CN116939661A

CN116939661A - SIM card abnormality detection method and system, electronic equipment and storage medium

Info

Publication number: CN116939661A
Application number: CN202310760638.4A
Authority: CN
Inventors: 卢成锦; 郑成林; 鄂雪妮; 王超
Original assignee: China Telecom Corp Ltd
Current assignee: China Telecom Corp Ltd
Priority date: 2023-06-26
Filing date: 2023-06-26
Publication date: 2023-10-24

Abstract

The invention discloses a method and a system for detecting abnormality of a SIM card, electronic equipment and a storage medium, wherein the method comprises the following steps: acquiring signaling interaction information, user position information and base station configuration information of a target SIM card at a plurality of sampling moments within a preset time length; feature extraction and feature fusion are carried out on the signaling interaction information, the user position information and the base station configuration information, a feature vector matrix corresponding to each sampling moment is obtained, and feature vector matrix time sequence data are generated; based on a first mean value matrix and a first standard deviation matrix of preset sliding window statistical feature vector matrix time sequence data, judging whether communication abnormality exists at corresponding sampling moments; and determining a plurality of sampling moments with abnormal communication as abnormal communication moments, and determining whether the target SIM card is abnormal according to the number of the abnormal communication moments. The invention improves the real-time performance, accuracy and efficiency of the abnormal detection of the SIM card, also improves the use experience of the user, and can be widely applied to the technical field of communication.

Description

SIM card abnormality detection method and system, electronic equipment and storage medium

Technical Field

The invention relates to the technical field of communication, in particular to a method and a system for detecting abnormality of a SIM card, electronic equipment and a storage medium.

Background

With the progress of the technological level and the increase of the demands of people for electronic entertainment, mobile phones have become an important component in the daily life of people. However, the security problem of the mobile phone also appears, and especially, the abnormal behavior of the SIM card brings a lot of inconveniences to the network experience and life of the user, and the normal use of the SIM card may be affected by the conventional loss of the SIM card, the falling water of the terminal, demagnetization, data configuration and core-side data configuration. Research and study show that 2022 is a customer complaint problem in telecommunication of certain province, wherein the abnormal problem of the SIM card accounts for 15 percent. In the prior art, a user often finds that the SIM card is abnormal in the process of using the mobile phone, and then goes to a business hall for detection or replacement. The above technical problems need to be solved.

Disclosure of Invention

The present invention aims to solve at least one of the technical problems existing in the prior art to a certain extent.

Therefore, an object of the embodiments of the present invention is to provide a method for detecting an abnormality of a SIM card, which improves the real-time performance, accuracy and efficiency of detecting an abnormality of a SIM card, and also improves the use experience of a user.

Another object of the embodiment of the present invention is to provide a SIM card abnormality detection system.

In order to achieve the technical purpose, the technical scheme adopted by the embodiment of the invention comprises the following steps:

in one aspect, an embodiment of the present invention provides a method for detecting SIM card abnormality, including the following steps:

acquiring signaling interaction information, user position information and base station configuration information of a target SIM card at a plurality of sampling moments within a preset time length;

performing feature extraction and feature fusion on the signaling interaction information, the user position information and the base station configuration information to obtain feature vector matrixes corresponding to the sampling moments, and generating feature vector matrix time sequence data according to the feature vector matrixes;

counting a first mean value matrix and a first standard deviation matrix of the time sequence data of the feature vector matrix based on a preset sliding window, and judging whether communication abnormality exists at the corresponding sampling moment according to the first mean value matrix, the first standard deviation matrix and the feature vector matrix;

and determining that a plurality of sampling moments with abnormal communication are abnormal communication moments, and determining whether the target SIM card is abnormal according to the quantity of the abnormal communication moments.

Further, in an embodiment of the present invention, the step of obtaining signaling interaction information, user location information, and base station configuration information of the target SIM card at a plurality of sampling moments within a preset duration specifically includes:

determining a target base station accessed by the target SIM card at the current sampling moment;

and acquiring signaling interaction information and user position information of the target SIM card at the current sampling moment through the target base station, and acquiring base station configuration information of the target base station at the current sampling moment.

Further, in an embodiment of the present invention, the step of extracting features and fusing features of the signaling interaction information, the user location information, and the base station configuration information to obtain feature vector matrices corresponding to the sampling moments, and generating feature vector matrix time sequence data according to the feature vector matrices specifically includes:

performing data cleaning and data encoding on the signaling interaction information to obtain first encoded information, and performing feature extraction on the first encoded information to obtain a first feature vector;

determining a first space coordinate according to the user position information, and performing vectorization processing on the first space coordinate to obtain a second feature vector;

Acquiring initial configuration information of a target base station, determining a configuration change increment according to the initial configuration information and the base station configuration information, and performing data coding and vectorization processing on the configuration change increment to obtain a third feature vector;

performing feature fusion on the first feature vector, the second feature vector and the third feature vector to obtain the feature vector matrix corresponding to the current sampling moment;

carrying out time sequence processing on the feature vector matrix according to the sequence of the sampling moments to obtain the feature vector matrix time sequence data;

the target base station is a base station accessed by the target SIM card at the current sampling moment.

