CN108076032A - A kind of abnormal behaviour user identification method and device - Google Patents

Abstract

Embodiments of the present invention provide a method and device for identifying users with abnormal behavior. The method includes: obtaining status information of the current network, and the status information includes: overall network rate, network element rate, and service flow value; according to the current network state information, preset time interval t, and observation time i, to determine whether there are users with abnormal behavior in the current network; if there are users with abnormal behavior in the current network, obtain the session record information of the user to be identified and the user terminal to be identified Information; according to the session record information and the user terminal information, identify the user with abnormal behavior. The apparatus performs the method described above. The method and device for identifying users with abnormal behaviors provided by the embodiments of the present invention ensure the stability of the current network rate by judging whether there are users with abnormal behaviors in the current network and identifying the users with abnormal behaviors.

Description

Abnormal behavior user identification method and device

technical field

Embodiments of the present invention relate to the technical field of mobile communications, and in particular to a method and device for identifying users with abnormal behavior.

Background technique

With the development of mobile communication technology, more and more people obtain information through the Internet to meet the needs of daily study and work.

But at the same time, some behaviors related to Internet information security, such as hacking accounts, posting advertisements, publishing malicious links, defrauding Internet users of money, etc., also occurred. Such behaviors are collectively referred to as "abnormal user behaviors". Network resources have greatly affected the normal user's online experience, resulting in slow or inability to access the Internet. The existing methods to solve this problem are mainly through user complaints, and the processing personnel go to the site to test, and according to the test results, specific The network environment is optimized, but users with abnormal behavior cannot be identified, and the problem of slow Internet speed of normal users cannot be solved from the source.

Therefore, how to effectively identify users with abnormal behavior has become an urgent problem to be solved.

Contents of the invention

Aiming at the problems existing in the prior art, embodiments of the present invention provide a method and device for identifying users with abnormal behavior.

On the one hand, an embodiment of the present invention provides a user identification method for abnormal behavior, including:

Obtaining status information of the current network, the status information including: the overall network speed, network element speed and service flow value;

According to the state information of the current network, the preset time interval t and the observation time i, determine whether there are abnormal behavior users in the current network;

If there is a user with abnormal behavior in the current network, obtaining session record information of the user to be identified and terminal information of the user to be identified;

Identify the user with abnormal behavior according to the session record information and the user terminal information.

On the other hand, an embodiment of the present invention provides an abnormal behavior user identification device, including:

A network information acquisition unit, configured to acquire status information of the current network, the status information including: the speed of the entire network, the speed of network elements and the value of service flow;

A judging unit, configured to judge whether there are abnormal behavior users in the current network according to the state information of the current network, the preset time interval t and the observation time i;

A user information acquiring unit, configured to acquire session record information of the user to be identified and terminal information of the user to be identified if there is a user with abnormal behavior in the current network;

An identifying unit, configured to identify the user with abnormal behavior according to the session record information and the user terminal information.

The method and device for identifying users with abnormal behaviors provided by the embodiments of the present invention ensure the stability of the current network rate by judging whether there are users with abnormal behaviors in the current network and identifying the users with abnormal behaviors.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flow diagram of a method for identifying a user with abnormal behavior according to an embodiment of the present invention;

FIG. 2 is a schematic flow diagram of a method for identifying users with abnormal behavior according to yet another embodiment of the present invention;

3 is a schematic structural diagram of an abnormal behavior user identification device according to an embodiment of the present invention;

Fig. 4 is a schematic diagram of the physical structure of the device provided by the embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

FIG. 1 is a schematic flow chart of a method for identifying users with abnormal behaviors in an embodiment of the present invention. As shown in FIG. 1 , a method for identifying users with abnormal behaviors provided in this embodiment includes the following steps:

S1: Obtain status information of the current network, where the status information includes: overall network rate, network element rate, and service flow value.

Specifically, the device acquires the state information of the current network, and the state information includes: the speed of the entire network, the speed of network elements, and the value of service flow. It should be noted that the current network status information may include the overall network rate, network element rate and service flow value, but is not limited to the above-mentioned overall network rate, network element rate and service flow value.

