsequently, this score is accumulated into the user's risk score, thus forming an abnormal traffic risk assessment system that comprehensively considers the user's service type.

[0112] The fifth establishment module is used to use the current above-mentioned risk score as the above-mentioned risk score of the above-mentioned user.

[0113] Specifically, when the system completes the comprehensive analysis of all relevant features (user type, size of downstream service traffic, resident cell type, downstream service type) of a user within a specific time window, and calculates an accumulated risk score based on these features, the current risk score is determined as the user's final risk score. This process ensures the real-time and accuracy of the risk score, reflecting the potential risk of the user's current network behavior.

[0114] In order to obtain an abnormal traffic detection model to detect abnormal traffic users, in an optional implementation manner, the neural network model is trained according to the above-mentioned user features of the above-mentioned normal traffic users and the above-mentioned user features of the above-mentioned abnormal traffic users to obtain an abnormal traffic detection model. The above-mentioned training unit includes:

[0115] The first training module is used to extract feature vectors from the above-mentioned user features corresponding to the above-mentioned normal traffic users to obtain a plurality of first vectors, and extract feature vectors from the above-mentioned user features corresponding to the above-mentioned abnormal traffic users to obtain a plurality of second vectors;

[0116] Specifically, the user feature data identified as normal traffic users is deeply processed and converted into a series of high-dimensional first vectors through an algorithm. Each first vector contains the key network feature information of the corresponding user. And feature vectors are extracted from the data of abnormal traffic users to generate a series of second vectors, which also contain the key feature information of abnormal users in network activities. This process provides data preparation for the subsequent establishment of an abnormal traffic detection model.

[0117] The second training module is used to input each of the above-mentioned first vectors and each of the above-mentioned second vectors into a contrast loss function, adjust the parameters of the above-mentioned neural network model until the contrast loss function converges, and obtain the above-mentioned abnormal traffic detection model.

[0118] Specifically, the first vector extracted from normal traffic users and the second vector extracted from abnormal traffic users are used as training data and input into the contrast loss function. The contrast loss function is a loss function specifically used to measure the similarity or difference between two inputs. In the field of abnormal traffic recognition, it is used to enhance the model's ability to distinguish normal and abnormal traffic. By calculating the distance or similarity between the first vector and the second vector using the contrast loss function, and using this information as a feedback signal, the system dynamically adjusts the internal parameters of the neural network model. This process is repeatedly executed until the contrast loss function reaches a convergence state, that is, the model can stably distinguish normal and abnormal traffic users and no longer makes large adjustments to the parameters. Finally, an optimized and trained abnormal traffic detection model is obtained, which can accurately identify abnormal traffic users based on user feature vectors.

[0119] In order to restrict the traffic of abnormal traffic users, in an optional implementation manner, when the abnormal probability of the above-mentioned new user exceeds a predetermined threshold, an adjustment strategy is formulated to restrict the downlink rate of the above-mentioned new user. The control unit includes:

[0120] The first control module is used to formulate multiple adjustment strategies according to the PRB utilization rate of the above-mentioned user. The adjustment strategy is to prevent the above-mentioned user from abnormally using traffic by reducing the magnitude of the downlink rate of the above-mentioned user. The PRB utilization rate is used to describe the occupancy degree of radio resources in the communication network;

[0121] Specifically, based on the real-time monitoring of the user's PRB utilization rate, multiple adjustment strategies are formulated, aiming to dynamically adjust the downlink rate of the user according to the current PRB utilization rate of the user, effectively suppressing the excessive consumption of abnormal traffic and maintaining the healthy operation of the network. That is, when it is monitored that the PRB utilization rate of a certain user increases abnormally, indicating that its network activity may cause excessive pressure on system resources, the system will enable the corresponding adjustment strategy, that is, reduce the downlink rate of the user, so as to limit its data transmission speed, reduce the occupancy of shared network resources, and prevent the performance of the entire network from declining due to the abnormal behavior of individual users.

