Target communication equipment identification method and device and electronic equipment

Abstract

The invention provides an identification method and device of target communication equipment, electronic equipment and a computer program product, belongs to the technical field of communication, and aims to solve the problem that the existing identification method cannot timely and accurately identify the target communication equipment. The method comprises the following steps: acquiring signaling data in a communication network, and processing the signaling data; performing micro-batch division on the processed data based on a sliding window strategy, and obtaining a multi-dimensional feature vector containing a spatial distribution feature and a communication behavior feature according to the data of each micro-batch; performing clustering identification on the multi-dimensional feature vector of each micro-batch based on the spatial distribution feature and the communication behavior feature to obtain a candidate communication card cluster of the current micro-batch; and generating a time sequence feature sequence according to a plurality of continuous micro-batches of candidate communication card clusters, and inputting the time sequence feature sequence into a time sequence identification model to obtain an identification result of the target communication equipment.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, electronic device, and computer program product for identifying a target communication device. Background Technology

[0002] In communication networks, there exists hardware known as "modem pools" or bulk communication devices. These devices can simultaneously integrate and manage a large number of communication cards, enabling automated and large-scale communication activities. In recent years, such devices and related communication cards have been widely used in telecommunications network fraud, posing a substantial threat to public property security and also bringing challenges to the security management of communication networks. Currently, the identification methods for such bulk communication cards mainly include: tracing the source by analyzing relay server information in call records, extracting network behavior characteristics of known specific virtual dialing devices, or comparing and identifying them based on a pre-set device fingerprint database. However, these methods have certain limitations. For example, they heavily rely on data from specific hardware devices or servers, and the acquisition of this data is time-consuming, difficult, and involves uncontrollable data variables. In addition, some methods mainly focus on single-dimensional feature analysis, such as call behavior alone. This lacks accuracy and robustness when facing constantly evolving adversarial strategies and normal services with similar communication patterns. Summary of the Invention

[0003] This application provides a method, apparatus, electronic device, and computer program product for identifying target communication devices, which can solve the problem that existing methods cannot identify target communication devices in a timely and accurate manner.

[0004] In a first aspect, embodiments of this application provide a method for identifying a target communication device, the method comprising the following steps: Acquire signaling data from the communication network and process the signaling data; The processed data is divided into micro-batches based on a sliding window strategy, and a multi-dimensional feature vector containing spatial distribution characteristics and communication behavior characteristics is obtained based on the data in each micro-batch. For each micro-batch, clustering identification is performed on the multi-dimensional feature vector based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters for the current micro-batch; A time-series feature sequence is generated based on multiple consecutive micro-batch candidate communication card clusters. The time-series feature sequence is then input into a time-series recognition model to obtain the recognition result of the target communication device.

[0005] Secondly, embodiments of this application provide a target communication device identification apparatus, which includes the following: The data processing module is used to acquire signaling data from the communication network and process the signaling data; The feature extraction module is used to divide the processed data into micro-batches based on a sliding window strategy, and to obtain a multi-dimensional feature vector containing spatial distribution features and communication behavior features based on the data in each micro-batch. The first identification module is used to perform clustering identification on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters for the current micro-batch; and, The second identification module is used to generate a time-series feature sequence based on multiple consecutive micro-batch candidate communication card clusters, input the time-series feature sequence into the time-series identification model, and obtain the identification result of the target communication device.

[0006] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the target communication device identification method as described in the first aspect.

[0007] Fourthly, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the steps of the target communication device identification method as described in the first aspect.

[0008] This application embodiment, through multi-dimensional analysis combining spatial distribution characteristics and communication behavior characteristics of processed signaling data, can construct a more comprehensive device behavior profile for communication cards. This effectively overcomes the shortcomings of single-feature dimensions being easily imitated and interfered with, significantly reducing the false positive rate and thus improving the accuracy of target communication device identification in complex and ever-changing real-world communication network environments. Unsupervised clustering identification based on general behavioral patterns, through a behavior-driven identification mechanism, can effectively discover target communication devices that do not possess known malicious labels or conceal hardware characteristics through technical means. This reduces reliance on prior knowledge and enhances the proactive detection capability against new and variant threats. Through a sliding window strategy and micro-batch processing, incremental, near-real-time analysis of continuous data streams can be achieved without waiting for the entire day's data aggregation, facilitating timely identification of abnormal communication patterns, shortening the detection response cycle, and meeting business timeliness requirements. By further constructing the identification results of individual micro-batches into a time-series feature sequence and performing comprehensive evaluation, fluctuations in single-point detection can be smoothed, improving the reliability and credibility of the identification results. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a flowchart illustrating a method for identifying a target communication device provided in an embodiment of this application; Figure 2 This is a flowchart illustrating another method for identifying a target communication device provided in an embodiment of this application; Figure 3 This is a flowchart illustrating another method for identifying a target communication device provided in an embodiment of this application; Figure 4 This is a schematic diagram of a data flow based on a sliding window provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a target communication device identification device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0011] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0012] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0013] In recent years, "modem pools" have been increasingly exploited by overseas telecommunications fraud gangs. These gangs rent equipment ports from modem pool holders, who then use these devices to make numerous fraudulent calls and send fraudulent text messages to people in China. Individuals who possess modem pool equipment and rent it to these gangs are guilty of aiding and abetting cybercrime. This situation poses a significant threat to public property security and also severely hinders the secure development of SIM cards and IoT cards.