S2: According to the status information of the current network, the preset time interval t and the observation time i, determine whether there is an abnormal behavior user in the current network.

Specifically, the device judges whether there is a user with abnormal behavior in the current network according to the status information of the current network, a preset time interval t, and an observation time i. It should be noted that: the preset time interval t and the observation time i can be set independently according to the actual situation, for example: the preset time interval t can be set to 1 hour, which can be understood as: the device performs the abnormal behavior user identification every 1 hour method once, and identify the user behavior to be selected; the smaller the value set for the preset time interval t, the higher the frequency of user behavior recognition, and the larger the value set for the preset time interval t, the higher the user behavior The lower the frequency of identification, the observation time i can be arbitrarily set to one or more times between the start time and end time corresponding to the preset time interval t, for example: when the preset time interval t is set to 1 hour, if the execution The current time of this method is 17:00, then the start time corresponds to 17:00, the end time corresponds to 18:00, and the observation time i can be any one or several times from 17:00 to 18:00 The acquisition time of the whole network rate or network element rate or service flow value.

S3: If there is a user with abnormal behavior in the current network, acquire session record information of the user to be identified and terminal information of the user to be identified.

Specifically, if the device learns that there is a user with abnormal behavior in the current network, it acquires the session record information of the user to be identified and the terminal information of the user to be identified. It should be noted that user session record information may include but not limited to: access record information to network domain names, session duration, source TCP/UDP port, target TCP/UDP port, etc. User terminal information may include but not limited to: The brand and model of the mobile phone terminal used, etc.

S4: Identify the user with abnormal behavior according to the session record information and the user terminal information.

Specifically, the device identifies the user with abnormal behavior according to the session record information and the user terminal information. It should be noted that the identification of users with abnormal behavior can be realized based on the number of visits to a specific domain name in the session record information, and the mobile terminal brand and model of the user terminal information, the mobile phone number used, and the location of the mobile terminal .

The abnormal behavior user identification method provided by the embodiment of the present invention ensures the stability of the current network rate by judging whether there are abnormal behavior users in the current network and identifying the abnormal behavior users.

On the basis of the above embodiments, the judging whether there are users with abnormal behavior in the current network according to the state information of the current network, the preset time interval t and the observation time i includes:

According to the overall network rate of the current network, the preset time interval t and the observation time i, it is judged whether the overall network rate of the current network has decreased.

Specifically, the device judges whether the overall network rate of the current network decreases according to the overall network rate of the current network, a preset time interval t, and an observation time i. It should be noted that: the basis for judging whether the overall network rate drops can be the percentage of the entire network rate decrease of the current network. Continue to refer to the above implementation for example as follows: when the preset time interval t is set to 1 hour, if the current time of executing this method is 17:00, then the start time corresponds to 17:00, and the end time corresponds to 18:00, assuming that the observation time i is 17:10, 17:25, and, then the number of observations n is 3 times, according to the formula: Calculate the average speed of the entire network within a preset time interval of 1 hour Among them, V _Ai is the whole network rate in the status information of the current network, and then according to the formula: Calculate the network-wide rate drop percentage P _A of the current network, and then according to the formula: Determine whether the overall network rate of the current network is in a declining state (that is, when _PA ≥ 5%, it means that the overall network rate has decreased; when _PA < 5%, it indicates that the entire network rate has not decreased), and 5% of them are preset The percentage of the entire network rate can be set independently according to the actual situation, and 5% here is an optional solution, which is not specifically limited in the embodiment of the present invention.

If it is determined that the network-wide rate of the current network is in a declining state, it is determined whether the network element rate of the current network has decreased.