Further, in an embodiment of the present invention, the step of counting a first mean matrix and a first standard deviation matrix of the time sequence data of the feature vector matrix based on a preset sliding window, and judging whether the corresponding sampling time has communication abnormality according to the first mean matrix, the first standard deviation matrix and the feature vector matrix specifically includes:

acquiring a preset sliding window, intercepting first time sequence fragment data from the time sequence data of the feature vector matrix according to the sliding window, and determining a plurality of first feature vector matrixes corresponding to the first time sequence fragment data;

Determining a first mean value matrix according to the mean values of a plurality of matrix elements positioned at the same matrix position in a plurality of first eigenvector matrices, and determining a first standard deviation matrix according to the standard deviation of a plurality of matrix elements positioned at the same matrix position in a plurality of first eigenvector matrices;

determining a first distance matrix of each first eigenvector matrix and the first mean matrix, and determining a first eigenvalue of each first eigenvector matrix according to the ratio of matrix elements in the first distance matrix to matrix elements corresponding to matrix positions in the first standard deviation matrix;

if the first characteristic value is larger than a preset first threshold value, determining that communication abnormality exists at the corresponding sampling moment, and if the first characteristic value is smaller than or equal to the first threshold value, determining that communication abnormality does not exist at the corresponding sampling moment.

Further, in an embodiment of the present invention, the step of determining a first distance matrix between each of the first eigenvector matrices and the first mean matrix, and determining a first eigenvalue of each of the first eigenvector matrices according to a ratio of matrix elements in the first distance matrix to matrix elements corresponding to matrix positions in the first standard deviation matrix specifically includes:

Determining matrix elements corresponding to matrix positions in the first distance matrix according to absolute values of differences between matrix elements in the first eigenvector matrix and matrix elements corresponding to matrix positions in the first mean matrix, so as to obtain the first distance matrix;

and determining the ratio of each matrix element in the first distance matrix to the matrix element corresponding to the matrix position in the first standard deviation matrix as a first ratio, and carrying out weighted summation on the first ratio to obtain the first characteristic value.

Further, in an embodiment of the present invention, the SIM card anomaly detection method further includes a step of optimally adjusting the first threshold, which specifically includes:

acquiring preset training sample time sequence data, an initial value of the first threshold value and an optimization factor of the first threshold value, wherein the training sample time sequence data comprises a plurality of second feature vector matrixes;

determining a second number of the second eigenvector matrixes with abnormal communication in the training sample time sequence data through manual labeling;

determining second eigenvalues of the second eigenvector matrixes, and predicting the first number of the second eigenvector matrixes with communication anomalies according to the second eigenvalues and the first threshold value;

If the first number is smaller than the second number, increasing the value of the first threshold according to the optimization factor, and if the first number is larger than the second number, decreasing the value of the first threshold according to the optimization factor;

and returning to the step of predicting the first number of the second eigenvector matrix with communication anomalies according to the second eigenvalue and the first threshold value until the first number is equal to the second number or the iteration number reaches a preset second threshold value.

Further, in an embodiment of the present invention, the step of determining whether the target SIM card is abnormal according to the number of abnormal communication moments specifically includes:

determining a third number of the abnormal communication moments;

determining a second ratio of the third quantity to the preset duration, and determining that the target SIM card is abnormal when the second ratio is larger than a preset third threshold;

or alternatively, the first and second heat exchangers may be,

and determining a third ratio of the third quantity to the total number of the sampling moments, and determining that the target SIM card is abnormal when the third ratio is larger than a preset fourth threshold value.

In another aspect, an embodiment of the present invention provides a SIM card abnormality detection system, including:

The information acquisition module is used for acquiring signaling interaction information, user position information and base station configuration information of the target SIM card at a plurality of sampling moments within a preset time length;

the feature fusion module is used for carrying out feature extraction and feature fusion on the signaling interaction information, the user position information and the base station configuration information to obtain feature vector matrixes corresponding to the sampling moments, and generating feature vector matrix time sequence data according to the feature vector matrixes;

the communication anomaly detection module is used for counting a first mean value matrix and a first standard deviation matrix of the time sequence data of the feature vector matrix based on a preset sliding window, and judging whether communication anomalies exist at the corresponding sampling moments according to the first mean value matrix, the first standard deviation matrix and the feature vector matrix;

the SIM card abnormality determining module is used for determining that a plurality of sampling moments with abnormal communication are abnormal communication moments and determining whether the target SIM card is abnormal according to the number of the abnormal communication moments.

In another aspect, an embodiment of the present invention provides an electronic device, where the electronic device includes a memory, a processor, a program stored on the memory and executable on the processor, and a data bus for implementing connection communication between the processor and the memory, where the program when executed by the processor implements a SIM card anomaly detection method as described above.

In another aspect, an embodiment of the present invention further provides a storage medium, where the storage medium is a computer readable storage medium, and the storage medium stores one or more programs, and the one or more programs may be executed by one or more processors, so as to implement a SIM card anomaly detection method as described above.

The advantages and benefits of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

The embodiment of the invention acquires signaling interaction information, user position information and base station configuration information of a target SIM card at a plurality of sampling moments within a preset time period, performs feature extraction and feature fusion on the signaling interaction information, the user position information and the base station configuration information to obtain a feature vector matrix corresponding to each sampling moment, generates feature vector matrix time sequence data according to the feature vector matrix, counts a first mean value matrix and a first standard deviation matrix of the feature vector matrix time sequence data based on a preset sliding window, judges whether the corresponding sampling moment has communication abnormality according to the first mean value matrix, the first standard deviation matrix and the feature vector matrix, further can determine that a plurality of sampling moments with communication abnormality are abnormal communication moments, and determines whether the target SIM card has the abnormality according to the number of the abnormal communication moments. The embodiment of the invention samples and detects the signaling interaction information, the user position information and the base station configuration information of the target SIM card, can detect the abnormality in the process of using the SIM card by the user, and improves the real-time performance and the efficiency of detecting the abnormality of the SIM card; by carrying out feature extraction and feature fusion on the information of three dimensions, namely signaling interaction information, user position information and base station configuration information, whether the target SIM card has communication abnormality can be judged more accurately, so that the accuracy of detecting the abnormality of the SIM card is improved; in addition, the embodiment of the invention can remotely detect whether the SIM card is abnormal without the need of autonomous perception of the abnormal condition of the SIM card by the user, thereby improving the use experience of the user.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following description will refer to the drawings that are needed in the embodiments of the present invention, and it should be understood that the drawings in the following description are only for convenience and clarity to describe some embodiments in the technical solutions of the present invention, and other drawings may be obtained according to these drawings without any inventive effort for those skilled in the art.