[0014] To address the above situation, some existing methods include utilizing all relay devices associated with the SIM card during a call, such as the SIM card server, communication card (or SIM card) server, and relay server, to identify fraudulent calls. However, this approach requires obtaining necessary data from the SIM server, management server, and relay server associated with the SIM card, which is time-consuming, difficult, and involves uncontrollable data variables. Other methods involve identifying the target virtual dialing device (e.g., GOIP device) and then extracting its network behavior characteristics and suspicious terminals with International Mobile Equipment Identity (IMEI) to determine suspicious communication numbers on the target GOIP device. However, this approach requires identifying the target GOIP device, which is challenging. Still other methods involve multi-angle identification of SIM cards and fraud warning data, primarily through embedded data or constructing a known sample space, then comparing and identifying the device using features such as the IMEI. However, this approach requires updating the mobile terminal database and collecting SIM card samples, which is also challenging.

[0015] Therefore, there is an urgent need for a method and apparatus that can accurately identify batch communication devices hidden in normal communication traffic from multi-dimensional behavioral characteristics without relying on specific hardware.

[0016] To address the aforementioned issues, this application proposes a method and apparatus for identifying target communication devices. Based on the usage characteristics of communication cards (including IoT cards, SIM cards, etc.), and utilizing artificial intelligence models, it mines potential features to effectively identify target communication devices (e.g., SIM card pooling). This can provide clues for operators, public security agencies, and other relevant entities, safeguarding public property security. Based on features such as voice, SMS, and internet browsing behavior, as well as location information, this application employs micro-batch observation and feature clustering, along with short-time series comprehensive evaluation to determine whether a communication card exhibits suspected SIM card pooling behavior. Subsequently, it analyzes the involved SIM card pooling devices, effectively identifying multi-card group control and multi-device multi-account group control strategies.

[0017] The following is in conjunction with the appendix Figures 1 to 6This application provides a detailed description of a target communication device identification method, apparatus, electronic device, and computer program product through specific embodiments and application scenarios.

[0018] Figure 1 This application illustrates an embodiment of a method for identifying a target communication device. This method can be executed by an electronic device, which may include a server and / or a terminal device. In other words, the method can be executed by software or hardware installed on the server and / or terminal device, and includes the following steps: Step 110: Obtain signaling data from the communication network and process the signaling data.

[0019] The signaling data is likely collected from network nodes in the communication network and converted into structured data with a unified specification that can be used for feature extraction. These network nodes include, but are not limited to, Session Management Functions (SMFs), Packet Data Network Gateways (PGWs), Gateway GPRS Support Nodes (GGSNs), SMS gateways, voice gateways, or IP Multimedia Subsystems. The signaling data is encapsulated in different communication protocols, mainly including the Radius protocol, Session Initiation Protocol (SIP), Hypertext Transfer Protocol (HTTP), and 3GPP standard protocols.

[0020] The processing of signaling data can include protocol parsing, data preprocessing, and standardization. Protocol parsing involves analyzing the raw protocol data packets of the acquired signaling data. Data preprocessing and standardization involve cleaning and standardizing the parsed signaling data to create a structured record of communication behavior.

[0021] Step 120: The processed data is divided into micro-batches based on the sliding window strategy, and a multi-dimensional feature vector containing spatial distribution features and communication behavior features is obtained based on the data of each micro-batch.

[0022] The sliding window strategy divides a continuous stream of communication activity records into micro-batches, typically requiring pre-setting two parameters: window size and sliding step. The window size defines the time span covered by each batch, limiting the temporal granularity of observing communication activity. The sliding step defines the time interval between each forward slide of the window, limiting the frequency and latency of output recognition results. Using a sliding window, the original data stream can be dynamically divided into a series of continuous, potentially overlapping, micro-batch data blocks.

[0023] Within each micro-batch window, for each communication card, a multi-dimensional feature vector containing spatial distribution characteristics and communication behavior characteristics is extracted and calculated. Spatial distribution characteristics include, but are not limited to, location information, generally the location area code and cell code of the base station most frequently connected to by the communication card during the window period. Communication behavior characteristics include, but are not limited to, call-related features, SMS-related features, and internet access-related features.

[0024] Finally, the above features are aggregated for each communication card within each micro-batch window to form a unified, quantitative, multi-dimensional feature vector. This feature vector can comprehensively characterize the spatial location stability and communication behavior pattern of the communication card within a specific time period, providing a data foundation for subsequent cluster analysis.

[0025] Step 130: Perform clustering recognition on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters of the current micro-batch.

[0026] The clustering identification process sequentially filters out subsequent communication card clusters that are spatially clustered and exhibit similar behavioral patterns from a massive number of communication cards within each micro-batch, based on spatial distribution characteristics and communication behavior characteristics. By employing two-level density clustering, based sequentially on spatial and behavioral characteristics, the accuracy of identification can be effectively improved.

[0027] Step 140: Generate a time-series feature sequence based on multiple consecutive micro-batch candidate communication card clusters, input the time-series feature sequence into the time-series recognition model, and obtain the recognition result of the target communication device.

[0028] The temporal feature sequence is used to address the potential misjudgment problem arising from a single micro-batch identification result, and can derive more stable and reliable judgment results based on the continuous behavior patterns of the communication card. By integrating the identification results of multiple consecutive micro-batches, for each candidate communication card cluster that appears repeatedly in multiple micro-batches, its state in each micro-batch is represented as a temporal data point.

