Equipment risk identification method, system, equipment and product

Abstract

The invention discloses an equipment risk identification method, system, equipment and product, and belongs to the technical field of communication security. According to the method, the current weight of the IP address sequence is calculated in a time sequence attenuation mode, and the IP weight is automatically attenuated by using the time sequence attenuation characteristic of the IP address, so that the historical behavior of the equipment after the IP is replaced quickly loses efficacy, and the anti-interference capability is improved; the suppression weight of the SIM card replacement behavior is calculated by adopting a double-factor suppression function, and the high-frequency abnormal SIM card replacement behavior is suppressed through the double-factor suppression function based on card replacement frequency suppression and SIM card survival time suppression, so that the recognition sensitivity of malicious equipment is remarkably improved; and weight fusion score calculation is carried out according to the current weight and the inhibition weight, a two-dimensional time sequence attenuation mechanism is formed through cooperative superposition of IP weight attenuation and SIM replacement inhibition, a dynamic, tamper-resistant or anti-counterfeiting equipment portrait is constructed together, and the tamper-resistant or anti-counterfeiting capability and the anti-interference capability are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication security, and in particular to a device risk identification method, system, device and product. BACKGROUND

[0002] In related technologies, communication device anti-fraud technologies are mainly divided into the following two categories: 1. Static device fingerprint technology: relying on device hardware identification (such as IMEI, MAC address) to construct a unique fingerprint, but it is easy to be tampered with or forged (such as resetting IMEI through flashing), thereby evading detection.

[0003] 2. Behavior analysis technology: risk identification is performed through device network behavior (such as IP address, call frequency), but there is also the problem of historical data interference: the timeliness of IP addresses is not considered, and long-term unused IP addresses are still counted in risk statistics, resulting in false positives.

[0004] In summary, the technical problems existing in related technologies need to be improved. SUMMARY

[0005] To solve at least one of the above technical problems, the main purpose of the embodiments of the present application is to propose a device risk identification method, system, device and product, which can improve the anti-tampering or anti-forging capability and anti-interference capability.

[0006] To achieve the above purpose, one aspect of an embodiment of the present application proposes a device risk identification method, which comprises the following steps: Obtaining an IP address sequence used by a to-be-identified device and a SIM card replacement record; Calculating the current weight of the IP address sequence in a time sequence attenuation manner; According to the SIM card replacement record, a double-factor inhibition function is used to calculate the inhibition weight of the SIM card replacement behavior, the double-factor inhibition function including a first inhibition factor for controlling the number of card replacements and a second inhibition factor for controlling the survival time; According to the current weight and the inhibition weight, a weight fusion score is calculated to obtain a risk score of the to-be-identified device; According to the risk score, risk devices are identified and disposal decisions are made.

[0007] In some embodiments, the risk device identification and disposal decision making according to the risk score comprises: obtaining a risk threshold corresponding to the current period, wherein the risk threshold is dynamically set by a five-period adaptive threshold strategy, and the five-period adaptive threshold strategy specifically includes: a risk threshold of 0.30 corresponding to a deep sleep period of 01:00-05:00; a risk threshold of 0.35 corresponding to a morning overdrive period of 05:00-08:00; a risk threshold of 0.60 corresponding to a morning active period of 08:00-14:00; a risk threshold of 0.55 corresponding to an afternoon high-risk period of 14:00-20:00; and a risk threshold of 0.40 corresponding to a night back-off period of 20:00-01:00; comparing the risk score with the risk threshold corresponding to the current period, and if the risk score exceeds the risk threshold, determining the to-be-identified device as a high-risk device and performing a corresponding high-risk disposal operation.

[0008] In some embodiments, the current weight of the IP address sequence is calculated in a time-series decay manner, including: calculating a real-time weight of each IP address in the IP address sequence by an exponential decay function; calculating the current weight of the IP address sequence according to the real-time weight of each IP address.

[0009] In some embodiments, the SIM card replacement record includes the number of SIM card replacements within 30 days of the to-be-identified device and the average survival time of the SIM card; and the expression of the double-factor inhibition function is: , wherein, is an inhibition weight of the SIM card replacement behavior, e is a base number of a natural logarithm function, is the number of SIM card replacements within 30 days of the to-be-identified device; is the average survival time of the SIM card; (k1, c1) is a first inhibition factor, k1 is a slope control parameter of the first inhibition factor, and c1 is a turning point control parameter of the first inhibition factor; (k2, c2) is a second inhibition factor, k2 is a slope control parameter of the second inhibition factor, and c2 is a turning point control parameter of the second inhibition factor.

[0010] In some embodiments, the expression of the exponential decay function is: , wherein, is a real-time weight of the IP address, e is a base number of a natural logarithm function, and λ is a decay coefficient, , is an unused time interval of the IP address, is equal to the difference between the current time and the last use time of the IP address; The current weight of the IP address sequence is calculated according to the real-time weight of each IP address, and the calculation includes: The average value of the real-time weights of all the IP addresses is calculated as the current weight of the IP address sequence.

[0011] In some embodiments, the weight fusion score calculation according to the current weight and the suppression weight to obtain the risk score of the device to be identified includes: According to the current weight and the suppression weight, a risk score calculation formula is used to calculate the risk score of the device to be identified, and the risk score calculation formula is: , Wherein, is the risk score of the device to be identified, is the total number of high-frequency IP addresses in 1 hour, and the high-frequency IP address represents an IP address that is used more than or equal to 5 times in 1 hour, is the current weight of the IP address sequence, is the number of SIM card replacements of the device to be identified in 30 days, is the suppression weight of the SIM card replacement behavior, and are adjustment coefficients, , , .