Fig. 1 is a flowchart of steps of a SIM card abnormality detection method according to an embodiment of the present invention;

fig. 2 is a flowchart of step S101 provided in the embodiment of the present invention;

fig. 3 is a flowchart of step S102 provided in the embodiment of the present invention;

fig. 4 is a flowchart of step S103 provided in the embodiment of the present invention;

fig. 5 is another flowchart of step S103 provided in the embodiment of the present invention;

FIG. 6 is a flowchart illustrating steps for optimally adjusting a first threshold according to an embodiment of the present invention;

FIG. 7 is a schematic instruction diagram of an adaptive anomaly detection algorithm according to an embodiment of the present invention;

fig. 8 is a flowchart of step S104 provided in the embodiment of the present invention;

fig. 9 is a schematic structural diagram of a SIM card abnormality detection system according to an embodiment of the present invention;

Fig. 10 is a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present application.

Detailed Description

Embodiments of the present application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to like or similar elements or elements having like or similar functions throughout. The embodiments described below by referring to the drawings are illustrative only and are not to be construed as limiting the application. It should be noted that although functional block division is performed in a system diagram and a logic sequence is shown in a flowchart, in some cases, the steps shown or described may be performed in a different order than the block division in the system diagram or the sequence in the flowchart. The step numbers in the following embodiments are set for convenience of illustration only, and the order between the steps is not limited in any way, and the execution order of the steps in the embodiments may be adaptively adjusted according to the understanding of those skilled in the art.

In the description of the present application, the plurality means two or more, and if the description is made to the first and second for the purpose of distinguishing technical features, it should not be construed as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the precedence of the indicated technical features. Furthermore, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of the application only and is not intended to be limiting of the application.

The SIM card abnormality detection method provided by the embodiment of the application can be applied to a terminal, a server and software running in the terminal or the server. In some embodiments, the terminal may be a smart phone, tablet, notebook, desktop, etc.; the server side can be configured as an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, and a cloud server for providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, basic cloud computing services such as big data and artificial intelligent platforms and the like; the software may be an application or the like that realizes the SIM card abnormality detection method, but is not limited to the above form.

The application is operational with numerous general purpose or special purpose computer system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

In the embodiments of the present application, when related processing is performed according to user information, user behavior data, user history data, user location information, and other data related to user identity or characteristics, permission or consent of the user is obtained first, and the collection, use, processing, and the like of the data comply with related laws and regulations and standards of related countries and regions. In addition, when the embodiment of the application needs to acquire the sensitive personal information of the user, the independent permission or independent consent of the user is acquired through popup or jump to a confirmation page and the like, and after the independent permission or independent consent of the user is definitely acquired, the necessary relevant data of the user for enabling the embodiment of the application to normally operate is acquired.

Referring to fig. 1, a flowchart illustrating steps of a method for detecting an abnormality of a SIM card according to an embodiment of the present application is provided, and referring to fig. 1, the method for detecting an abnormality of a SIM card includes the following steps:

s101, signaling interaction information, user position information and base station configuration information of a target SIM card at a plurality of sampling moments within a preset time are obtained.

Specifically, the embodiment of the invention obtains the signaling conditions of the user SIM card and the wireless side and the core side, the position information of the user and the condition information of the base station where the user SIM card is located, and realizes the abnormality detection of the target SIM card through a subsequent abnormality algorithm.

Referring to fig. 2, further as an optional implementation manner, the step of obtaining signaling interaction information, user location information and base station configuration information of a target SIM card at a plurality of sampling moments within a preset duration specifically includes:

s1011, determining a target base station to which a target SIM card is connected at the current sampling moment;

s1012, acquiring signaling interaction information and user position information of a target SIM card at the current sampling time through a target base station, and acquiring base station configuration information of the target base station at the current sampling time.

Specifically, the embodiment of the invention determines the target base station accessed by the target SIM card at the current sampling moment through the information acquisition module deployed at the base station side; after the target base station is determined, signaling interaction information of the target SIM card and the base station or a core network and user position information of the current position of the target SIM card can be obtained through the target base station; in addition, the base station configuration information of the current sampling time of the target base station can be obtained, wherein the base station configuration information comprises the basic configuration of the base station and the related configuration of the communication channels of the base station and the SIM card.

In the embodiment of the invention, the abnormality detection is carried out on the target SIM card for a single time by taking the preset time length as a unit, a plurality of sampling moments are determined in the preset time length according to the preset time interval, and the signaling interaction information, the user position information and the base station configuration information acquired at each sampling moment form data to be processed corresponding to the sampling moment.

It can be understood that the embodiment of the invention adopts a real-time big data stream processing technology, so that the abnormal behavior of the SIM card can be analyzed and identified in real time while the data is continuously processed, and compared with the traditional batch processing mode, the real-time stream processing can greatly improve the detection efficiency and the response speed.

S102, feature extraction and feature fusion are carried out on the signaling interaction information, the user position information and the base station configuration information, a feature vector matrix corresponding to each sampling moment is obtained, and feature vector matrix time sequence data are generated according to the feature vector matrix.