[0029] Specifically, the aggregated feature representation of the cluster in each micro-batch (e.g., the average or normalized value of all communication card feature vectors within the cluster) is extracted, and these aggregated feature representations arranged in chronological order are combined into a temporal feature sequence. This temporal feature sequence is input into a pre-trained temporal recognition model. First, each data point in the temporal sequence is mapped to a query, key, and value vector through a linear transformation. A sparse attention mechanism can then be employed, focusing only on historical moments within a fixed adjacent window when calculating the attention for the current moment, rather than the entire historical sequence. This effectively reduces computational complexity and emphasizes recent, most relevant behavioral patterns. Through the attention mechanism, different weights are assigned to the states at different time points in the sequence (e.g., recently stable and anomalous behaviors may receive higher weights), and a weighted comprehensive output is calculated. The temporal recognition model outputs a quantified temporal feature score for each tracked communication card or communication card cluster. This score comprehensively reflects the overall degree of behavioral anomalousness over a past period. The obtained temporal feature score is compared with a judgment threshold determined through historical data validation. When the time sequence feature score is higher than or equal to the threshold, the corresponding communication card is determined to be the target communication device (i.e., the SIM card pool card); otherwise, it is determined to be a normal communication card.

[0030] This embodiment utilizes a multi-dimensional analysis combining "spatial distribution characteristics" and "communication behavior characteristics" to construct a more comprehensive device behavior profile. This effectively overcomes the shortcomings of single-feature dimensions (e.g., call behavior alone) which are easily imitated and interfered with, significantly reducing misjudgments caused by normal marketing activities. Consequently, it achieves higher identification accuracy in complex and ever-changing real-world network environments. Instead of relying on specific hardware fingerprints (e.g., fixed device identifiers) or predefined fraud samples, it uses unsupervised clustering based on general behavioral patterns. This helps identify batches of communication devices that lack known malicious labels or have concealed their hardware characteristics through technical means, reducing reliance on prior knowledge and enhancing the proactive detection capability of new and variant threats. Employing a "sliding window" and "micro-batch" processing strategy, it enables incremental, near real-time analysis of continuous data streams. Without waiting for a full day's data aggregation, it can promptly identify abnormal batch communication behaviors, significantly shortening the detection response cycle and facilitating timely early warning and intervention, meeting business timeliness requirements. Furthermore, by constructing the identification results of a single micro-batch into a temporal feature sequence and conducting a comprehensive evaluation, the fluctuations of single-point detection can be effectively smoothed out. The final judgment can be made from the perspective of continuously exhibiting malicious behavior patterns, which can further improve the reliability and credibility of the identification results.

[0031] Figure 2This illustration shows a flowchart of another method for identifying a target communication device according to an embodiment of this application. This method can be executed by an electronic device, which may include a server and / or a terminal device, etc. In other words, the method can be executed by software or hardware installed on the server and / or the terminal device, and the method includes the following steps: Step 210: Based on step 110 of the above embodiment, acquire signaling data in the communication network and process the signaling data. The method of this embodiment may further include the following specific steps: Signaling data is obtained from multiple network nodes in the communication network, including at least two of voice communication signaling, SMS communication signaling, and Internet access log signaling; the signaling data is parsed based on a set communication protocol; multiple set field information is extracted from the parsed data, including user identification information, location area information, timestamp information, and service type information.

[0032] The signaling data can be obtained by receiving signaling data (including voice, SMS, and internet access logs) sent by core network equipment and parsing the signaling data. Core network equipment can include SMF, PGW, GGSN, SMS gateway, internet access log gateway, etc. Specifically, the signaling data can be RADIUS signaling, SIP protocol data, HTTP protocol data, and 3GPP protocol data. For example, based on the RADIUS protocol, the IoT card number (MSISDN), base station location area code (LAC), base station cell number (CI), radio network type (RatType), message timestamp (Time), message type (PacketType), user service type (ServiceType), and RADIUS device IP address (NAS-IP-Address) can be parsed from RADIUS signaling data. Based on SIP, the calling number, called number, call duration, and call setup time can be parsed from SIP protocol data. Based on HTTP, the accessed URL, user agent, and data traffic volume can be parsed from HTTP protocol data. Based on the 3GPP standard protocol, the International Mobile Equipment Identity (IMEI) and International Mobile Subscriber Identity (IMSI) of the terminal can be parsed from 3GPP protocol data. After parsing, the parsed data is output for subsequent data preprocessing.

[0033] Step 220: The processed data is divided into micro-batches based on the sliding window strategy, and a multi-dimensional feature vector containing spatial distribution features and communication behavior features is obtained based on the data of each micro-batch. Step 230: Perform clustering recognition on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters of the current micro-batch.

[0034] Step 240: Generate a time-series feature sequence based on multiple consecutive micro-batch candidate communication card clusters, input the time-series feature sequence into the time-series recognition model, and obtain the recognition result of the target communication device.

[0035] Steps 220-240 can be found above. Figure 1 The specific descriptions of steps 120-140 in the illustrated embodiment are provided, and the same technical effects can be achieved. To avoid repetition, they will not be repeated here.

[0036] In this embodiment, data is collected from multiple core network nodes such as SMF, PGW, GGSN, SMS gateway, and Internet access log gateway. Multiple protocols, including Radius, SIP, HTTP, and 3GPP, are parsed to integrate signaling information from multiple dimensions, including voice, SMS, and data traffic. This overcomes the limitations of a single data source perspective and provides a comprehensive, three-dimensional data foundation covering the entire communication behavior for subsequent analysis, improving the comprehensiveness and accuracy of identifying target communication devices. Key fields, including user identifiers (MSISDN, IMEI), location information (LAC, CI), timestamps (Time), and user service type (ServiceType), are extracted from the complex raw protocols. This transforms the unstructured raw data stream into unified, standardized structured data, providing reliable input for obtaining spatial distribution and communication behavior characteristics in subsequent steps. It also makes micro-batch feature calculation based on sliding windows possible.