[0012] In some embodiments, the IP address sequence used by the device to be identified and the SIM card replacement record are obtained, and the obtaining includes: The IP address sequence of the device to be identified is collected from the NAT gateway of the operator base station, wherein the IP collection field format used when collecting is: <device identification IMEI, timestamp, base station ID, allocated IP, port usage, uplink and downlink traffic>; The device-number binding record of the device to be identified is collected from the HLR of the operator base station, and the SIM card replacement record is obtained by statistics, wherein the SIM collection field format used when collecting is: <device identification IMEI, SIM card identification ICCID, binding time, unbinding time>.

[0013] Another aspect of the embodiment of the application provides a device risk identification system, and the system includes: A data acquisition module is configured to acquire an IP address sequence used by a device to be identified and a SIM card replacement record; An IP time sequence attenuation weight calculation module is configured to calculate a current weight of the IP address sequence in a time sequence attenuation manner; The SIM replacement double-factor dynamic inhibition weight calculation module is configured to calculate an inhibition weight of a SIM card replacement behavior according to the SIM card replacement record by using a double-factor inhibition function, wherein the double-factor inhibition function includes a first inhibition factor for controlling the number of card replacements and a second inhibition factor for controlling the survival time; The device risk score calculation module is configured to perform weight fusion score calculation according to the current weight and the inhibition weight, and obtain a risk score of the device to be identified. The risk identification and decision module is configured to perform identification and disposal decision of the risk device according to the risk score.

[0014] To achieve the above object, another aspect of the embodiments of the present application provides an electronic device, comprising: at least one processor; at least one memory configured to store at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the above method.

[0015] To achieve the above object, another aspect of the embodiments of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above method.

[0016] To achieve the above object, another aspect of the embodiments of the present application provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the above method.

[0017] The embodiments of the present application at least have the following beneficial effects: the present application provides a device risk identification method, system, device, medium and product, the scheme first acquires the IP address sequence used by the to-be-identified device and the SIM card replacement record, then calculates the current weight of the IP address sequence in a time sequence attenuation manner, calculates the inhibition weight of the SIM card replacement behavior by using a double-factor inhibition function according to the SIM card replacement record; then, weight fusion score calculation is performed according to the current weight and the inhibition weight, to obtain the risk score of the to-be-identified device; finally, risk device identification and disposal decision are performed according to the risk score. The scheme calculates the current weight of the IP address sequence in a time sequence attenuation manner, automatically attenuates the IP weight by using the time sequence attenuation characteristics of the IP address, makes the historical behavior of the device after replacing the IP quickly invalid, solves the problem of historical data interference, and improves the anti-interference ability; the double-factor inhibition function is used to calculate the inhibition weight of the SIM card replacement behavior, the double-factor inhibition function based on the number of card changes and the inhibition of the SIM card survival time is used to suppress the high-frequency abnormal SIM card replacement behavior, the frequent SIM card change behavior is quantified as a risk additive factor, and the identification sensitivity to malicious devices is significantly improved; the weight fusion score calculation is performed according to the current weight and the inhibition weight, the synergistic superposition of “IP weight attenuation + SIM replacement inhibition” is formed, a double-dimensional time sequence attenuation mechanism is formed, and a dynamic, tamper-resistant or anti-forgery device image is jointly constructed, and the tamper-resistant or anti-forgery ability and the anti-interference ability are effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 The system architecture diagram provided by the embodiments of the present application; Figure 2 The step flowchart of the device risk identification method provided by the embodiments of the present application; Figure 3 It is a specific embodiment flowchart of the device risk identification method provided by the embodiments of the present application; Figure 4 It is a device risk identification system structure schematic diagram provided by the embodiments of the present application; Figure 5 It is a hardware structure schematic diagram of an electronic device provided by the embodiments of the present application; Figure 6 It is another hardware structure schematic diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0019] In order to make the purposes, technical solutions and advantages of the present application clearer, further detailed explanations will be given below in combination with the accompanying drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and should not be used to limit the present application. When the following description refers to the accompanying drawings, the same numbers in different drawings represent the same or similar elements unless otherwise specified. The implementations described in the following exemplary examples do not represent all implementations consistent with embodiments of the present application. They are merely examples of apparatuses and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0020] It can be understood that the terms “first”, “second” and the like used in the present application can be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word “if” as used herein can be interpreted as “when” or “when” or “in response to determining”.

[0021] The terms “at least one”, “multiple”, “each”, “any” and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0023] Before the embodiments of the present application are described in detail, first, some nouns and terms involved in the embodiments of the present application are explained, and the nouns and terms involved in the embodiments of the present application are applicable to the following explanations.

[0024] IP address (Internet Protocol Address, Internet Protocol Address), also called Internet Protocol Address), is a unified address format provided by IP protocol, which allocates a logical address for each network and each host on the Internet, so as to shield the difference of physical address.

[0025] SIM card (Subscriber Identity Module), also known as user identity card, smart card, GSM digital mobile phone must be equipped with this card can be used. On the computer chip stores the information of digital mobile phone customers, encryption keys and user phone book and other content, can be used for GSM network customer identity authentication, and the user's voice information encryption when calling.

[0026] NAT (Network Address Translation, network address translation) is an access wide area network (WAN) technology, is a kind of private (reserved) address translation into a legal IP address conversion technology, it is widely used in various types of Internet access and various types of network. The reason is very simple, NAT not only perfectly solve the problem of IP address shortage, but also can effectively avoid attacks from outside the network, hide and protect the computer inside the network. And NAT gateway is a kind of network address translation service.