The embodiment of the invention comprehensively grasps the behavior characteristics of the target SIM card through multidimensional characteristic analysis, specifically, the embodiment of the invention performs characteristic extraction on a plurality of dimensions such as signaling interaction between the terminal and the base station, position information of a user, configuration information of the base station and the like, and integrates the extracted characteristic vectors into a characteristic vector matrix through a characteristic fusion technology. Compared with the traditional single feature analysis, the multi-dimensional feature analysis can more accurately describe the behavior mode of the SIM card, so that the accuracy of the abnormality detection of the SIM card is improved.

Referring to fig. 3, as an alternative implementation manner, further feature extraction and feature fusion are performed on signaling interaction information, user location information and base station configuration information to obtain feature vector matrixes corresponding to each sampling time, and feature vector matrix time sequence data is generated according to the feature vector matrixes, which is shown in fig. 3 as a flowchart of step S102 provided by the embodiment of the present invention, and specifically includes the steps of:

s1021, performing data cleaning and data encoding on the signaling interaction information to obtain first encoded information, and performing feature extraction on the first encoded information to obtain a first feature vector;

s1022, determining a first space coordinate according to the user position information, and performing vectorization processing on the first space coordinate to obtain a second feature vector;

s1023, acquiring initial configuration information of a target base station, determining a configuration change increment according to the initial configuration information and the base station configuration information, and carrying out data coding and vectorization processing on the configuration change increment to obtain a third feature vector;

s1024, carrying out feature fusion on the first feature vector, the second feature vector and the third feature vector to obtain a feature vector matrix corresponding to the current sampling moment;

S1025, carrying out time sequence processing on the feature vector matrix according to the sequence of each sampling moment to obtain feature vector matrix time sequence data;

the target base station is a base station accessed by a target SIM card at the current sampling moment.

Specifically, operations such as data cleaning, correction, classification, sorting, screening and sorting are performed on the signaling interaction information to obtain complete and accurate signaling interaction information between the target SIM card and the target base station, then data encoding is performed to obtain first encoded information, then feature extraction is performed to obtain a first feature vector, and the feature extraction method can adopt the existing feature extraction methods such as a principal component analysis method or a multidimensional scale analysis method.

And converting the user position information into three-dimensional space coordinates, and then carrying out vectorization processing to obtain a second feature vector.

And for the configuration information of the base station, acquiring initial configuration information of the target base station, comparing the configuration information of the base station with the initial configuration information to obtain a configuration change increment of the target base station at the current sampling moment, and then carrying out data coding and vectorization processing on the configuration change increment to obtain a third feature vector.

And carrying out feature fusion according to the first feature vector, the second feature vector and the third feature vector to obtain a feature vector matrix corresponding to the current sampling moment, wherein the feature fusion can adopt the existing feature fusion technology, for example, vector connection is carried out on the first feature vector, the second feature vector and the third feature vector to obtain a feature vector matrix taking the sum of the three dimensions as vector dimension numbers, and for example, vector element addition is carried out on the first feature vector, the second feature vector and the third feature vector on the dimension corresponding to the order to realize vector splicing of the first feature vector, the second feature vector and the third feature vector to obtain a feature vector matrix taking the highest value of the three dimensions as vector dimension numbers, and for example, weighting and summing the vector elements of each feature vector are introduced on the basis of the vector splicing mode to obtain the corresponding feature vector matrix. It should be noted that, the embodiment of the present invention does not limit the feature fusion manner, and a specific feature fusion manner may be selected according to actual situations.

After the feature vector matrix corresponding to each sampling time is obtained, carrying out time sequence processing on all the feature vector matrices according to the sequence of each sampling time, and obtaining the time sequence data of the feature vector matrix.

S103, counting a first mean value matrix and a first standard deviation matrix of the characteristic vector matrix time sequence data based on a preset sliding window, and judging whether communication abnormality exists at corresponding sampling moments according to the first mean value matrix, the first standard deviation matrix and the characteristic vector matrix.

Specifically, the sliding window can intercept time series data in a specified time range according to a specified unit length so as to calculate a statistical index in the time range.

Referring to fig. 4, as a further alternative implementation manner, referring to fig. 4, a step of determining whether there is a communication abnormality at a corresponding sampling time based on a first mean matrix and a first standard deviation matrix of preset sliding window statistical feature vector matrix time sequence data and according to the first mean matrix, the first standard deviation matrix and the feature vector matrix is further shown in fig. 4 as a flowchart of step S103 provided by the embodiment of the present invention, which specifically includes:

s1031, acquiring a preset sliding window, intercepting first time sequence fragment data from feature vector matrix time sequence data according to the sliding window, and determining a plurality of first feature vector matrixes corresponding to the first time sequence fragment data;

S1032, determining a first mean value matrix according to the mean value of the matrix elements positioned at the same matrix position in the plurality of first eigenvector matrices, and determining a first standard deviation matrix according to the standard deviation of the matrix elements positioned at the same matrix position in the plurality of first eigenvector matrices;

s1033, determining a first distance matrix of each first eigenvector matrix and a first mean matrix, and determining a first eigenvalue of each first eigenvector matrix according to the ratio of matrix elements in the first distance matrix to matrix elements corresponding to matrix positions in the first standard deviation matrix;

s1034, if the first characteristic value is larger than a preset first threshold value, determining that communication abnormality exists at the corresponding sampling time, and if the first characteristic value is smaller than or equal to the first threshold value, determining that communication abnormality does not exist at the corresponding sampling time.