[0037] In yet another exemplary embodiment, based on step 210 of the above embodiment, the method of acquiring signaling data in the communication network and processing the signaling data may further include the following specific steps: The defined field information is validated and cleaned, and then converted into a predefined vector data format based on the defined communication protocol.

[0038] The validity checks include verifying the completeness and format of data records, and filtering out invalid data with missing or incorrectly formatted required fields. The data cleaning includes handling outliers (e.g., call durations exceeding reasonable limits), filling in missing values ​​for specific scenarios, and logically correcting inconsistent data (e.g., contradictory states of the same session in different signaling systems).

[0039] After validity checks and data cleaning, data from different protocols and formats are mapped and integrated according to predefined fields and formats, and the output is a structured data record for subsequent feature extraction.

[0040] In this embodiment, by performing validity checks and data cleaning on the fields, invalid and dirty data can be effectively removed, improving the accuracy and consistency of the data and avoiding feature extraction bias and model misjudgment caused by data quality issues. Processing outliers and missing values ​​smooths out data fluctuations, enabling subsequent feature extraction to work stably under non-ideal data conditions, thus improving the adaptability and robustness of the recognition method in complex real-world environments. Data from different protocols and formats are uniformly mapped according to predefined fields and formats to generate unified structured data records for subsequent unified feature vectors, providing a foundation for multi-dimensional feature fusion analysis.

[0041] Figure 3 This application illustrates another method for identifying a target communication device according to an embodiment of the present application. This method can be executed by an electronic device, which may include a server and / or a terminal device, etc. In other words, the method can be executed by software or hardware installed on the server and / or the terminal device, and the method includes the following steps: Step 310: Obtain signaling data from the communication network and process the signaling data.

[0042] Step 310 can be found above. Figure 1 The specific description of step 110 in the illustrated embodiment can achieve the same technical effect, and will not be repeated here to avoid repetition.

[0043] Step 320, based on step 120 of the above embodiment, the processed data is divided into micro-batches based on the sliding window strategy, and a multi-dimensional feature vector containing spatial distribution characteristics and communication behavior characteristics is obtained based on the data of each micro-batch. The method of this embodiment may also include the following specific steps: The processed data is divided into micro-batches based on a preset window size and sliding step size; spatial distribution features and communication behavior features are extracted from each micro-batch of data. The spatial distribution features include base station location area codes and / or base station cell codes, and the communication behavior features include call dimension features, SMS dimension features, and / or Internet access dimension features.

[0044] The call dimension features can include total number of calls, number of calls made by the caller, average call duration, and caller ID dispersion. SMS dimension features can include total number of SMS messages sent, SMS content similarity (obtained by calculating text similarity within a window), and the frequency of sensitive word occurrences (which can be counted based on an existing corpus). Internet access dimension features can include a list of IP addresses used and their switching frequency, total uplink and downlink data traffic, and the main URLs accessed and their access frequency.

[0045] When analyzing the characteristics of terminal devices, data from a single moment cannot represent the current status of the device. It is necessary to observe continuously over a period of time and use the information over this period to characterize the usage of the terminal. Therefore, a micro-batch method is adopted to evaluate the current terminal information using interaction information over a period of time, forming multi-dimensional feature vector data X, including time, call dimensions, SMS dimensions, internet access dimensions, and location information. The specific data format is shown below: {Time, Number, Location, Call Duration, Number of Calls, List of Called Numbers, Number of Calls Made by the Caller, Message Content Similarity, Number of Sensitive Words, IMEI, List of IPs Used, Number of Switches, Uplink Traffic, Downlink Traffic, Number of Accesses to Main URL, Location Information, ...}

[0046] To ensure the continuity of the analyzed features, a sliding window strategy is used to extract relevant features. See [link / reference] Figure 4 The original data stream is the data processed in step 310. The sliding window data stream is the data extracted from the original data stream according to the set sliding step size and window size. When the sliding step size is set to 2 and the window size is 3, the sliding window data stream acquires the data from the original data stream time1 to time3 at time3, and acquires the data from the original data stream time3 to time5 at time5 and performs the corresponding feature calculations.

[0047] Call characteristics can be monitored using abnormal call patterns. For example, analyzing call records based on SIP signaling and 3GPP protocols can help identify situations where a large number of numbers make or receive calls within a short period with extremely short call durations. Normal communication behavior usually exhibits a certain distribution pattern in call duration, while modem pool devices may generate a large number of calls that connect and disconnect instantly. Pay attention to the source areas of numbers that frequently ring once and then disconnect. If a large number of numbers from a specific area exhibit this behavior, it may indicate that the modem pool device is making exploratory calls.

[0048] The table below shows an example of call-related data obtained through a sliding window.

[0049]

[0050] SMS dimensional features can be analyzed based on the SMPP (Short Message Peer to Peer) protocol, GSM 03.40 protocol, and 3GPP TS 23.040 protocol. Sensitive word detection (using existing corpora) can be performed on SMS content at the SMS service gateway to analyze and detect large numbers of SMS messages with identical content. SIM card pool devices often send batches of SMS messages with the same or similar content, such as fraudulent messages and advertisements. By analyzing the similarity of SMS content, possible signs of SIM card pool device usage can be detected. Observe the timing patterns of SMS sending. If a large number of SMS messages are sent in a short period of time with very regular intervals, it may indicate the operation of a SIM card pool device.

[0051] The table below shows an example of SMS data obtained through a sliding window.