[0027] IME (International Mobile Equipment Identity, international mobile equipment identity), commonly known as "mobile phone serial number", "mobile phone serial code", "mobile phone serial number", used to identify each independent mobile phone in GSM mobile network, equivalent to the identity card number of mobile phone.

[0028] HLR (Home Location Register, home location register), a responsible for the management of mobile user database, permanent storage and record of the user's subscription data in the region, and dynamically update the location information of the user, in order to provide the network routing of the called user in the call service. HLR is the CN (Core Network, core network) of GSM / GPRS / EDGE network element.

[0029] ICCID (Integrate circuit card identity, integrated circuit card identity), it is a 20 digit special coding method, stored in the SIM card, also known as SIM card number. ICCID for IC card unique identification number, equivalent to the identity card of IC card.

[0030] GOIP device: a kind of virtual dialing device, which can convert traditional telephone signal into network signal. GOIP device can access GSM, CDMA, WCDMA and LTE frequency band mobile phone card through communication embedded software, support SIP protocol, and can be connected to AI robot interaction system. GOIP device has virtual dialing function, can switch mobile phone number to call anyone, and is difficult to intercept and trace the signal, so it is often used by fraudsters to commit fraud.

[0031] In the related art, the communication device anti-fraud technology is mainly divided into the following two types: 1. Static device fingerprint technology: relying on the hardware identifier (such as IMEI, MAC address) of the device to build a unique fingerprint, but it is easy to be tampered or forged (such as resetting IMEI through flashing), to evade detection.

[0032] 2. Behavior analysis technology: risk identification is performed through device network behavior (such as IP address, call frequency), but there is also the problem of historical data interference: the timeliness of IP address is not considered, and the long-term unused IP is still counted in the risk statistics, leading to false positives.

[0033] Therefore, the embodiments of the present application provide a device risk identification method, system, device, medium and product, which first acquires an IP address sequence used by a to-be-identified device and a SIM card replacement record, then calculates a current weight of the IP address sequence in a time sequence decay manner, calculates an inhibition weight of a SIM card replacement behavior using a double-factor inhibition function according to the SIM card replacement record; then performs weight fusion score calculation according to the current weight and the inhibition weight to obtain a risk score of the to-be-identified device; finally, risk device identification and disposal decision are performed according to the risk score. The current weight of the IP address sequence is calculated in a time sequence decay manner, the time sequence decay characteristic of the IP address is used to automatically decay the IP weight, the historical behavior after the device replaces the IP is quickly invalidated, the problem of historical data interference is solved, and the anti-interference ability is improved; the inhibition weight of the SIM card replacement behavior is calculated using a double-factor inhibition function, the double-factor inhibition function based on the number of card changes and the inhibition of the survival time of the SIM card is used to suppress the high-frequency abnormal SIM card replacement behavior, the frequent SIM card change behavior is quantified as a risk addition factor, and the identification sensitivity to malicious devices is significantly improved; the weight fusion score calculation is performed according to the current weight and the inhibition weight, the double-dimensional time sequence decay mechanism is formed through the synergistic superposition of "IP weight decay + SIM replacement inhibition", and a dynamic, tamper-resistant or anti-forgery device image is jointly constructed, and the tamper-resistant or anti-forgery ability and the anti-interference ability are effectively improved.

[0034] First, the system architecture used in the device risk identification method of the present application is introduced. Figure 1As shown, the system mainly includes three layers of data acquisition layer, model calculation layer and judgment decision layer.

[0035] The data acquisition layer is configured to collect IP sequences of to-be-identified devices and SIM card replacement records from operator base stations.

[0036] The model calculation layer is configured to calculate a current weight of an IP address sequence in a time sequence attenuation manner, calculate an inhibition weight of a SIM card replacement behavior by using a double-factor inhibition function according to the SIM card replacement records, and perform weight fusion score calculation according to the current weight and the inhibition weight to obtain a risk score of the to-be-identified device. In some embodiments, the model calculation layer can be further subdivided into an IP time sequence attenuation weight calculation module, a SIM replacement double-factor dynamic inhibition weight calculation module and a device risk score calculation module according to its functions.

[0037] The IP time sequence attenuation weight calculation module is configured to calculate a current weight of an IP address sequence in a time sequence attenuation manner.

[0038] The SIM replacement double-factor dynamic inhibition weight calculation module is configured to calculate an inhibition weight of a SIM card replacement behavior by using a double-factor inhibition function according to the SIM card replacement records.

[0039] The device risk score calculation module is configured to perform weight fusion score calculation according to the current weight and the inhibition weight to obtain a risk score of the to-be-identified device.

[0040] The judgment decision layer is configured to compare the risk score with a risk threshold, identify a risk device and perform corresponding decision processing. In some embodiments, the risk threshold is an adaptive threshold, which can be adjusted according to different time periods.

[0041] Based on the architecture of Figure 1 the embodiments of the present application propose a device risk identification method, as shown in Figure 2 the method includes the following steps S201-S205: S201, acquiring an IP address sequence used by a to-be-identified device and SIM card replacement records; S202, calculating a current weight of the IP address sequence in a time sequence attenuation manner; S203, calculating an inhibition weight of a SIM card replacement behavior by using a double-factor inhibition function according to the SIM card replacement records, the double-factor inhibition function including a first inhibition factor for controlling the number of card replacements and a second inhibition factor for controlling the survival time; S204, performing weight fusion score calculation according to the current weight and the inhibition weight to obtain a risk score of the to-be-identified device; S205, identifying a risk device and making a disposal decision according to the risk score.