Specifically, if the device determines that the network-wide rate of the current network is in a declining state, it determines whether the network element rate of the current network has decreased. If it is determined that the network-wide rate of the current network is not reduced, it can be considered that there is no user with abnormal behavior in the current network. It should be noted that: the basis for judging whether the network element rate drops can be the network element rate drop percentage of the current network, continue to refer to the above implementation for example as follows: the number of observations n is 3 times, according to the formula: Calculate the average value of network element speed within a preset time interval of 1 hour Among them, V _Bi is the network element rate in the current network status information, and then according to the formula: Calculate the network element speed reduction percentage P _B of the current network, and then according to the formula: Judging whether the network element rate of the current network is in a declining state, 10% of which is the preset network element rate percentage, which can be set independently according to the actual situation. The 10% here is an optional solution. No specific limitation is made.

If it is determined that the network element rate of the current network is in a declining state, then according to the size of the service flow values, select the first m service flow values among the service flow values as candidate service flow values.

Specifically, if the device determines that the network element rate of the current network is in a declining state, select the first m service flow values among the service flow values as candidate service flow values according to the size of the service flow values. If the device determines that the rate of the network element of the current network is not decreased, it may consider that there is no user with abnormal behavior in the current network. The value of m can be set independently according to the actual situation, and is not specifically limited here. This embodiment lists the value of the service flow to be selected obtained by m=10 as shown in Table 1:

Table 1 shows the top 10 service flow values that can be used as the service flow values to be selected

Table 1

business Traffic (MB) Proportion Rate(kbps) 360 Security Guard 3687 14% 283 Fetion 1090 4% 198 netease 570 2% 108 ICBC 553 2% 93 Qzone 370 1% 479 Tencent.com 284 1% 591 UC browsing 151 1% 480 Sina 148 1% 503 baidu 110 0% 397 Apple official website 77 0% 470 RNC as a whole 25598 100% 278

Calculate the rate of the service to be selected corresponding to the service to be selected according to the preset time interval t and the flow value of the service to be selected.

Specifically, the device calculates the rate of the service to be selected corresponding to the service to be selected according to the preset time interval t and the flow value of the service to be selected. An example is as follows: According to the formula: Calculate the rate V _ij of the service to be selected, where i is the observation time, j is the jth service, and M _ij is the flow rate of the service to be selected.

Judging whether the rate of the service to be selected on the current network drops.

Specifically, the device judges whether the rate of the service to be selected on the current network decreases. According to the formula: Calculate the average value of the service rate to be selected Then according to the formula: Judging whether the service rate to be selected on the current network is in a declining state. Judging whether the service rate to be selected on the current network is in a declining state.

If it is determined that the rate of the service to be selected on the current network is in a declining state, it is determined that there are users with abnormal behavior in the current network.

Specifically, if the device determines that the rate of the service to be selected on the current network is in a declining state, it determines that there is a user with abnormal behavior on the current network. If it is determined that the rate of the service to be selected on the current network is in a non-decreasing state, it may be considered that there is no user with abnormal behavior in the current network.

The abnormal behavior user identification method provided by the embodiment of the present invention can accurately identify whether there is an abnormal behavior user in the current network by judging whether the current network's overall network rate, network element rate, and candidate service rate have decreased.

On the basis of the above embodiments, the judging whether the overall network rate of the current network has decreased according to the overall network rate of the current network, the preset time interval t and the observation time i includes:

Obtain the number of observations n within the preset time interval t according to the preset time interval t and the observation time i, wherein the observation time i is located at the start time and end time corresponding to the preset time interval t between.

Specifically, the device obtains the number of observations n within the preset time interval t according to the preset time interval t and the observation time i, wherein the observation time i is located at the start corresponding to the preset time interval t between time and end time. It has been described in the above embodiments, and will not be repeated here.

According to the number of observations n and the network-wide rate of the current network, an average value of the network-wide rate within the preset time interval t is calculated.

Specifically, the device calculates an average value of the network-wide rate within the preset time interval t according to the number of observations n and the network-wide rate of the current network. It has been described in the above embodiments, and will not be repeated here.

Calculate the decrease percentage of the network-wide rate of the current network according to the average value of the network-wide rate and the network-wide rate of the current network.

Specifically, the device calculates the decrease percentage of the network-wide rate of the current network according to the average value of the network-wide rate and the network-wide rate of the current network. It has been described in the above embodiments, and will not be repeated here.