[0052]

[0053] Internet connectivity characteristics can be identified through abnormal traffic patterns. For example, analyzing network traffic based on the HTTP protocol can reveal a large number of connection requests originating from unknown devices. Modem pool devices may generate a large number of network connections during operation. By analyzing device identifiers and connection behavior within the network traffic, abnormal traffic sources can be identified. Examine the magnitude and trend of the traffic. If a sudden traffic spike occurs with an unknown source, it may indicate that the modem pool device is conducting data transmission or communication activities.

[0054] Internet access characteristics can also be obtained through IP address analysis, such as monitoring based on the HTTP protocol and analyzing the distribution of IP addresses in network traffic. If a large amount of communication is found to originate from the same or similar IP address range, and these IP addresses are inconsistent with normal user behavior, it may be that the modem pool device is operating through specific network addresses. Monitoring the use of dynamic IP addresses is also crucial. Modem pool devices may frequently change IP addresses to evade detection; by monitoring and analyzing dynamic IP addresses, abnormal IP switching behavior can be detected.

[0055] The table below shows an example of internet access data obtained through a sliding window.

[0056]

[0057] Step 330: Perform clustering recognition on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters of the current micro-batch.

[0058] Step 340: Generate a time-series feature sequence based on multiple consecutive micro-batch candidate communication card clusters, input the time-series feature sequence into the time-series recognition model, and obtain the recognition result of the target communication device.

[0059] Steps 330 and 340 can be found above. Figure 1 The specific descriptions of steps 130 and 140 in the illustrated embodiment are provided, and they achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0060] In this embodiment, a sliding window mechanism is used to divide the continuous data stream into micro-batches for processing, focusing on communication behavior within a short time window. This allows for the timely capture of typical, short-term, high-intensity bursts of activity (e.g., concentrated calls, mass SMS messages) of target communication devices (e.g., SIM card pool devices), facilitating near real-time detection and early warning, and overcoming the high latency of traditional offline batch analysis. Multi-dimensional feature vectors encompass spatial distribution features and communication behavior features, resulting in a more comprehensive and three-dimensional device behavior profile. Target communication device identification does not rely on any single feature; even if disguised in one dimension (e.g., call duration), it is difficult to conceal in other dimensions (e.g., SMS content, IP behavior), thus significantly reducing false positives and false negatives. Using a sliding window instead of a single-moment snapshot for analysis allows for evaluation based on aggregated information within a time segment, effectively smoothing out instantaneous fluctuations and identifying persistent abnormal patterns, thereby improving stability and reliability.

[0061] In yet another exemplary embodiment, based on step 130 of the above embodiment, clustering identification is performed on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters for the current micro-batch. The method of this embodiment may further include the following specific steps: For each micro-batch, a first-level density clustering is performed on the multi-dimensional feature vector. The first-level density clustering clusters all communication cards based on the spatial distribution features and using a density clustering algorithm to obtain multiple first sub-clusters. For each first sub-cluster, a second-level density clustering is performed. The second-level density clustering clusters all communication cards in the first sub-cluster based on the communication behavior features and using a density clustering algorithm to identify second sub-clusters with similar communication behavior patterns. The second sub-clusters are marked as candidate communication card clusters for the current micro-batch.

[0062] The first-level density clustering and the second-level density clustering respectively filter the multi-dimensional feature vectors of the first micro-batch based on spatial distribution characteristics and communication behavior characteristics.

[0063] The first-level density clustering utilizes the spatial distribution characteristics of communication cards, such as the Base Station Location Area Code (LAC) and Base Station Cell Number (CI), to perform first-level clustering on all communication cards within the entire micro-batch. A density-based hierarchical clustering algorithm (Hierarchical Density-Based Spatial Clustering of Applications with Noise, HDBSCAN) can be employed. Leveraging the fixed physical location of the SIM card pool device, which ensures that multiple cards within it will generate signaling at the same location, the algorithm quickly identifies geographically concentrated groups of communication cards from the global data. The HDBSCAN algorithm automatically determines the number of clusters and identifies sparse, isolated points (i.e., normally distributed communication cards) as noise, thus focusing on discovering high-density spatial clusters. The multiple spatial clusters output by the first-level density clustering serve as first sub-clusters. Each first sub-cluster contains several spatially closely related communication cards, used as candidate ranges for subsequent further identification.

[0064] The second-level density clustering, based on each first sub-cluster obtained from the first-level density clustering, utilizes the communication behavior characteristics of the communication cards within the cluster (e.g., call, SMS, internet access, etc.) for density clustering, and can also employ the HDBSCAN algorithm. Within card groups located close to each other, communication cards with highly similar abnormal communication behaviors are further identified. Cards in the same SIM card pool will exhibit nearly identical call patterns, SMS templates, or data usage characteristics, while normal users, even when geographically close, exhibit diverse behavior patterns. The second-level density clustering identifies second sub-clusters with similar behavioral patterns within each first sub-cluster. Communication cards within these second sub-clusters are spatially clustered and behaviorally homogeneous, conforming to the typical characteristics of SIM card pools.