[0122] The second control module is used to set the weights of the 4G load, 4G traffic, and user rate;

[0123] The third control module is used to determine the value of the downlink rate of the above-mentioned new user that needs to be adjusted in each of the above-mentioned adjustment strategies according to the PRB utilization rate of the above-mentioned new user, and obtain the first downlink rate corresponding to each of the above-mentioned adjustment strategies;

[0124] The fourth control module is used to calculate the influence degrees of the above adjustment strategies on the 4G load, the 4G traffic volume, and the user rate after adjusting the above first downlink rate, multiply the weight of the above 4G load by the influence degree of the 4G load to obtain the first weighted value corresponding to each of the above adjustment strategies, multiply the weight of the above 4G traffic volume by the influence degree of the 4G traffic volume to obtain the second weighted value corresponding to each of the above adjustment strategies, multiply the weight of the above user rate by the influence degree of the user rate to obtain the third weighted value corresponding to each of the above adjustment strategies. The influence degree of the 4G load is used to describe the reduction ratio of the above 4G load of the current base station when reducing the above downlink rate. The influence degree of the 4G traffic volume is used to describe the reduction ratio of the above 4G traffic volume of the current base station when reducing the above downlink rate. The influence degree of the user rate is used to describe the increase ratio of the rates of other users covered by the current base station when reducing the above downlink rate;

[0125] The fifth control module is used to add the above first weighted value, the above second weighted value, and the above third weighted value corresponding to each of the above adjustment strategies to obtain the comprehensive weighted value corresponding to each of the above adjustment strategies;

[0126] The sixth control module is used to compare the magnitudes of the above comprehensive weighted values of each of the above adjustment strategies, and determine the adjustment strategy with the largest above comprehensive weighted value as the optimal adjustment strategy;

[0127] The seventh control module is used to adjust the above downlink rate of the above user according to the above optimal adjustment strategy.

[0128] Specifically, by setting the weights of the 4G load, the 4G traffic volume, and the user rate, the priorities of different network performance indicators in resource allocation are clarified, and according to the specific situation of the PRB utilization rate of the new user, the adjustment values of the corresponding first downlink rate in each adjustment strategy are determined, aiming to adjust the user data transmission speed by means of rate limiting. When evaluating the impacts of these strategies, the specific influence degrees on the 4G load, the 4G traffic volume, and the user rate are calculated and multiplied by the corresponding weights to obtain the first, second, and third weighted values of each strategy. By adding these weighted values, the comprehensive weighted value of each strategy is obtained, and this value reflects the comprehensive benefit of the strategy in meeting the multi-objective optimization requirements. Finally, the system selects the strategy with the highest comprehensive weighted value as the optimal adjustment strategy and adjusts the downlink rate of the new user accordingly, realizing the dynamic optimal allocation of network resources.

[0129] In an optional implementation manner, in order to reasonably limit the traffic volume of abnormal traffic users, multiple above adjustment strategies are formulated according to the PRB utilization rate of the above new user. The above first control module includes:

[0130] The first control sub-module is used to execute the first adjustment strategy. When the PRB utilization rate of the above-mentioned user is greater than 70% and less than 80%, adjust the above-mentioned downlink rate to be less than 5 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 80% and less than 90%, adjust the above-mentioned downlink rate to be less than 4 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 90% and less than 100%, adjust the above-mentioned downlink rate to be less than 2 Mbps;

[0131] The second control sub-module is used to execute the second adjustment strategy. When the PRB utilization rate of the above-mentioned user is greater than 50% and less than 80%, adjust the above-mentioned downlink rate to be less than 5 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 80% and less than 90%, adjust the above-mentioned downlink rate to be less than 4 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 90% and less than 100%, adjust the above-mentioned downlink rate to be less than 2 Mbps;

[0132] The third control sub-module is used to execute the third adjustment strategy. When the PRB utilization rate of the above-mentioned user is greater than 20% and less than 70%, adjust the above-mentioned downlink rate to be less than 5 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 70% and less than 80%, adjust the above-mentioned downlink rate to be less than 4 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 80% and less than 100%, adjust the above-mentioned downlink rate to be less than 2 Mbps;