Specifically, the length (duration) of the sliding window may be dynamically determined according to the length of the feature vector matrix timing data; for each first eigenvector matrix in the intercepted first time sequence chip number data, carrying out average value calculation and standard deviation calculation of the matrix to obtain a first average value matrix and a first standard deviation matrix, specifically, calculating the average value of matrix elements at the same matrix position as matrix elements of the first average value matrix and calculating the standard deviation of the matrix elements at the same matrix position as matrix elements of the first standard deviation matrix; calculating a first distance matrix of the first eigenvector matrix and the first mean matrix, specifically calculating absolute values of differences of matrix elements at the same matrix positions in the first eigenvector matrix and the first mean matrix as matrix elements of the first distance matrix; calculating the ratio of matrix elements at the same matrix position of the first distance matrix to the first standard deviation matrix, obtaining a plurality of first ratios, and determining a first eigenvalue of a first eigenvector matrix according to the obtained plurality of first ratios; and comparing the first characteristic value with a preset first threshold value, and determining that communication abnormality exists at the corresponding sampling moment when the first characteristic value is larger than the first threshold value.

It should be noted that, the embodiment of the present invention relates to calculation of the mean value and standard deviation of the matrix, the relevant calculation rule is common knowledge in the art, and may be implemented by MATLAB, and the embodiment of the present invention only introduces the calculation principle, and does not describe the specific calculation process.

Referring to fig. 5, as a further alternative implementation manner, a step of determining a first distance matrix between each first eigenvector matrix and a first mean matrix and determining a first eigenvalue of each first eigenvector matrix according to a ratio of a matrix element in the first distance matrix to a matrix element corresponding to a matrix position in the first standard deviation matrix is further shown in another flowchart of step S103 provided by the embodiment of the present invention, which specifically includes:

s10331, determining matrix elements corresponding to matrix positions in the first distance matrix according to absolute values of differences between each matrix element in the first eigenvector matrix and matrix elements corresponding to matrix positions in the first mean matrix, so as to obtain the first distance matrix;

s10332, determining the ratio of each matrix element in the first distance matrix to the matrix element corresponding to the matrix position in the first standard deviation matrix as a first ratio, and carrying out weighted summation on the first ratio to obtain a first characteristic value.

Specifically, in the embodiment of the present invention, the first feature value of the first feature vector matrix is determined according to the first ratio value of each matrix element in the first distance matrix and the matrix element corresponding to the matrix position in the first standard deviation matrix, and specifically, the first feature value may be obtained by weighting and summing the first ratio values, where each first ratio value may take the same weight value or may take different weight values, and when taking different weight values, the weight value of each first ratio value is determined according to the data source of the matrix element corresponding to the matrix position in the first feature vector matrix, for example, for the matrix element obtained based on signaling interaction information, a higher weight value may be taken, and for the matrix element obtained based on user position information, a lower weight value may be taken.

Referring to fig. 6, further as an optional implementation manner, the SIM card anomaly detection method further includes a step of optimally adjusting the first threshold, which specifically includes:

s201, acquiring a plurality of preset training sample time sequence data, an initial value of a first threshold value and an optimization factor of the first threshold value, wherein the training sample time sequence data comprises a plurality of second feature vector matrixes;

S202, determining a second number of second eigenvector matrixes with abnormal communication in the training sample time sequence data through manual labeling;

s203, determining second eigenvalues of each second eigenvector matrix, and predicting the first number of the second eigenvector matrices with abnormal communication according to the second eigenvalues and the first threshold;

s204, if the first quantity is smaller than the second quantity, increasing the value of the first threshold according to the optimization factor, and if the first quantity is larger than the second quantity, decreasing the value of the first threshold according to the optimization factor;

and S205, returning to the step of predicting the first quantity of the second eigenvector matrix with the communication abnormality according to the second eigenvalue and the first threshold value until the first quantity is equal to the second quantity or the iteration number reaches a preset second threshold value.

Specifically, the first threshold value of the embodiment of the invention can be adaptively optimized and adjusted through training samples, so that the accuracy of detecting the sampling moment of communication abnormality is improved. Fig. 7 is a schematic instruction diagram of an adaptive anomaly detection algorithm according to an embodiment of the present invention, which improves an existing big data analysis algorithm, and adopts an anomaly detection algorithm with an adaptive adjustment threshold, so that the operation speed is faster and the execution efficiency is higher by combining a big data stream technology with an adaptive technology. The algorithm can automatically adjust parameters of the detection algorithm (namely the length of the sliding window and the number of the first threshold) according to the change of the data characteristics, so that abnormal behavior detection of different types of SIM cards is adapted. In addition, the algorithm has strong generalization capability, and can be widely applied to SIM card abnormality detection tasks in different scenes.

Referring to fig. 7, the anomaly detection algorithm based on sliding window and adaptive threshold adjustment adopted in the embodiment of the present invention may adaptively adjust detection parameters according to the collected data features, and the specific algorithm steps are as follows:

step one: initializing detection parameters:

based on the data acquisition characteristics of big data, determining a sliding window with the size omega according to the acquired sample time sequence data in a certain time period, and setting an initial first threshold value as T ₀ And an optimization factor α for adjusting the first threshold.

Step two: calculating statistics within each sliding window:

for each sliding window of the acquired sample timing data, the mean matrix { μ ] of the data points within the sliding window is counted _ab Sum of standard deviation matrix { sigma } _ab }：

Wherein x is _iab Matrix elements, μ representing the ith row, b column of the ith eigenvector matrix within the sliding window _ab Matrix elements, sigma, representing the a-th row, b-th column of the mean matrix _ab Matrix elements representing the a-th row and b-th column of the standard deviation matrix.