If the overall network rate decrease percentage of the current network is greater than or equal to the preset overall network rate percentage, it is determined that the overall network rate of the current network is in a declining state.

Specifically, if the device learns that the overall network rate decrease percentage of the current network is greater than or equal to a preset overall network rate percentage, it determines that the overall network rate of the current network is in a decreased state. It has been described in the above embodiments, and will not be repeated here.

The abnormal-behavior user identification method provided by the embodiment of the present invention ensures the accuracy of judging the overall network rate decrease state by calculating the rate decrease percentage of the current network.

On the basis of the foregoing embodiments, the determination of whether the network element rate of the current network has decreased includes:

According to the number of observations n and the network element rate of the current network, an average value of the network element rate within the preset time interval t is calculated.

Specifically, the device calculates an average value of the network element rate within the preset time interval t according to the number of observations n and the network element rate of the current network. It has been described in the above embodiments, and will not be repeated here.

Calculate the decrease percentage of the network element rate of the current network according to the average value of the network element rate and the network element rate of the current network.

Specifically, the device calculates a decrease percentage of the network element rate of the current network according to the average value of the network element rate and the network element rate of the current network. It has been described in the above embodiments, and will not be repeated here.

If the decreasing percentage of the network element rate of the current network is greater than or equal to the preset network element rate percentage, it is determined that the network element rate of the current network is in a decreasing state.

Specifically, if the device learns that the decrease percentage of the network element rate of the current network is greater than or equal to the preset network element rate percentage, it determines that the network element rate of the current network is in a decreased state. It has been described in the above embodiments, and will not be repeated here.

The abnormal behavior user identification method provided by the embodiment of the present invention ensures the accuracy of judging the network element rate decrease state by calculating the rate decrease percentage of the network element rate in the current network.

On the basis of the above embodiments, the judging whether the service rate of the current network to be selected has decreased includes:

Calculate the average value of the service rates to be selected according to the service rates to be selected and the number m of service flows to be selected.

Specifically, the device calculates an average value of the service rates to be selected according to the service rates to be selected and the number m of service flows to be selected. It has been described in the above embodiments, and will not be repeated here.

According to the average value of the service rate to be selected The average value of the service rate V _ij to be selected and the network element rate If passed the formula If the calculation result is 1, it is judged that the service rate to be selected in the current network is in a declining state.

Specifically, according to the average value of the service rate to be selected, the device The average value of the service rate V _ij to be selected and the network element rate If passed the formula If the calculation result is 1, it is judged that the service rate to be selected in the current network is in a declining state. It has been described in the above embodiments, and will not be repeated here.

The abnormal behavior user identification method provided by the embodiment of the present invention ensures the accuracy of judging that the service rate to be selected is in a declining state according to the calculated average value of the service rate to be selected and the network element rate.

On the basis of the above embodiments, the identifying the user with abnormal behavior according to the session record information and the user terminal information includes:

According to the specific domain name visit times in the session record information, the user to be identified whose visit times to the specific domain name is greater than a first visit times threshold is identified as an abnormal user.

Specifically, Fig. 2 is a schematic flowchart of a method for identifying users with abnormal behavior according to another embodiment of the present invention. As shown in Fig. 2, the device counts the number of visits to a specific domain name greater than the number of visits to a specific domain name in the session record information. The user to be identified with a visit times threshold is identified as an abnormal user. The first access times threshold can be set independently according to the actual situation, which is not limited here. An example is as follows: there are 1,000 users to be identified, the first access threshold is 50, and 40 of the users to be identified have a specific domain name whose access times are greater than the first access threshold of 50 times, then these 40 users to be identified will be identified as abnormal user.

The user to be identified whose visit times to the specific domain name is less than a first visit times threshold is taken as the first user to be identified.