[0133] The fourth control sub-module is used to execute the fourth adjustment strategy. When the PRB utilization rate of the above-mentioned user is greater than 20% and less than 50%, adjust the above-mentioned downlink rate to be less than 5 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 50% and less than 80%, adjust the above-mentioned downlink rate to be less than 4 Mbps. When the PRB utilization rate of the above-mentioned user is greater than 80% and less than 100%, adjust the above-mentioned downlink rate to be less than 2 Mbps.

[0134] Specifically, by defining a multi-level dynamic adjustment strategy based on the user's PRB utilization rate, the downlink rate of the user is intelligently limited in different PRB utilization rate threshold ranges, aiming to balance network resource allocation, optimize network efficiency, and ensure the quality of service of users under different network loads, so as to achieve precise control of abnormal traffic and overall improvement of network performance. The above strategy is based on real-time monitoring of the PRB utilization rate, which can accurately identify the degree of network resource tension. Through hierarchical rate limiting, effective control of users with abnormal traffic is achieved. Each of the four adjustment strategies has its own focus and can be flexibly adjusted according to different scenarios and user behaviors. By limiting the downlink rate of users with abnormal traffic through the above four adjustment strategies, more network resources are released for other users, thus improving the network experience of normal users and reducing user complaints caused by network congestion, especially during network peak hours, enabling it to respond quickly, maintain network stability, and avoid excessive consumption of resources. After obtaining the abnormal traffic situation, the DPI service identification technology is used for service identification. When it is identified that it is not a malicious behavior, no adjustment is made, and when it is identified as a malicious behavior, the corresponding adjustment is made according to the above method.

[0135] In order to avoid restricting wrong users with abnormal traffic, in an optional implementation manner, after formulating an adjustment strategy to limit the downlink rate of the above new user, the above device further includes:

[0136] A feedback unit, configured to obtain the feedback of the above new user, and adjust the above adjustment strategy of the above new user according to the above feedback.

[0137] Specifically, obtaining user feedback aims to obtain the actual experience and opinions of users on the adjustment strategy. This mechanism provides a bridge for interaction between users and network operators. When a user is identified as a user with abnormal traffic and their downlink rate is adjusted accordingly, user feedback is collected, which includes but is not limited to the perception of network speed changes, the understanding of rate limiting measures, and the evaluation of overall service satisfaction. The feedback can reveal the actual effect of the adjustment strategy, including whether it effectively alleviates network load, whether it has a negative impact on user experience, and whether it is necessary to make secondary adjustments or optimizations to the current strategy.

[0138] The above abnormal traffic rate limiting device includes a processor and a memory. The above establishment unit, determination unit, training unit, control unit, etc. are all stored in the memory as program units, and the corresponding functions are implemented by the processor executing the above program units stored in the memory. The above modules are all located in the same processor; or, the above each module is located in different processors in any combination form.

[0139] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the accuracy of detecting abnormal traffic users can be improved by adjusting kernel parameters.

[0140] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0141] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned abnormal traffic limiting method.

[0142] Specifically, an abnormal flow limiting method includes:

[0143] Step S201, establishing an abnormal traffic scoring standard according to user characteristics, and calculating risk scores of multiple users according to the abnormal traffic scoring standard, the risk scores are used to assess the possibility of the users using traffic in violation of regulations, the user characteristics include the user type of the user, the size of downlink service traffic, the resident cell type and the downlink service type;

[0144] Step S202, determining users corresponding to the risk scores less than the risk score threshold as normal traffic users, and determining users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users;

[0145] Step S203, training a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model;

[0146] Step S204, input the above-mentioned user characteristics of the new user into the above-mentioned abnormal traffic detection model to obtain the abnormal probability of the above-mentioned new user, and when the above-mentioned abnormal probability of the above-mentioned new user is greater than or equal to the first predetermined threshold, formulate an adjustment strategy to limit the downlink rate of the above-mentioned new user.