Step three: communication anomaly detection:

for each eigenvector matrix { x } within the sliding window _iab Calculating the mean matrix { mu }, and _ab distance matrix { d }, of _iab }：

d _iab ＝|x _iab -μ _ab |

According to distance matrix { d } _iab Sum of standard deviation matrix { sigma } _ab Determining a first ratio L _iab ：

According to a first ratio L _iab Determining a feature vector matrix { x } _iab First eigenvalue S of } _i The following are provided:

S _i ＝Σ(L _iab *m _iab )

wherein m is _iab The weighting weight corresponding to the matrix element of the ith row and the ith column of the ith eigenvector matrix is represented;

if the first characteristic value S _i Greater than a first threshold T ₀ And marking the data point of the sampling moment corresponding to the feature vector matrix as abnormal communication.

Step four: adaptively adjusting a threshold:

after each detection, the system records the relevant threshold value, and adjusts the actual threshold value T according to the ratio of the number of actual abnormal data points in the window to the number of predicted abnormal data points. The actual anomaly data points may be determined by manually analyzing the collected data, and the determined anomaly types include, but are not limited to Security mode rejected, unshifted, user authentication failed, MAC failure, attach request times, and frequently registered VoLTE.

If the actual abnormal data points are too many, the threshold value can be lowered; if there are too few actual outlier data points, the threshold may be raised. And continuously recording and updating the threshold value, and optimizing the detected threshold value to improve the detection accuracy. The formula for optimally adjusting the first threshold is as follows:

It can be understood that the magnitude of the optimization factor α determines the sensitivity degree of the algorithm when the first threshold is adjusted, and the optimization factor α can adopt a fixed value according to experience, and can also optimize the value of α while adjusting the first threshold, so that the adjustment of the first threshold is more scientific and accurate. The following describes in detail an embodiment of optimizing the value of α while adjusting the first threshold.

Initializing: setting an initial value T of T ₀ The maximum iteration number N (e.g. 10) is used for abnormality detection, and the actual abnormal point number A and the predicted abnormal point number E are recorded.

Calculating a first threshold adjustment amount:(the initial value of α may be set to 0.1).

Updating the first threshold: t=t ₀ +ΔT。

Re-predicting the number E of abnormal points according to the updated first threshold ₁ And judging the actual abnormal point quantity A and the predicted abnormal point quantity E ₁ Whether the ratio is within an acceptable range: if (A/E) ₁ )>The preset high threshold value indicates that the quantity of actually occurring SIM card communication anomalies is excessive, the threshold value is adjusted to be too large, and alpha is reduced; if (A/E)<The preset low threshold value indicates that the number of actually occurring abnormal SIM card cards is too small, the threshold value is adjusted to be too small, and alpha is increased.

And adjusting alpha according to the result of the last step: if (a/E) > high threshold, adjusted α=α x shrinkage ratio; if (a/E) < low threshold, adjusted α=α/shrinkage ratio; the number of the remaining cases α is not adjusted, wherein the shrinkage ratio can be preset.

And updating the updated first threshold value T again according to the adjusted optimization factor alpha, and predicting the number of abnormal points again to calculate a new first threshold value T, and adjusting the optimization factor alpha so as to facilitate the next updating of the first threshold value T. It will be appreciated that the value of the first threshold is updated every iteration, and the optimization factor may or may not be adjusted, and the adjusted optimization factor is used for the next update of the first threshold.

When the value of the first threshold T is such that the difference between the actual abnormal point number and the predicted abnormal point number corresponding to all the sample time sequence data is within the preset range, or the iteration number reaches the preset N times, stopping the iteration, and outputting the first threshold T at this time.

Step five: sliding window:

the sliding window is moved forward by one time step and the window ω at this time is recorded _i And repeating the second to fourth steps.

Step six: and (3) outputting results:

all data points marked as abnormal and corresponding time stamps (namely sampling time) are output, and corresponding abnormal events are found according to the time stamps so as to be further analyzed and processed.

S104, determining a plurality of sampling moments with abnormal communication as abnormal communication moments, and determining whether the target SIM card is abnormal according to the number of the abnormal communication moments.

Referring to fig. 8, a flowchart of step S104 provided by the embodiment of the present invention is shown, and referring to fig. 8, further as an alternative implementation, the step of determining whether there is an abnormality in the target SIM card according to the number of abnormal communication moments specifically includes:

determining a third number of abnormal communication moments;

or alternatively, the first and second heat exchangers may be,

and determining a third ratio of the third quantity to the total number of sampling moments, and determining that the target SIM card is abnormal when the third ratio is larger than a preset fourth threshold value.

Specifically, the embodiment of the invention determines whether the target SIM card is abnormal based on the number of sampling moments with communication abnormality, for example, determines a second ratio of a third number of sampling moments with communication abnormality (namely abnormal sampling moments) to a preset time length, wherein the second ratio reflects the number of times of occurrence of communication abnormality of the target SIM card in unit time, and if the second ratio is greater than a preset third threshold, the second ratio indicates that the target SIM card is abnormal; and for example, determining a third ratio of the third number to the total number of sampling moments in the preset time period, wherein the third ratio reflects the probability of abnormal communication of the target SMI card during each sampling detection, and if the third ratio is larger than a preset fourth threshold value, the target SIM card is abnormal.

According to the embodiment of the invention, based on the detection of the SIM card state by the big data fusion analysis model, the AI algorithm is combined with the big data technology, so that whether the SIM card of the user is abnormal can be rapidly and accurately identified. The embodiment of the invention is mainly applicable to the front end and the rear end:

1) User complaints are processed aiming at the back-end customer service personnel: the method can help customer service personnel to quickly locate the abnormal problem of the SIM card, improve the working efficiency and enhance the perception of users.