[0042] In step S201, the device to be identified is a communication device for which fraud risk needs to be identified. This embodiment of the application does not impose specific limitations on the type of device to be identified, and it can be selected according to actual needs. For example, the device to be identified can be a communication device such as an operator base station, a server, or a mobile terminal.

[0043] The IP address sequence used by the device to be identified refers to the sequence formed by arranging the various IP addresses used by the device to be identified in chronological order. The SIM card replacement record reflects the SIM card replacement status of the device to be identified. It is understood that the SIM card replacement record includes, but is not limited to, the number of SIM card replacements within 30 days and the average lifespan of the SIM card. Optionally, in some embodiments, parameters such as the SIM card binding time and unbinding time can be obtained first, and then the SIM card replacement record can be obtained through data statistics and calculation.

[0044] In step S201, it can be done by Figure 1 The data acquisition layer is used to collect the IP address sequence and SIM card replacement records used by the device to be identified.

[0045] In step S202, it can be done by Figure 1 The IP time-series decay weight calculation module in the model calculation layer calculates the current weight of the IP address sequence. In some embodiments, considering that the active time of the IP addresses of fraudulent devices is not very long (generally 4-6 hours), this application adopts a method of IP weight decaying with time to quickly invalidate the historical behavior after the device changes its IP, solving the problem of historical data interference and improving anti-interference capability. Optionally, an exponential decay function can be used to calculate the real-time weight of each IP address in the IP address sequence, and then the current weight of the IP address sequence can be obtained by averaging or other methods.

[0046] In step S203, it can be done by Figure 1 The SIM card replacement two-factor dynamic suppression weight calculation module in the model calculation layer calculates the suppression weight of SIM card replacement behavior. In some embodiments, considering that SIM card replacement behavior of fraudulent devices occurs frequently, the SIM card replacement weight can be suppressed. To this end, this application designs a two-factor suppression function to calculate the suppression weight of SIM card replacement behavior, giving lower weights to devices that frequently replace SIM cards or have short SIM card lifespans. It can be understood that the two-factor suppression function includes a first suppression factor for controlling the number of card replacements and a second suppression factor for controlling the lifespan.

[0047] In step S204, it can be done by Figure 1The device risk score calculation module in the model calculation layer calculates the risk score of the device according to the current weight and the suppression weight, so as to construct the device risk score through the dual-weight fusion of "IP weight attenuation + SIM replacement suppression", and to jointly construct the dynamic, tamper-resistant or anti-forgery device portrait, thereby effectively improving the tamper-resistant or anti-forgery capability and the anti-interference capability.

[0048] In step S205, the risk score can be compared with the risk threshold by the judgment and decision layer to identify the risk device and perform corresponding decision processing. In some embodiments, the risk threshold can be a dynamic threshold adjusted according to different time periods, so as to adapt to the characteristics that the occurrence probability of fraud behavior is different at different time periods of a day. It can be understood that if the risk score of the device to be identified in the current period is higher than the risk threshold, a high-risk decision is triggered, the device to be identified is marked as a high-risk device (such as a fraud device), and the device is disabled or intercepted; if the risk score of the device to be identified in the current period is lower than the risk threshold, the device to be identified is determined to be a normal device, and the device is released and the corresponding behavior database is updated. Figure 1

[0049] In summary, the embodiments shown in steps S201 to S205 have at least the following technical effects: the current weight of the IP address sequence is calculated in a time sequence attenuation manner, the IP weight is automatically attenuated by using the time sequence attenuation characteristics of the IP address, the historical behavior of the device after changing the IP is quickly invalidated, the problem of historical data interference is solved, and the anti-interference capability is improved; the suppression weight of the SIM card replacement behavior is calculated by using a double-factor suppression function, the high-frequency abnormal SIM card replacement behavior is suppressed by the double-factor suppression function based on the number of card changes and the survival time of the SIM card, the frequent SIM card change behavior is quantified as a risk additive factor, and the identification sensitivity to malicious devices is significantly improved; the risk score of the device is calculated according to the current weight and the suppression weight, the dual-dimensional time sequence attenuation mechanism is formed through the synergistic superposition of "IP weight attenuation + SIM replacement suppression", and the dynamic, tamper-resistant or anti-forgery device portrait is jointly constructed, thereby effectively improving the tamper-resistant or anti-forgery capability and the anti-interference capability.

[0050] In some embodiments, the step S205 of identifying the risk device and making the disposal decision according to the risk score can further include the following steps S2051 and S2052: ​S2051, acquire a risk threshold corresponding to a current period, wherein the risk threshold is dynamically set by a five-period adaptive threshold strategy, and the five-period adaptive threshold strategy specifically includes: a risk threshold 0.30 corresponding to a deep sleep period of 01:00-05:00; a risk threshold 0.35 corresponding to a morning overdrive period of 05:00-08:00; a risk threshold 0.60 corresponding to a morning active period of 08:00-14:00; a risk threshold 0.55 corresponding to an afternoon high-risk period of 14:00-20:00; and a risk threshold 0.40 corresponding to a night back-off period of 20:00-01:00; S2052, compare the risk score with the risk threshold corresponding to the current period, and if the risk score exceeds the risk threshold, determine the to-be-identified device as a high-risk device and perform a corresponding high-risk disposal operation.