[0065] This embodiment uses the HDBSCAN algorithm as an example for specific explanation. Based on the usage characteristics of the communication card (e.g., voice, SMS, data usage), a time-point-based dataset is constructed according to the micro-batch concept, serving as the sample input for training the SIM card recognition model. An automatic machine learning algorithm is used for training to establish a location-based SIM card clustering model. The machine learning algorithm used is the HDBSCAN algorithm. HDBSCAN is a hierarchical density clustering algorithm that extends DBSCAN and transforms it into a hierarchical clustering algorithm. It then uses a technique based on cluster stability to extract planar clusters. The biggest advantage of HDBSCAN compared to DBSCAN is that it eliminates the need for manual selection of neighborhood radius and MinPts; only the size of the smallest generated cluster needs to be selected, and the algorithm can automatically recommend the optimal clustering results. It also defines a new distance metric, Mutual Reachability Distance, which better reflects the density between points. The specific calculation method is as follows: 1) Nearest neighbor distance: Used to construct a minimum spanning tree. Defined as: mreach(p,q)=max(dist(p,q),core_dist(p),core_dist(q)) Where dist(p,q) is the distance between point p and point q, and core_dist(p) is the distance from point p to its MinPts-th nearest neighbor.

[0066] 2) Density relative error: Used in the pruning process to determine whether to cut branches. Defined as: density_reachability(p,q)=child_density(p,q) / density(p) If the value is less than a threshold, the branch is cut off.

[0067] 3) Stable clustering: HDBSCAN uses cluster stability to select the final clustering result by comparing the cluster tree structure under different ε values.

[0068] HDBSCAN does not require explicit setting of the number of clusters; it determines the number automatically based on the density distribution of the data. In practice, the algorithm outputs a stability diagram from which a suitable threshold can be selected to determine the number of clusters.

[0069] Because the characteristics of SIM card pool devices dictate that a single SIM card pool device is typically located in a small area, and the communication cards within the SIM card pool share similar usage characteristics, a two-layer HDBSCAN clustering strategy is employed to construct a SIM card recognition model.

[0070] First-level density clustering: Location-based clustering. In this location-based strategy, the features of each card can be expressed as latitude and longitude. The rules for calculating distance are as follows:

[0071] in,( , ), ( , Let be the latitude and longitude coordinates of points p and q, and let the average latitude and longitude of the nodes within the cluster represent the latitude and longitude of all nodes within the cluster. , ).

[0072]

[0073] Second-level density clustering: Clustering based on usage features. In the usage feature-based strategy, assuming communication card P corresponds to point p and communication card Q corresponds to point q, the Euclidean geometric distance between communication cards P and Q is calculated as follows:

[0074] Among them, P Let Q represent the n characteristic values ​​of the communication card Q. Represents the n characteristic values ​​of communication card Q. The coefficients represent the n eigenvalues.

[0075] Based on the above two-level density clustering, the communication card was clustered, and the clusters were... C P For example, we can obtain the aggregated feature vector (average eigenvalue) of this cluster. This is used in subsequent time-series identification models.

[0076] The specific calculation method is as follows:

[0077] in, Similar to the second-level density clustering N is the total number of communication cards. Let be the original feature vector of the i-th communication card.

[0078] In this embodiment, the first-level density clustering, based on spatial distribution characteristics and leveraging the fixed physical locations of SIM card pool devices, quickly and accurately filters out candidate SIM cards with highly concentrated geographical locations from a massive number of communication cards, significantly narrowing down the range of suspected targets. The second-level density clustering then performs behavioral clustering, effectively avoiding the significant computational overhead and noise interference associated with direct global behavioral clustering. This allows for the identification of abnormal behavior patterns for the most likely subsequent target devices, improving identification efficiency and accuracy. It does not rely on any preset, static blacklists or fixed hardware fingerprints; the identification process is based on dynamic, relative spatial co-clusters and behavioral homogeneity, effectively combating deliberate counter-surveillance tactics and providing strong robustness. The HDBSCAN algorithm automatically determines the optimal number of clusters without requiring manual setting of key neighborhood radius parameters. It can automatically distinguish between dense clusters and noise points, achieving fully automated unsupervised learning and identification, which helps improve automated identification capabilities, optimize deployment methods, and reduce operation and maintenance costs.

[0079] In yet another exemplary embodiment, based on step 140 of the above embodiment, a time-series feature sequence is generated according to multiple consecutive micro-batch candidate communication card clusters, and the time-series feature sequence is input into a time-series recognition model to obtain the recognition result of the target communication device. The method of this embodiment may further include the following specific steps: Clustering features of candidate communication card clusters in multiple consecutive micro-batches are represented into a temporal feature sequence; the temporal feature sequence is input into a temporal recognition model based on an attention mechanism to calculate a temporal feature score; the temporal feature score is compared with a preset threshold, and the recognition result of the target communication device is output according to the comparison result, wherein the communication card with an attention score greater than or equal to the preset threshold is determined as the target communication device.

[0080] The temporal feature sequence is obtained by integrating the identification results of multiple consecutive micro-batches. For each candidate communication card cluster that appears repeatedly in multiple micro-batches, its state in each micro-batch is represented as a temporal data point. Specifically, the aggregated feature representation of the cluster in each micro-batch (e.g., the average value or normalized value of all communication card feature vectors in the cluster) is extracted, and these aggregated feature representations arranged in chronological order are combined into a temporal feature sequence.

[0081] The constructed temporal feature sequence is input into a pre-trained temporal recognition model. The temporal recognition model outputs a quantified temporal feature score for each tracked communication card or communication card cluster, which comprehensively reflects the degree of its overall behavioral anomaly over a past period.

[0082] The obtained time-series feature score is compared with a judgment threshold determined through historical data verification. When the time-series feature score is higher than or equal to the threshold, the corresponding communication card is determined to be the target communication device (i.e., the SIM card pool); otherwise, it is determined to be a normal communication card.