2) Aiming at the front end, the function is applied to public numbers, a user can finish abnormal self-checking of the SIM card, reduce abnormal complaint quantity of the SIM card, determine user problems, guide the user to solve the problems, provide convenience communication internet service for the user, and also combine a short message sending platform of China telecom to timely push a guide short message for exchanging the card to the user with abnormal SIM card, discover the problems before complaint, and reduce user complaint.

The embodiment of the invention acquires the user communication record, the call duration, the communication place and the like of the user SIM card, and the connection and registration signaling of the SIM card and a core network under the condition of acquiring the permission of the user, and uploads the connection and registration signaling to a big data lake for storage and timing update; the collected data are cleaned, corrected, classified, ordered, screened and arranged through a big data stream processing technology, and meanwhile, the data are analyzed and modeled through a big data analysis algorithm; then, according to the big data modeling result, combining 4G signaling and 5G signaling which cause abnormal appearance of the SIM card, carrying out abnormal detection on the data, and extracting characteristics related to abnormal behavior of the SIM card, wherein the characteristics comprise real-time detection of abnormal conditions such as failure of registering the SIM card, unknown or non-in-system of the UE S1 APID (unique identification of the UE on an S1 interface), failure of user identity verification and the like; and finally, storing the big data processing result to form an API interface call, so that a back-end customer service technician can conveniently call and inquire user complaints and the front-end user can use the SIM card to conduct self-checking.

The method steps of the embodiments of the present invention are described above. It can be understood that the embodiment of the invention samples and detects the signaling interaction information, the user position information and the base station configuration information of the target SIM card, so that the abnormality detection can be performed in the process of using the SIM card by the user, and the instantaneity and the efficiency of the abnormality detection of the SIM card are improved; by carrying out feature extraction and feature fusion on the information of three dimensions, namely signaling interaction information, user position information and base station configuration information, whether the target SIM card has communication abnormality can be judged more accurately, so that the accuracy of detecting the abnormality of the SIM card is improved; in addition, the embodiment of the invention can remotely detect whether the SIM card is abnormal without the need of autonomous perception of the abnormal condition of the SIM card by the user, thereby improving the use experience of the user.

Compared with the prior art, the embodiment of the invention has the following advantages:

high-efficiency real-time: through a real-time big data stream processing technology, related information such as signaling, position information, access base station information and the like of a user SIM card can be continuously acquired through a base station, and the related information is transmitted to a big data lake in real time, so that abnormal behaviors can be analyzed and identified in real time while the data is continuously processed, and the detection efficiency and response speed are greatly improved;

Adaptive capability: adopting a self-adaptive abnormality detection algorithm, continuously and adaptively adjusting a first threshold and a sliding window required under the condition of continuously processing and detecting the abnormality of the SIM card, continuously optimizing and identifying a detection process, and continuously adjusting the threshold through parameter self-optimization in the continuous detection process to achieve the optimal detection;

the accuracy is high: through multidimensional feature analysis and feature fusion technology, the behavior mode of the SIM card can be more accurately described, so that the accuracy of anomaly detection is improved.

Referring to fig. 9, a schematic structural diagram of a SIM card abnormality detection system according to an embodiment of the present invention is provided, and referring to fig. 9, the SIM card abnormality detection system includes:

the feature fusion module is used for carrying out feature extraction and feature fusion on the signaling interaction information, the user position information and the base station configuration information to obtain a feature vector matrix corresponding to each sampling moment, and generating feature vector matrix time sequence data according to the feature vector matrix;

the communication anomaly detection module is used for counting a first mean value matrix and a first standard deviation matrix of the characteristic vector matrix time sequence data based on a preset sliding window, and judging whether communication anomalies exist at corresponding sampling moments according to the first mean value matrix, the first standard deviation matrix and the characteristic vector matrix;

The SIM card abnormality determination module is used for determining a plurality of sampling moments with abnormal communication as abnormal communication moments and determining whether the target SIM card is abnormal according to the number of the abnormal communication moments.

The content in the method embodiment is applicable to the system embodiment, the functions specifically realized by the system embodiment are the same as those of the method embodiment, and the achieved beneficial effects are the same as those of the method embodiment.

The embodiment of the invention also provides electronic equipment, which comprises: the system comprises a memory, a processor, a program stored on the memory and capable of running on the processor, and a data bus for realizing connection communication between the processor and the memory, wherein the program is executed by the processor to realize the SIM card abnormality detection method. The electronic equipment can be any intelligent terminal including a tablet personal computer, a vehicle-mounted computer and the like.

Referring to fig. 10, a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present invention is shown in fig. 10, where the embodiment of the present invention provides an electronic device, including:

the processor 1001 may be implemented by using a general-purpose CPU (central processing unit), a microprocessor, an application-specific integrated circuit (ApplicationSpecificIntegratedCircuit, ASIC), or one or more integrated circuits, etc. to execute related programs to implement the technical solution provided by the embodiments of the present invention;

The memory 1002 may be implemented in the form of read-only memory (ReadOnlyMemory, ROM), static storage, dynamic storage, or random access memory (RandomAccessMemory, RAM). The memory 1002 may store an operating system and other application programs, and when the technical solution provided in the embodiments of the present disclosure is implemented by software or firmware, relevant program codes are stored in the memory 1002, and the processor 1001 invokes the SIM card anomaly detection method for executing the embodiments of the present disclosure;

an input/output interface 1003 for implementing information input and output;

the communication interface 1004 is configured to implement communication interaction between the present device and other devices, and may implement communication in a wired manner (e.g. USB, network cable, etc.), or may implement communication in a wireless manner (e.g. mobile network, WIFI, bluetooth, etc.);

a bus 1005 for transferring information between the various components of the device (e.g., the processor 1001, memory 1002, input/output interface 1003, and communication interface 1004);

wherein the processor 1001, the memory 1002, the input/output interface 1003, and the communication interface 1004 realize communication connection between each other inside the device through the bus 1005.