[0051] In step S2051, a unified risk threshold is used for the related art all day, which cannot adapt to the problem that fraud behavior is high in the daytime and relatively low in the early morning but has a high success rate (i.e., the threshold is rigid). The five-period adaptive threshold strategy is used to dynamically set the risk threshold, and a five-period adaptive threshold table (0.30 / 0.35 / 0.60 / 0.55 / 0.40) is designed to match the time regularity of fraud behavior and solve the problem of insufficient period coverage of the related art. For example, if the current time is 05:00, the corresponding risk threshold is 0.35.

[0052] In step S2052, if the risk score exceeds the corresponding risk threshold, the to-be-identified device is determined as a high-risk device (such as a fraud device) and a corresponding device disabling or interception high-risk disposal operation is performed. It can be understood that if the risk score does not exceed the corresponding risk threshold, the to-be-identified device is determined as a normal device, the device is released, and the corresponding behavior database is updated.

[0053] In some embodiments, the step S202 of calculating the current weight of the IP address sequence in a time sequence decay manner includes the following steps S2021 and S2022: S2021, calculating the real-time weight of each IP address in the IP address sequence by an exponential decay function; S2022, calculating the current weight of the IP address sequence according to the real-time weight of each IP address.

[0054] In some embodiments, the expression of the exponential decay function in step S2021 is: , wherein, is the real-time weight of the IP address, e is the base of the natural logarithm function, and λ is the decay coefficient, , is the unused time interval of the IP address, is equal to the difference between the current time and the last use time of the IP address.

[0055] According to prior knowledge, the average survival time of IP addresses of fraudulent devices is 4-6 hours, and the decay coefficient λ can be reasonably set to 0.1 / hour in step S2021, so that the real-time weight of the IP address decays to 50% of the initial value after about 7 hours, and the real-time weight (i.e. importance) of the IP address decreases by 63% every 10 hours.

[0056] In some embodiments, the step S2022 of calculating the current weight of the IP address sequence according to the real-time weight of each IP address comprises: calculating the average value of the real-time weights of all IP addresses as the current weight of the IP address sequence.

[0057] In step S2022, the current weight of the IP address sequence can be quickly obtained by directly averaging, so as to prepare for the subsequent weight fusion to calculate the risk score.

[0058] In some embodiments, the SIM card replacement record includes the number of SIM card replacements within 30 days of the device to be identified and the average survival time of the SIM card; and the expression of the double-factor inhibition function in step S203 is: , wherein, is the inhibition weight of the SIM card replacement behavior, e is the base of the natural logarithm function, is the number of SIM card replacements within 30 days of the device to be identified; is the average survival time of the SIM card; (k1, c1) is the first inhibition factor, k1 is the slope control parameter of the first inhibition factor, and c1 is the inflection point control parameter of the first inhibition factor; (k2, c2) is the second inhibition factor, k2 is the slope control parameter of the second inhibition factor, and c2 is the inflection point control parameter of the second inhibition factor.

[0059] Optionally, when designing the first inhibition factor (k1, c1), considering normal card replacement of users, etc., k1 can be set to a normal range, i.e. the inflection point control parameter c1 is set to a normal user upper limit; and in order to balance sensitivity and stability, the slope control parameter k1 is set to 0.05, so that the weight is approximately 0.05 when the number of card replacements is 6.

[0060] ​​​Meanwhile, according to the average survival time of the fraud device SIM card <24 hours and the average survival time of the normal user >720 hours (30 days), a survival time factor (k2, c2) is designed to set the inflection point (lower than 3 days is considered abnormal); slope : Avoid numerical magnitude differences by weight adjustment.

[0061] In some embodiments, the step S204 performs weight fusion score calculation according to the current weight and the suppression weight to obtain a risk score of the device to be identified, and specifically includes the following steps: According to the current weight and the suppression weight, a risk score calculation formula is used to calculate the risk score of the device to be identified, and the risk score calculation formula is: , wherein, is the risk score of the device to be identified, is the total number of high-frequency IP addresses in 1 hour, the high-frequency IP address represents an IP address that is used more than or equal to 5 times in 1 hour, is the current weight of the IP address sequence, is the number of SIM card replacements of the device to be identified in 30 days, is the suppression weight of the SIM card replacement behavior, and are adjustment coefficients, , , .

[0062] Optionally, considering the balance of risk contribution, the IP feature has higher dominance, and by default, a=0.7 and b=0.3. In the risk score calculation formula, the parameters and are designed for user friendliness--even if a normal user replaces a card twice and uses two IP addresses, unless multiple IPs are used frequently, short IP switching will not cause false positives, and fraud devices such as GOIP devices can be accurately detected.

[0063] In some embodiments, the step S201 acquires an IP address sequence and a SIM card replacement record used by the device to be identified, and includes the following steps S2011 and S2012: S2011, acquires the IP address sequence of the public network of the device to be identified from the NAT gateway of the operator base station, wherein the IP acquisition field format used when acquiring is: <device identification IMEI, timestamp, base station ID, allocated IP, port usage, uplink and downlink traffic>; ​S2012. Collect the device-number binding record of the device to be identified from the HLR of the operator's base station, and then obtain the SIM card replacement record. The SIM collection field format used during collection is: <Device Identifier IMEI, SIM Card Identifier ICCID, Binding Time, Unbinding Time>.

[0064] In step S2011, the public IP address sequence of the device to be identified can be obtained through the IP logs in the operator's base station logs.

[0065] In step S2012, SIM card replacement records can be obtained through the SIM logs in the operator's base station logs.

[0066] Steps S2011 and S2012 prepare for the subsequent calculation of IP weights and SIM card replacement suppression weights.

[0067] The device risk identification method of this application will be described in detail below with reference to specific embodiments.