Specifically, the device takes the user to be identified whose visit times to the specific domain name is less than a first visit times threshold as the first user to be identified. Continuing to refer to the foregoing embodiment, an example is described as follows: the above 960 (1000−40=960) users to be identified are taken as the first users to be identified.

extracting the mobile phone number of the first user to be identified, and if the number of times the same mobile phone number has visited the specific domain name is greater than a second threshold of visit times, identifying the first user to be identified as an abnormal user, wherein the second The access count threshold is smaller than the first access count threshold.

Specifically, the device extracts the mobile phone number of the first user to be identified, and identifies the first user to be identified as an abnormal user if the number of visits to the specific domain name by the same mobile phone number is greater than the second access times threshold, wherein, The second access times threshold is smaller than the first access times threshold. The second access times threshold can be set independently according to the actual situation, which is not limited here. Continuing to refer to the above-mentioned embodiment, an example is as follows: the first user to be identified is 960, and the second access times threshold is 40 times, and the number of visits to a specific domain name by the same mobile phone number among the first users to be identified is greater than the second access times threshold of 40 The first 60 users to be identified are identified as abnormal users.

The first user to be identified whose number of visits to the specific domain name by the same mobile phone number is less than a second threshold of visit times is used as the second user to be identified.

Specifically, the device uses the first user to be identified whose number of visits to the specific domain name by the same mobile phone number is less than the second threshold of visit times as the second user to be identified. An example is as follows: the first user to be identified is 960, and 900 (960-60) first users to be identified are taken as the second user to be identified.

Extracting the mobile phone terminal information of the second user to be identified, where the mobile phone terminal information includes: a manufacturer and model of the mobile phone terminal.

Specifically, the device extracts the mobile phone terminal information of the second user to be identified, and the mobile phone terminal information may include but not limited to: a manufacturer and model of the mobile phone terminal.

If the number of visits to the specific domain name by the mobile phone terminal of the same manufacturer and model is greater than the third visit times threshold, the second user to be identified is identified as an abnormal user, wherein the third visit times The threshold is smaller than the second access times threshold.

Specifically, if the device learns that the number of visits to the specific domain name by the mobile phone terminal of the same manufacturer and model is greater than the third threshold for the number of visits, it identifies the second user to be identified as an abnormal user, wherein the The third access times threshold is smaller than the second access times threshold. The third visit times threshold can be set independently according to the actual situation, which is not limited here. Continuing to refer to the foregoing embodiment, an example is as follows: the second user to be identified is 900, and the third access times threshold is 30 times. The 20 second unrecognized users whose access times to the specific domain name are greater than the third access times threshold of 30 times are identified as abnormal users.

The second user to be identified whose number of accesses to the specific domain name by the mobile phone terminal of the same manufacturer and model is less than a third access times threshold is taken as the third user to be identified.

Specifically, the device takes the second user to be identified whose number of visits to the specific domain name by the mobile phone terminal of the same manufacturer and model is less than a third threshold for the number of visits as the third user to be identified. An example is as follows: the second unidentified user is 900, and 880 (900-20) second unidentified users are taken as the third unidentified user.

extracting the location information of the mobile phone terminal of the third user to be identified, and if the displacement variation generated by the position of the mobile phone terminal within the preset time interval t is less than a preset distance threshold, the third user to be identified is Identified as an abnormal user.

Specifically, the device extracts the location information of the mobile phone terminal of the third user to be identified, and if the displacement variation of the location of the mobile phone terminal within the preset time interval t is less than a preset distance threshold, the second Three users to be identified are identified as abnormal users. The preset distance threshold can be set independently according to the actual situation, which is not limited here. Continuing to refer to the above-mentioned embodiment, an example is as follows: there are 880 third users to be identified, and the preset distance threshold is 200 meters, and the displacement generated by the position of the mobile phone terminal among the third users to be identified within the preset time interval t The 10 third unrecognized users whose variation is less than the preset distance threshold of 200 meters are identified as abnormal users. Identify the 870 (880-10) third unidentified users whose displacement variation of the position of the mobile phone terminal among the third unidentified users is greater than or equal to the preset distance threshold of 200 meters within the preset time interval t as normal users .

The method for identifying users with abnormal behaviors provided by the embodiments of the present invention ensures the accuracy of the recognition effect by successively identifying users with abnormal behaviors.