[0147] An embodiment of the present invention provides a processor, which is used to run a program, wherein the above-mentioned abnormal traffic flow limiting method is executed when the above-mentioned program is run.

[0148] Specifically, an abnormal flow limiting method includes:

[0149] Step S201, establishing an abnormal traffic scoring standard according to user characteristics, and calculating risk scores of multiple users according to the abnormal traffic scoring standard, the risk scores are used to assess the possibility of the users using traffic in violation of regulations, the user characteristics include the user type of the user, the size of downlink service traffic, the resident cell type and the downlink service type;

[0150] Step S202, determining users corresponding to the risk scores less than the risk score threshold as normal traffic users, and determining users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users;

[0151] Step S203, training a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model;

[0152] Step S204, input the above-mentioned user characteristics of the new user into the above-mentioned abnormal traffic detection model to obtain the abnormal probability of the above-mentioned new user, and when the above-mentioned abnormal probability of the above-mentioned new user is greater than or equal to the first predetermined threshold, formulate an adjustment strategy to limit the downlink rate of the above-mentioned new user.

[0153] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0154] Step S201, establishing an abnormal traffic scoring standard according to user characteristics, and calculating risk scores of multiple users according to the abnormal traffic scoring standard, the risk scores are used to assess the possibility of the users using traffic in violation of regulations, the user characteristics include the user type of the user, the size of downlink service traffic, the resident cell type and the downlink service type;

[0155] Step S202, determining users corresponding to the risk scores less than the risk score threshold as normal traffic users, and determining users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users;

[0156] Step S203, training a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model;

[0157] Step S204, input the above-mentioned user characteristics of the new user into the above-mentioned abnormal traffic detection model to obtain the abnormal probability of the above-mentioned new user, and when the above-mentioned abnormal probability of the above-mentioned new user is greater than or equal to the first predetermined threshold, formulate an adjustment strategy to limit the downlink rate of the above-mentioned new user.

[0158] Obviously, those skilled in the art should understand that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device. They can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. They can be implemented by program codes executable by the computing device. Thus, they can be stored in a storage device and executed by the computing device. And in some cases, the steps shown or described can be executed in a different order than here, or they can be separately fabricated into individual integrated circuit modules, or multiple modules or steps among them can be fabricated into a single integrated circuit module for implementation. In this way, the present invention is not limited to any specific combination of hardware and software.

[0159] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0160] The present application is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the functions specified in Figure 1 one or more of the flows Figure 1 or multiple flows and / or blocks

[0161] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device that implements the functions specified in Figure 1 one or more of the flows Figure 1 or multiple flows and / or blocks

[0162] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable device provide for implementing the functions in the flowFigure 1 one or more processes and / or blocks Figure 1 steps of functions specified in one or more blocks

[0163] In a typical configuration, a computing device includes one or more processors (CPUs), an input / output interface, a network interface, and memory.

[0164] The memory may include non-permanent memory in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0165] Computer-readable media includes permanent and non-permanent, removable and non-removable media implemented by any method or technology for information storage. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile discs (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0166] It should also be noted that the term "comprising", "including" or any other variation thereof is intended to cover non-exclusive inclusion, such that a process, method, commodity or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, commodity or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, commodity or device comprising the element.

[0167] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0168] 1) An abnormal traffic rate limiting method of the present application establishes an abnormal traffic scoring standard, calculates the risk scores of multiple users, divides normal traffic users and abnormal traffic users according to the risk scores, trains a neural network model with the user characteristics of normal traffic users and abnormal traffic users to obtain an abnormal traffic detection model, obtains an abnormal probability when inputting the user characteristics of a new user, and adjusts the downlink rate of the new user according to an adjustment strategy when the abnormal probability exceeds a predetermined threshold, avoiding waste of network resources caused by malicious use of traffic by abnormal traffic users and solving the problem of uneven network resource allocation caused by inaccurate detection of abnormal traffic users in the prior art.