[0068] like Figure 3 As shown in the illustration, this specific embodiment provides a method for identifying equipment risks, which specifically includes the following process: (1) Data collection: through Figure 1 The data acquisition layer collects device IP sequences and SIM card replacement records from operator base stations.

[0069] The data acquisition process may further include the following processes: 1) IP Log Collection: Obtain the device's public IP sequence from the NAT gateway. Collect the following fields: <Device Identifier IMEI, Timestamp, Base Station ID, Assigned IP, Port Usage, Uplink and Downlink Traffic>. 2) SIM Log Collection: Obtain device-number binding records from HLR, collecting fields such as: <Device Identifier IMEI, SIM Card Identifier ICCID, Binding Time, Unbinding Time (recorded when changing cards)>; (2) Calculation of weights and risk scores: through Figure 1 The model calculation layer adopts a combination of IP timing decay calculation module and SIM replacement suppression calculation module, and uses dual weight fusion to build device risk score calculation engine, and then calculates the risk score of the device through device risk score calculation engine.

[0070] The model's computational layer, which performs weight and risk score calculations, mainly includes the following core modules: 1) IP Timing Decay Weight Calculation Module Record the IP address sequence used by the device and calculate the real-time weight based on time decay:

[0071] wherein, is the decay coefficient, according to the average survival time of 4-6 hours of fraud device IP, we set the decay coefficient to 0.1 / hour, so that the IP weight decays to 50% of the initial value after about 7 hours, and the importance of IP decreases by 63% every 10 hours; is the IP unused time interval, i.e. .

[0072] After calculating the real-time weight of each IP address used by the device, the current weight of the IP address sequence can be obtained by averaging .

[0073] 2) SIM replacement double-factor dynamic inhibition weight calculation module:

[0074] wherein, is the number of SIM replacements within 30 days of the device; is the average survival time of the SIM card (hours); k1, c1 are the inhibition parameters for controlling the number of card replacements; k2, c2 are the inhibition parameters for controlling the survival time.

[0075] In order to construct a reasonable type inhibition function, when designing the card replacement frequency factor (k1, c1), considering the normal card replacement and other situations of users, we set to the normal range, i.e. the inflection point control (the upper limit of normal users); in order to balance the sensitivity and stability, the slope control is set to ensure that the weight ≈0.05 when the card is replaced 6 times.

[0076] At the same time, we design the survival time factor (k2, c2) according to the average survival time of the SIM card of the fraud device <24 hours, and the normal user >720 hours (30 days), set the inflection point (lower than 3 days is considered abnormal); the slope : avoid numerical magnitude difference through weight adjustment.

[0077] 3) Device risk score calculation module:

[0078] wherein the adjustment coefficient , , , considering the balance of risk contribution, the IP feature is more dominant, and by default , ; the number of high-frequency IP Definition: the number of different IP addresses used within 1 hour (the number of times each IP address is used ≥ 5 times).

[0079] (3) The judgment and decision layer judges the device risk according to the five-period adaptive threshold value, and corresponds to the high-risk processing or release. Figure 1

[0080] After the judgment and decision layer calculates the above risk score, the risk score is compared with the threshold value, the risk device is identified, and the corresponding decision processing is performed.

[0081] The threshold value in the embodiment of the application is an adaptive threshold value, which is adjusted according to different time periods. Specifically, according to the time distribution law of historical fraud behaviors, a five-period adaptive threshold value strategy is set: deep sleep period (01:00-05:00), threshold value 0.30; morning excessive period (05:00-08:00), threshold value 0.35, morning active period (08:00-14:00), threshold value 0.60; afternoon high incidence period (14:00-20:00), threshold value 0.55; night back period (20:00-01:00), threshold value 0.40.

[0082] The judgment and decision layer selects the corresponding threshold value according to the current period, and compares it with the device risk score obtained by the model calculation layer to trigger the decision: 1) if the current period device risk score is higher than the threshold value, trigger the high-risk decision and execute the disposal; 2) if the current period device risk score is lower than the threshold value, we consider that the device is a normal device, and the device is released, and the corresponding behavior database is updated.

[0083] In order to better illustrate the actual application effect of the method of the application, the following takes a suspected fraud device and a normal device as an example to illustrate in detail how to apply the method of the application to risk judgment.

[0084] Embodiment 1: suspected fraud device (IMEI: , representing 1 actual Arabic numeral), the current detection time point is 14:30, Its card replacement behavior within one month is shown in Table 1 as follows: Table 1

[0085] Its IP usage behavior (24 hours) is shown in Table 2 as follows (representing 1 actual Arabic numeral): Table 2

[0086] Then, the implementation process of embodiment 1 is as follows: ​​Step one: Calculate the real-time weight of each IP address by IP timing decay weight calculation module according to the following public formula:

[0087] Calculate the weight of each historical use IP within 24 hours, , , , , , Get the current weight of IP address sequence . Among them, the high-frequency IP within one hour is 2, which is , .

[0088] Step two: Calculate the SIM card suppression weight by SIM replacement suppression weight calculation module according to the following formula:

[0089] Calculate the SIM card suppression weight

[0090] Step three: Calculate the device risk score by device risk score calculation module according to the following formula:

[0091] Calculate the device risk score

[0092] Step four: Determine the risk according to the time period threshold value, the current time period is 14:30, and the risk threshold value corresponding to the time period is 0.55, , confirm that the device is a high-risk device and is included in continuous monitoring.

[0093] Embodiment 2: Normal user (IMEI: , representing 1 actual Arabic numeral), the current detection time point is 14:30.