The embodiment of the invention also provides a storage medium, which is a computer readable storage medium and is used for computer readable storage, the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to realize the SIM card abnormality detection method.

The memory, as a non-transitory computer readable storage medium, may be used to store non-transitory software programs as well as non-transitory computer executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, the memory optionally includes memory remotely located relative to the processor, the remote memory being connectable to the processor through a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Embodiments of the present invention also disclose a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The computer instructions may be read from a computer-readable storage medium by a processor of a computer device, and executed by the processor, to cause the computer device to perform the method shown in fig. 1.

In some alternative embodiments, the functions/acts noted in the block diagrams may occur out of the order noted in the operational illustrations. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved. Furthermore, the embodiments presented and described in the flowcharts of the present invention are provided by way of example in order to provide a more thorough understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed, and in which sub-operations described as part of a larger operation are performed independently.

Furthermore, while the present invention has been described in the context of functional modules, it should be appreciated that, unless otherwise indicated, one or more of the functions and/or features described above may be integrated in a single physical device and/or software module or one or more of the functions and/or features may be implemented in separate physical devices or software modules. It will also be appreciated that a detailed discussion of the actual implementation of each module is not necessary to an understanding of the present invention. Rather, the actual implementation of the various functional modules in the apparatus disclosed herein will be apparent to those skilled in the art from consideration of their attributes, functions and internal relationships. Accordingly, one of ordinary skill in the art can implement the invention as set forth in the claims without undue experimentation. It is also to be understood that the specific concepts disclosed are merely illustrative and are not intended to be limiting upon the scope of the invention, which is to be defined in the appended claims and their full scope of equivalents.

The above functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present invention may be embodied in essence or a part contributing to the prior art or a part of the technical solution in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above-described method of the various embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

Logic and/or steps represented in the flowcharts or otherwise described herein, e.g., a ordered listing of executable instructions for implementing logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium upon which the program described above is printed, as the program described above may be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

It is to be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above-described embodiments, the various steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, may be implemented using any one or combination of the following techniques, as is well known in the art: discrete logic circuits having logic gates for implementing logic functions on data signals, application specific integrated circuits having suitable combinational logic gates, programmable Gate Arrays (PGAs), field Programmable Gate Arrays (FPGAs), and the like.

In the foregoing description of the present specification, reference has been made to the terms "one embodiment/example", "another embodiment/example", "certain embodiments/examples", and the like, means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiments or examples. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

While embodiments of the present application have been shown and described, it will be understood by those of ordinary skill in the art that: many changes, modifications, substitutions and variations may be made to the embodiments without departing from the spirit and principles of the application, the scope of which is defined by the claims and their equivalents.

While the preferred embodiment of the present application has been described in detail, the present application is not limited to the above embodiments, and various equivalent modifications and substitutions can be made by those skilled in the art without departing from the spirit of the present application, and these equivalent modifications and substitutions are intended to be included in the scope of the present application as defined in the appended claims.

Claims

1. The method for detecting the abnormality of the SIM card is characterized by comprising the following steps of:

2. The SIM card anomaly detection method according to claim 1, wherein the step of obtaining signaling interaction information, user location information, and base station configuration information of the target SIM card at a plurality of sampling moments within a preset duration specifically includes:

3. The SIM card anomaly detection method according to claim 1, wherein the step of performing feature extraction and feature fusion on the signaling interaction information, the user location information, and the base station configuration information to obtain feature vector matrices corresponding to the sampling moments, and generating feature vector matrix time sequence data according to the feature vector matrices specifically includes:

4. The SIM card anomaly detection method according to claim 1, wherein the step of counting a first mean value matrix and a first standard deviation matrix of the feature vector matrix time sequence data based on a preset sliding window, and judging whether the corresponding sampling time has communication anomalies according to the first mean value matrix, the first standard deviation matrix and the feature vector matrix specifically includes:

5. The method for detecting abnormal SIM card according to claim 4, wherein the step of determining the first distance matrix between each of the first eigenvector matrices and the first mean matrix, and determining the first eigenvalue of each of the first eigenvector matrices according to the ratio of the matrix element in the first distance matrix to the matrix element corresponding to the matrix position in the first standard deviation matrix, specifically includes:

6. The SIM card anomaly detection method of claim 4, further comprising the step of optimally adjusting the first threshold, comprising:

7. The SIM card abnormality detection method according to any one of claims 1 to 6, characterized in that said step of determining whether or not there is an abnormality in the target SIM card according to the number of abnormal communication moments, specifically includes:

determining a third number of the abnormal communication moments;

or alternatively, the first and second heat exchangers may be,

8. A SIM card anomaly detection system, comprising:

9. An electronic device comprising a memory, a processor, a program stored on the memory and executable on the processor, and a data bus for enabling a connection communication between the processor and the memory, the program when executed by the processor implementing the steps of the SIM card anomaly detection method of any one of claims 1 to 7.

10. A storage medium, which is a computer-readable storage medium, for computer-readable storage, characterized in that the storage medium stores one or more programs executable by one or more processors to implement the steps of the SIM card anomaly detection method according to any one of claims 1 to 7.