The method for obtaining the flow chart of the abnormal behavior user identification method shown in Figure 2 can be obtained according to the following steps:

R1: User session record information to be identified, and key features are extracted as sample base factors. Independent features that have no effect on other features are regarded as a sample library factor, and multiple features that interact and act together are combined into a sample library factor. Thus, a sample library containing online behavior sessions of normal users and abnormal users is established.

R2: Based on the sample library factors in step R1, a certain number of objects are randomly selected, and a training data set is constructed. Through training and pruning, a flow chart of the abnormal behavior user identification method shown in Figure 2 is generated. The detailed structure and algorithm of the flow chart of the user identification method for identifying abnormal behaviors are as follows:

The decision tree algorithm adopts the CART (Classification and Regression Trees) algorithm, that is, the classification regression tree algorithm.

The CART algorithm mainly includes two steps: (1) recursively divide the sample for tree building process, (2) use the verification data for pruning.

Step (1) recursively builds a binary tree, segments x ₁ , x ₂ , . . . , x _n represent n attributes of a single sample, and y represents the category it belongs to. The CART algorithm recursively divides the n-dimensional space into non-overlapping rectangles. The division steps are roughly as follows:

(1) Select an independent variable x _i , and then select a value v _i of x _i , _vi divides the n-dimensional space into two parts, all samples in one part satisfy x _i ≤ v _i , and all samples in the other part satisfy x _i >v _i , for discrete variables, there are only two values of the attribute value, that is equal to this value or not equal to this value. Continuous variables need to be discretized first, and the characteristics of abnormal user online behavior in this proposal belong to continuous variables.

(2) Recursive processing, the two parts obtained above are reselected according to step (1) to continue dividing until the entire n-dimensional space is divided.

In the division process, for a variable attribute, its division point is the midpoint of a pair of continuous variable attribute values. Assuming that an attribute of a set of m samples has m continuous values, then there will be m-1 split points, and each split point is the mean of two adjacent continuous values. The division of each attribute is sorted according to the amount of impurities that can be reduced, and the reduction of impurities is defined as the sum of the proportions of the impurity before division minus the division of the impurity amount of each node after division. The Gini index is commonly used in the impurity measurement method. The Gini value is mainly to measure the impurity of the data division or training data set K. The Gini value is tested on the branch node. If it meets a certain purity, it is divided into the left subtree, otherwise it is divided into the right subtree. tree, and finally generate a binary decision tree. The smaller the Gini value, the higher the "purity" of the sample. Assuming that a sample has a total of Z classes, and the probability of belonging to class i is p _i , then the Gini impurity of a node K can be defined as the following formula:

When Gini(K)=0, all samples belong to the same class, and when all classes appear in nodes with equal probability, Gini(K) is maximized,

In the actual recursive division process, if all samples of the current node do not belong to the same class or there is only one sample left, then this node is a non-leaf node, so it is necessary to try each attribute of the sample and the split point corresponding to each attribute, Try to find a partition with the largest impurity variable, and the subtree partitioned by this attribute is the optimal branch.

Step (2) CART algorithm adopts post-pruning, and this proposal adopts cost complexity pruning method in post-pruning: r(t) is the error rate of node t, p(t) is the percentage of data on node t in all data ratio, if the node is pruned, R(t) is the error cost of node t, then

R(t)=r(t)×p(t) (9)

If the node is not pruned, R(T _t ) is the error cost of the subtree T _t , which is equal to the sum of the error costs of all leaf nodes on the subtree T _t ; is the number of leaf nodes contained in the subtree, according to the formula (9), for the surface error rate gain value α of each non-leaf node in the classification regression tree, we have

Figure 3 is a schematic structural diagram of an abnormal behavior user identification device according to an embodiment of the present invention. As shown in Figure 3, this embodiment provides an abnormal behavior user identification device, including a network information acquisition unit 1, a judgment unit 2, and a user information acquisition unit 3 and identification unit 4, wherein:

The network information obtaining unit 1 is used to obtain the state information of the current network, and the state information includes: the whole network speed, the network element speed and the service flow value; t and observation time i, to determine whether there is an abnormal behavior user in the current network; the user information acquisition unit 3 is used to obtain the session record information of the user to be identified and the user terminal information to be identified if there is a user with abnormal behavior in the current network The identifying unit 4 is configured to identify the user with abnormal behavior according to the session record information and the user terminal information.