[0094] The card replacement behavior within one month is shown in Table 3 as follows: Table 3

[0095] The IP use behavior (24 hours) is shown in Table 4 as follows (representing 1 actual Arabic numeral): Table 4

[0096] So the implementation process of this embodiment 2 is: ​Step one: Calculate the real-time weight of each IP address by IP timing attenuation weight calculation module according to the following public formula:

[0097] Calculate the weight of each historical use IP within 24 hours, , , , Get the current weight of the IP address sequence . Among them, the high-frequency IP within one hour is 0.

[0098] Step two: Calculate the SIM replacement suppression weight by the SIM replacement suppression weight calculation module according to the following formula:

[0099] Calculate the SIM card suppression weight

[0100] Step three: Calculate the device risk score by the device risk score calculation module according to the following formula:

[0101] Calculate the device risk score

[0102] Step four: Determine the risk according to the time period threshold, the current time period is 14:30, and the time period threshold is 0.55, Confirm that the device is a normal device and release it.

[0103] Special note: The number of high-frequency IPs of ordinary user mobile phones is usually 0 (single IP low-frequency use), the SIM replacement is 0 (no card replacement within 30 days), and the score is 0.

[0104] As shown in Figure 4 , the embodiment of the application further provides a device risk identification system, which comprises: A data acquisition module 401 is configured to acquire an IP address sequence used by a to-be-identified device and a SIM card replacement record. An IP timing attenuation weight calculation module 402 is configured to calculate a current weight of the IP address sequence in a timing attenuation manner. A SIM replacement double-factor dynamic suppression weight calculation module 403 is configured to calculate a suppression weight of a SIM card replacement behavior according to the SIM card replacement record by using a double-factor suppression function, wherein the double-factor suppression function comprises a first suppression factor for controlling the number of card replacements and a second suppression factor for controlling survival time. The device risk score calculation module 404 is configured to perform weight fusion score calculation according to the current weight and the suppression weight, to obtain a risk score of the device to be identified. The risk identification and decision module 405 is configured to perform identification and disposal decision of the risk device according to the risk score.

[0105] It can be understood that the content in the above method embodiments is applicable to the system embodiments, the system embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0106] As shown in Figure 5 , the electronic device provided by the embodiment of the present application comprises: at least one processor 501; at least one memory 502 configured to store at least one program; When the at least one program is executed by the at least one processor 501, the at least one processor 501 implements the method described above.

[0107] Please refer to Figure 6 , Figure 6 the hardware structure of the electronic device of another embodiment is shown, and the electronic device comprises: The processor 601 can be implemented in the form of a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is configured to execute related programs to implement the technical solutions provided by the embodiments of the present application. The memory 602 can be implemented in the form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory). The memory 602 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 602 and are called and executed by the processor 601 to implement the method described above. The input / output interface 603 is configured to realize information input and output. The communication interface 604 is configured to realize the communication interaction between the device and other devices. The communication can be realized in a wired manner (for example, USB, network cable, etc.), or in a wireless manner (for example, mobile network, WIFI, Bluetooth, etc.). A bus 605 is used to transmit information between the various components (for example, the processor 601, the memory 602, the input / output interface 603, and the communication interface 604) of the device. The processor 601, the memory 602, the input / output interface 603, and the communication interface 604 are communicatively connected to each other within the device through the bus 605.

[0108] It can be understood that the contents in the above method embodiments are all applicable to the device embodiments, the device embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0109] The device embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0110] It can be understood that the contents in the above method embodiments are all applicable to the storage medium embodiments, the storage medium embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0111] The device embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0112] It can be understood that the contents in the above method embodiments are all applicable to the program product embodiments, the program product embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0113] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0114] The embodiments described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0115] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation to the embodiments of the present application, and can include more or fewer steps than the figures, or combine certain steps, or different steps.

[0116] The device embodiments described above are merely illustrative, and the units described as separate components can or can not be physically separated, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0117] Those skilled in the art can understand that all or some of the steps in the above disclosed method, the function modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0118] The terms "first", "second", "third", "fourth" and the like used in the description of the present application and the above-described figures, if any, are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0119] It should be understood that in the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the association between the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that there are three cases of only A, only B and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0120] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic. The division of the units is merely logical function division. There can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0121] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0122] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0123] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0124] In summary, the present application discloses a device risk identification method, system, device, medium and product to solve the problems of easy tampering of static fingerprints, historical data interference, threshold rigidity and high cost deployment in the prior art. The scheme has the following characteristics or advantages: (1) Adapt to the existing network of operators: can directly interface with CRM / signaling system, read IP session log and SIM card change signaling, without adding data collection points.

[0125] (2) Solve the problem of historical interference and dynamic confrontation by two-dimensional timing decay mechanism (IP weight decay + SIM replacement inhibition): dynamic decay makes the historical behavior invalid quickly after the device replaces IP or SIM card, IP weight automatically decays (24 hours of non-use weight≈0.08), but retains dynamic historical memory - high-risk IP residual weight continues to affect fraudulent devices, while excluding historical strong interference to ensure that only recent active IP affects decision-making; SIM replacement double-factor inhibition function (6 times of card replacement weight≈0.05) suppresses high-frequency abnormalities, and is user-friendly designed - normal users even replace the card twice, use two IPs, unless they use multiple IPs frequently, temporary IP switching will not lead to misjudgment, and can accurately detect GOIP devices and other fraudulent devices.