[0169] 2) An abnormal traffic rate limiting device of the present application establishes an abnormal traffic scoring standard, calculates the risk scores of multiple users, divides normal traffic users and abnormal traffic users according to the risk scores, trains a neural network model with the user characteristics of normal traffic users and abnormal traffic users to obtain an abnormal traffic detection model, obtains an abnormal probability when inputting the user characteristics of a new user, and adjusts the downlink rate of the new user according to an adjustment strategy when the abnormal probability exceeds a predetermined threshold, avoiding waste of network resources caused by malicious use of traffic by abnormal traffic users and solving the problem of uneven network resource allocation caused by inaccurate detection of abnormal traffic users in the prior art.

[0170] The above are only the preferred embodiments of the present application and are not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for limiting abnormal flow, characterized in that: include: Establishing an abnormal traffic scoring standard according to user characteristics, and calculating risk scores of multiple users according to the abnormal traffic scoring standard, wherein the risk scores are used to assess the possibility of the user's illegal use of traffic, wherein the user characteristics include the user type of the user, the size of the downlink service traffic, the resident cell type, and the downlink service type; Determine the users corresponding to the risk scores less than the risk score threshold as normal traffic users, and determine the users corresponding to the risk scores greater than or equal to the risk score threshold as abnormal traffic users; Training a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model; The user characteristics of the new user are input into the abnormal traffic detection model to obtain the abnormal probability of the new user, and when the abnormal probability of the new user is greater than or equal to a first predetermined threshold, an adjustment strategy is formulated to limit the downlink rate of the new user.

2. The method according to claim 1, characterized in that: An abnormal traffic scoring standard is established according to user characteristics, and risk scores of multiple users are calculated according to the abnormal traffic scoring standard, including: In a case where the user type of the user is a non-ordinary mobile user, obtaining a first risk score, and adding the first risk score to the risk score, where an initial value of the risk score is zero; When the size of the downlink service flow of the user is greater than or equal to a second predetermined threshold, obtaining a second risk score, and adding the second risk score to the risk score; When the type of the resident community of the user is an urban village or an industrial community, obtaining a third risk score, and adding the third risk score to the risk score; When the downlink service type of the user is a video service or a download service, obtaining a fourth risk score, and adding the fourth risk score to the risk score; The current risk score is used as the risk score of the user.

3. The method according to claim 1, characterized in that The neural network model is trained according to the user characteristics of the normal traffic user and the user characteristics of the abnormal traffic user to obtain an abnormal traffic detection model, including: Extracting feature vectors from the user features corresponding to the normal traffic users to obtain a plurality of first vectors, and extracting feature vectors from the user features corresponding to the abnormal traffic users to obtain a plurality of second vectors; Input each of the first vectors and each of the second vectors into a contrast loss function, adjust the parameters of the neural network model until the contrast loss function converges, and obtain the abnormal traffic detection model.

4. The method according to claim 1, characterized in that When the abnormal probability of the new user exceeds a predetermined threshold, formulating an adjustment strategy to limit the downlink rate of the new user includes: Formulate a plurality of adjustment strategies according to the PRB utilization rate of the user, wherein the adjustment strategy is to prevent the user from abnormally using traffic by reducing the downlink rate of the user, and the PRB utilization rate is used to describe the degree of occupancy of wireless resources in a communication network; Set the weight of 4G load, 4G traffic and user rate; Determine, in each of the adjustment strategies, a value of the downlink rate of the new user that needs to be adjusted according to the PRB utilization rate of the new user, and obtain a first downlink rate corresponding to each of the adjustment strategies; Calculate the degree of influence of the 4G load, the degree of influence of the 4G traffic, and the degree of influence of the user rate after each adjustment strategy adjusts the first downlink rate, and multiply the weight of the 4G load by the degree of influence of the 4G load to obtain a first weighted value corresponding to each adjustment strategy, multiply the weight of the 4G traffic by the degree of influence of the 4G traffic to obtain a second weighted value corresponding to each adjustment strategy, and multiply the weight of the user rate by the degree of influence of the user rate to obtain a third weighted value corresponding to each adjustment strategy, the degree of influence of the 4G load is used to describe the proportion of the 4G load reduction of the current base station when the downlink rate is reduced, the degree of influence of the 4G traffic is used to describe the proportion of the 4G traffic reduction of the current base station when the downlink rate is reduced, and the degree of influence of the user rate is used to describe the proportion of the rate of other users covered by the current base station increased when the downlink rate is reduced; Adding the first weighted value, the second weighted value, and the third weighted value corresponding to each of the adjustment strategies to obtain a comprehensive weighted value corresponding to each of the adjustment strategies; Comparing the comprehensive weighted values ​​of the adjustment strategies, and determining the adjustment strategy with the largest comprehensive weighted value as the optimal adjustment strategy; The downlink rate of the user is adjusted according to the optimal adjustment strategy.