[0083] In this embodiment, the clustering results of multiple micro-batches are combined into a temporal feature sequence. Instead of relying on isolated snapshots at a single point in time, it is based on the continuous behavioral performance of a single card or device cluster over a continuous period. This effectively smooths out instantaneous false alarms caused by temporary, sudden normal business operations (e.g., users sending mass holiday greetings via SMS). Only when abnormal behavior patterns persist over time will a device be ultimately identified as a target communication device, thus improving the accuracy and reliability of the identification results. An attention-based temporal identification model is employed, providing the ability to intelligently weight historical information. The model can automatically learn and focus on historical moments most relevant to the current risk assessment, rather than selecting all historical data. For example, recently stable abnormal behavior will receive a higher weight than a single, accidental anomaly from the distant past. This dynamic focusing mechanism enhances the model's ability to perceive behavioral evolution trends, making its judgments more accurate and intelligent. The temporal feature score is a continuous quantitative value that provides operators and security personnel with the ability to classify risks. A higher score indicates a higher confidence that the target is a malicious device. This allows for more refined subsequent response measures, such as real-time blocking of high-scoring targets and focused monitoring of medium-scoring targets, thereby effectively combating crime while protecting normal business operations and optimizing operational efficiency.

[0084] In yet another exemplary embodiment, based on step 140 of the above embodiment, a time-series feature sequence is generated according to multiple consecutive micro-batch candidate communication card clusters, and the time-series feature sequence is input into a time-series recognition model to obtain the recognition result of the target communication device. The method of this embodiment may further include the following specific steps: The attention-based temporal recognition model is a sparse attention model; when calculating the attention score, the sparse attention model calculates the attention score between any position in the temporal feature sequence and its adjacent positions within a fixed window size.

[0085] This embodiment uses a sparse attention model for sliding window risk assessment as an example for detailed explanation. Assuming a sliding strategy with a window size of n and a step size of m, to simplify the process, elements from the same cluster are used... To characterize the feature values ​​of each communication card, and to reduce the differences in values ​​at different times, normalization was performed within the same location region (divided into the same cluster according to location) and at a unified time point. For ease of representation, this will be used subsequently. This represents the normalized value of the i-th communication card.

[0086]

[0087] Where m represents the maximum number of cards at each time point within the window of size n, then the input sequence for a window of size n is X = {x1, x2, ..., x...}n}, where x i The i-th element in the sequence is transformed linearly to obtain the query matrix Q=X*W_q, the key matrix K=X*W_k, and the value matrix V=X*W_v, where W_q, W_k, and W_v are weight values. These weight matrices are continuously learned and adjusted during model training. The attention score is calculated as follows:

[0088] in, It is the attention score between the i-th query and the j-th key. It is the dimension of the key. and These are the i-th and j-th rows of the query matrix Q and the key matrix K, respectively. Then, the attention score is normalized using the softmax function, as shown in the following formula:

[0089] Finally, the output of the attention is calculated, using the following formula:

[0090] In sparse attention mechanisms, the attention score is no longer calculated for all elements j; instead, a subset of elements is selected based on a sparsity strategy. For example, in fixed-window attention, only elements j whose distance from position i is within the window range are selected for calculation, i.e.:

[0091] Where w is the window size. Then, the attention score after sparsification is normalized using the softmax function, and the output is calculated:

[0092] in, It is the set of elements related to the j-th element selected according to the sparse strategy. Scoring of time series features.

[0093] With threshold (Obtained through multiple verifications) To determine whether the i-th card is a suspected SIM card, a flag is set for the communication card. The calculation method is as follows:

[0094] The flag value is A flag value of 1 indicates that the current communication card is not a suspected SIM card pool card, while a flag value of 1 indicates that the current communication card is a suspected SIM card pool card. By combining the location and IMEI of the communication card, other cards are identified, thus obtaining information about the communication cards and SIM card pools involved in the SIM card pool device.

[0095] In this embodiment, by introducing a sparse attention mechanism, the attention scores are limited to adjacent positions within a fixed window size, significantly reducing the computational complexity of the attention mechanism and improving computational efficiency. This enables fast, low-latency analysis of long-term behavioral sequences, meeting the business needs of real-time or near-real-time processing. The sparse attention model does not simply reduce computation; the local prior aligns with the behavioral characteristics of the SIM card pool device. For example, continuous group calls and regular group messaging typically exhibit continuous, short-term local patterns, allowing the identification target to focus on the most relevant historical information in the recent past. This effectively filters out noise interference from distant past or irrelevant time points, resulting in more accurate and stable identification results. The temporal feature score, as a quantitative output, provides a binary judgment by comparing it with a set threshold. This is not only simple to operate and provides quantitative basis for operations and maintenance personnel, but also indicates that a higher temporal feature score indicates a more obvious abnormal behavior pattern, effectively enhancing the interpretability and credibility of the identification results and facilitating subsequent manual review and tiered handling.

[0096] Corresponding to the target communication device identification method provided in the above embodiments, based on the same technical concept, this application also provides a target communication device identification device. See Figure 5 The device 400 includes a data processing module 410, a feature extraction module 420, a first recognition module 430, and a second recognition module 440.

[0097] The data processing module 410 is used to acquire signaling data in the communication network and process the signaling data; the feature extraction module 420 is used to divide the processed data into micro-batches based on a sliding window strategy, and obtain a multi-dimensional feature vector containing spatial distribution features and communication behavior features based on the data of each micro-batch; the first identification module 430 is used to perform clustering identification on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters of the current micro-batch; and the second identification module 440 is used to generate a time-series feature sequence based on the candidate communication card clusters of multiple consecutive micro-batches, input the time-series feature sequence into the time-series identification model, and obtain the identification result of the target communication device.

[0098] It should be noted that the target communication device identification device provided in this application embodiment and the target communication device identification method provided in this application embodiment are based on the same application concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned target communication device identification method, and the repeated parts will not be described again.