[0126] (3) Precise attack in time period: through five-time period dynamic threshold strategy, match the time law of fraudulent behavior, convert time factor into core detection dimension, crack the dynamic avoidance problem of fraudsters, and overcome the defect of insufficient period coverage of related technology.

[0127] (4) Lightweight system implementation: replace complex AI model with lightweight mathematical modeling, only need IP and SIM two types of basic data, and double decay mechanism only needs four arithmetic operations, deployment is more simple, can realize low-cost and rapid deployment of operators.

[0128] The preferred embodiments of the embodiments of the application are explained above with reference to the accompanying drawings, and are not limited to the scope of the embodiments of the application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the application shall be within the scope of the right of the embodiments of the application.

Claims

1. A method for identifying equipment risks, characterized in that, The method includes the following steps: Obtain the IP address sequence and SIM card replacement records used by the device to be identified; The current weight of the IP address sequence is calculated using a time-series decay method; Based on the SIM card replacement records, a two-factor inhibition function is used to calculate the inhibition weight of SIM card replacement behavior. The two-factor inhibition function includes a first inhibition factor for controlling the number of card replacements and a second inhibition factor for controlling the survival time. The risk score of the device to be identified is obtained by calculating a weight fusion score based on the current weight and the suppression weight. Based on the risk score, risk equipment is identified and disposal decisions are made.

2. The method according to claim 1, characterized in that, The process of identifying and handling risky equipment based on the risk score includes: Obtain the risk threshold corresponding to the current time period. The risk threshold is dynamically set using a five-time period adaptive threshold strategy. Specifically, the five-time period adaptive threshold strategy includes: a risk threshold of 0.30 for the deep sleep period (01:00-05:00); a risk threshold of 0.35 for the morning transition period (05:00-08:00); a risk threshold of 0.60 for the morning active period (08:00-14:00); a risk threshold of 0.55 for the afternoon high-incidence period (14:00-20:00); and a risk threshold of 0.40 for the nighttime decline period (20:00-01:00). The risk score is compared with the risk threshold corresponding to the current time period. If the risk score exceeds the risk threshold, the device to be identified is determined to be a high-risk device and the corresponding high-risk handling operation is performed.

3. The method according to claim 1, characterized in that, The calculation of the current weight of the IP address sequence using a time-series decay method includes: The real-time weight of each IP address in the IP address sequence is calculated using an exponential decay function; The current weight of the IP address sequence is calculated based on the real-time weight of each IP address.

4. The method according to claim 1, characterized in that, The SIM card replacement record includes the number of SIM card replacements and the average SIM card lifespan within 30 days for the device to be identified; the expression for the two-factor suppression function is: ， in, The suppression weight for SIM card replacement behavior, where e is the base of the natural logarithm function. The number of times the SIM card of the device to be identified has been changed within 30 days; denoted as SIM card average survival time; (k1, c1) is the first inhibition factor, where k1 is the slope control parameter of the first inhibition factor and c1 is the inflection point control parameter of the first inhibition factor; (k2, c2) is the second inhibition factor, where k2 is the slope control parameter of the second inhibition factor and c2 is the inflection point control parameter of the second inhibition factor.

5. The method according to claim 3, characterized in that, The expression for the exponential decay function is: ， in, Here, represents the real-time weight of the IP address, e is the base of the natural logarithm function, and λ is the decay coefficient. , This represents the time interval during which an IP address has not been used. It equals the difference between the current time and the last time the IP address was used; The step of calculating the current weight of the IP address sequence based on the real-time weight of each IP address includes: The average of the real-time weights of all the IP addresses is calculated as the current weight of the IP address sequence.

6. The method according to any one of claims 1-5, characterized in that, The step of calculating the risk score of the device to be identified by performing weight fusion score based on the current weight and the suppression weight includes: Based on the current weight and the suppression weight, the risk score of the device to be identified is calculated using the risk score calculation formula, which is: ， in, The risk score of the device to be identified. This represents the total number of high-frequency IP addresses within one hour. High-frequency IP addresses are those that have been used five or more times within one hour. The current weight of the IP address sequence. This represents the number of times the SIM card for the device to be identified has been changed within 30 days. Suppression weights for SIM card replacement behavior, and All are adjustment coefficients. , , .

7. The method according to any one of claims 1-5, characterized in that, The acquisition of the IP address sequence and SIM card replacement record used by the device to be identified includes: The IP address sequence of the device to be identified is collected from the NAT gateway of the operator's base station. The IP collection field format used during collection is: <Device Identifier IMEI, Timestamp, Base Station ID, Allocated IP, Port Usage, Uplink and Downlink Traffic>. The device-number binding records of the device to be identified are collected from the HLR of the operator's base station, and then the SIM card replacement records are obtained. The SIM collection field format used during collection is: <Device Identifier IMEI, SIM Card Identifier ICCID, Binding Time, Unbinding Time>.

8. A device risk identification system, characterized in that, The system includes: The data acquisition module is used to acquire the IP address sequence and SIM card replacement records used by the device to be identified; The IP time-series decay weight calculation module is used to calculate the current weight of the IP address sequence in a time-series decay manner; The SIM card replacement dual-factor dynamic inhibition weight calculation module is used to calculate the inhibition weight of SIM card replacement behavior based on the SIM card replacement record using a dual-factor inhibition function. The dual-factor inhibition function includes a first inhibition factor for controlling the number of card replacements and a second inhibition factor for controlling the survival time. The device risk score calculation module is used to calculate the risk score of the device to be identified by performing a weight fusion score based on the current weight and the suppression weight. The risk identification and decision-making module is used to identify and make decisions on the handling of risky equipment based on the risk score.

9. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images