5. The method according to claim 4, characterized in that Formulate a plurality of adjustment strategies according to the PRB utilization rate of the new user, including: The first adjustment strategy is to adjust the downlink rate to less than 5 Mbps when the PRB utilization rate of the user is greater than 70% and less than 80%, to adjust the downlink rate to less than 4 Mbps when the PRB utilization rate of the user is greater than 80% and less than 90%, and to adjust the downlink rate to less than 2 Mbps when the PRB utilization rate of the user is greater than 90% and less than 100%. The second adjustment strategy is to adjust the downlink rate to less than 5 Mbps when the PRB utilization rate of the user is greater than 50% and less than 80%, to adjust the downlink rate to less than 4 Mbps when the PRB utilization rate of the user is greater than 80% and less than 90%, and to adjust the downlink rate to less than 2 Mbps when the PRB utilization rate of the user is greater than 90% and less than 100%. A third adjustment strategy is to adjust the downlink rate to less than 5 Mbps when the PRB utilization rate of the user is greater than 20% and less than 70%, to adjust the downlink rate to less than 4 Mbps when the PRB utilization rate of the user is greater than 70% and less than 80%, and to adjust the downlink rate to less than 2 Mbps when the PRB utilization rate of the user is greater than 80% and less than 100%. The fourth adjustment strategy is to adjust the downlink rate to less than 5 Mbps when the PRB utilization rate of the user is greater than 20% and less than 50%; to adjust the downlink rate to less than 4 Mbps when the PRB utilization rate of the user is greater than 50% and less than 80%; and to adjust the downlink rate to less than 2 Mbps when the PRB utilization rate of the user is greater than 80% and less than 100%.

6. The method according to claim 1, characterized in that After formulating an adjustment strategy to limit the downlink rate of the new user, the method further includes: Obtain feedback from the new user, and adjust the adjustment strategy for the new user according to the feedback.

7. An abnormal flow limiting device, characterized in that: include: An establishing unit is used to establish an abnormal traffic scoring standard according to user characteristics, and calculate risk scores of multiple users according to the abnormal traffic scoring standard, wherein the risk scores are used to evaluate the possibility of the user's illegal use of traffic, and the user characteristics include the user type of the user, the size of the downlink service traffic, the resident cell type and the downlink service type; A determination unit, configured to determine a user corresponding to a risk score less than a risk score threshold as a normal traffic user, and determine a user corresponding to a risk score greater than or equal to the risk score threshold as an abnormal traffic user; A training unit, configured to train a neural network model according to the user characteristics of the normal traffic users and the user characteristics of the abnormal traffic users to obtain an abnormal traffic detection model; A control unit is used to input the user characteristics of the new user into the abnormal traffic detection model to obtain the abnormal probability of the new user, and when the abnormal probability of the new user is greater than or equal to a first predetermined threshold, formulate an adjustment strategy to limit the downlink rate of the new user.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. An abnormal flow limiting system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include methods for executing any one of claims 1 to 6.

Images