[0099] The target communication device identification method and apparatus provided in this application utilize voice, SMS, internet access log signaling, etc., combined with the usage characteristics of SIM card pools, and identify SIM card pools through artificial intelligence technology. Based on a sliding window strategy, a micro-batch approach is adopted to explore the behavioral characteristics of SIM card pools, and based on the results of a single exploration, a time-series identification and feedback model is constructed to further identify SIM card pools.

[0100] Corresponding to the target communication device identification method provided in the above embodiments, based on the same technical concept, this application also provides an electronic device for performing the above method. Figure 6 To illustrate the structure of an electronic device according to various embodiments of this application, as shown in the following diagrams... Figure 6 As shown. Electronic device 500 can vary considerably due to differences in configuration or performance, and may include one or more processors 510 and memory 520. Memory 520 may store one or more application programs or data. Memory 520 may be temporary or persistent storage. The application programs stored in memory 520 may include one or more modules (not shown), each module may include a series of computer-executable instructions for the electronic device. Furthermore, processor 510 may be configured to communicate with memory 520 and execute the series of computer-executable instructions stored in memory 520 on the electronic device.

[0101] This application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer, implement the steps of the target communication device identification method as described above.

[0102] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0103] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems, devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0104] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0105] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0106] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0107] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0108] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0109] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0110] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying a target communication device, characterized in that, The method includes the following steps: Acquire signaling data from the communication network and process the signaling data; The processed data is divided into micro-batches based on a sliding window strategy, and a multi-dimensional feature vector containing spatial distribution characteristics and communication behavior characteristics is obtained based on the data in each micro-batch. For each micro-batch, clustering identification is performed on the multi-dimensional feature vector based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters for the current micro-batch; A time-series feature sequence is generated based on multiple consecutive micro-batch candidate communication card clusters. The time-series feature sequence is then input into a time-series recognition model to obtain the recognition result of the target communication device.

2. The method according to claim 1, characterized in that, The process of acquiring signaling data from the communication network and processing the signaling data includes the following steps: Signaling data is obtained from multiple network nodes in the communication network, and the signaling data includes at least two of voice communication signaling, SMS communication signaling, and Internet access log signaling; The signaling data is parsed based on the established communication protocol. Multiple configuration fields are extracted from the data parsed by the protocol. These configuration fields include user identification information, location area information, timestamp information, and service type information.

3. The method according to claim 2, characterized in that, The step of acquiring signaling data from the communication network and processing the signaling data further includes the following steps: The defined field information is validated and cleaned, and then converted into a predefined vector data format based on the defined communication protocol.

4. The method according to claim 1, characterized in that, The process of dividing the processed data into micro-batches based on a sliding window strategy and obtaining a multi-dimensional feature vector containing spatial distribution characteristics and communication behavior characteristics based on each micro-batch includes the following steps: The processed data is divided into micro-batches based on a preset window size and sliding step size; Spatial distribution features and communication behavior features are extracted from each micro-batch of data. The spatial distribution features include base station location area codes and / or base station cell codes, and the communication behavior features include call dimension features, SMS dimension features, and / or Internet access dimension features.

5. The method according to claim 1, characterized in that, The step of performing clustering identification on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters for the current micro-batch includes the following steps: For each micro-batch of multi-dimensional feature vectors, a first-level density clustering is performed. The first-level density clustering is based on the spatial distribution features and uses a density clustering algorithm to cluster all communication cards to obtain multiple first sub-clusters. For each first sub-cluster, a second-level density clustering is performed. The second-level density clustering is based on the communication behavior characteristics and uses a density clustering algorithm to cluster all communication cards in the first sub-cluster, and to identify second sub-clusters with similar communication behavior patterns. The second sub-cluster is marked as a candidate communication card cluster in the current micro-batch.

6. The method according to claim 1, characterized in that, The step of generating a time-series feature sequence based on multiple consecutive micro-batch candidate communication card clusters, and inputting the time-series feature sequence into a time-series recognition model to obtain the recognition result of the target communication device includes the following steps: The clustering features of multiple consecutive micro-batch candidate communication card clusters are combined into a time-series feature sequence; The temporal feature sequence is input into a temporal recognition model based on an attention mechanism to calculate the temporal feature score; The temporal feature score is compared with a preset threshold, and the identification result of the target communication device is output based on the comparison result. The communication card with a temporal feature score greater than or equal to the preset threshold is identified as the target communication device.

7. The method according to claim 6, characterized in that, The attention-based temporal recognition model is a sparse attention model; When calculating the attention score, the sparse attention model calculates the attention score between any position in the temporal feature sequence and its adjacent positions within a fixed window size.

8. A target communication device identification device, characterized in that, The device includes the following: The data processing module is used to acquire signaling data from the communication network and process the signaling data; The feature extraction module is used to divide the processed data into micro-batches based on a sliding window strategy, and to obtain a multi-dimensional feature vector containing spatial distribution features and communication behavior features based on the data in each micro-batch. The first identification module is used to perform clustering identification on the multi-dimensional feature vector of each micro-batch based on the spatial distribution features and communication behavior features to obtain the candidate communication card clusters of the current micro-batch. as well as, The second identification module is used to generate a time-series feature sequence based on multiple consecutive micro-batch candidate communication card clusters, input the time-series feature sequence into the time-series identification model, and obtain the identification result of the target communication device.

9. An electronic device, characterized in that, It includes a processor, a memory, a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, implement the steps of the method as described in any one of claims 1 to 7.

Images