Specifically, the network information acquisition unit 1 is used to acquire the status information of the current network, and the status information includes: the whole network rate, the network element rate and the service flow value, and the network information acquisition unit 1 sends the status information to the judgment unit 2, and judges Unit 2 is used to judge whether there are users with abnormal behavior in the current network according to the state information of the current network, the preset time interval t and the observation time i, and the judgment unit 2 sends the judgment result of the user with abnormal behavior to the user information acquisition unit 3. The user information acquisition unit 3 is used to acquire the session record information of the user to be identified and the user terminal information to be identified if there is an abnormal behavior user in the current network, and the user information acquisition unit 3 sends the session record information and the user terminal information The identification unit 4 is configured to identify the user with abnormal behavior according to the session record information and the user terminal information.

The abnormal behavior user identification device provided by the embodiment of the present invention ensures the stability of the current network rate by judging whether there are abnormal behavior users in the current network and identifying the abnormal behavior users.

On the basis of the above embodiments, the judging unit 2 is used for:

According to the overall network rate of the current network, the preset time interval t and the observation time i, it is judged whether the overall network rate of the current network is declining; Whether the network element rate of the current network is declining; if it is judged that the network element rate of the current network is in a declining state, then according to the size of the service flow value, select the first m service flow values in the service flow value as the waiting Select a service flow value; calculate the candidate service rate corresponding to the candidate service according to the preset time interval t and the candidate service flow value; determine whether the candidate service rate of the current network has declined; if If it is determined that the rate of the service to be selected on the current network is in a declining state, then it is determined that there are users with abnormal behavior in the current network.

Specifically, the judging unit 2 is used to judge whether the whole network speed of the current network drops according to the whole network speed of the current network, the preset time interval t and the observation time i; Judging that the entire network rate of the current network is in a declining state, then judging whether the network element rate of the current network is declining; the judging unit 2 is used to judge that the network element rate of the current network is in a declining state, then According to the size of the service flow value, select the first m service flow values in the service flow value as the service flow value to be selected; the judgment unit 2 is used to The traffic value is used to calculate the rate of the service to be selected corresponding to the service to be selected; the judging unit 2 is used to judge whether the rate of the service to be selected in the current network has declined; the judging unit 2 is used to determine whether the current If the service rate of the network to be selected is in a declining state, it is determined that there are users with abnormal behavior in the current network.

The device for identifying users with abnormal behaviors provided by the embodiments of the present invention can accurately identify whether there are users with abnormal behaviors in the current network by judging whether the overall network rate, network element rate, and candidate service rate of the current network have decreased.

On the basis of the above embodiments, the judging unit 2 is also used for:

According to the service rate to be selected and the number m of service flows to be selected, calculate the average value of the service rate to be selected; according to the average value of the service rate to be selected The average value of the service rate V _ij to be selected and the network element rate If passed the formula If the calculation result is 1, it is judged that the service rate to be selected in the current network is in a declining state.

Specifically, the judgment unit 2 is also used to calculate the average value of the service rate to be selected according to the service rate to be selected and the number m of service flows to be selected; average value The average value of the service rate V _ij to be selected and the network element rate If passed the formula If the calculation result is 1, it is judged that the service rate to be selected in the current network is in a declining state.

The abnormal behavior user identification device provided by the embodiment of the present invention ensures the accuracy of judging that the rate of the service to be selected is in a declining state according to the calculated average value of the rate of the service to be selected and the rate of the network element.

On the basis of the above-mentioned embodiments, the identification unit 4 is used for:

According to the number of visits to a specific domain name in the session record information, identify the user whose visits to the specific domain name is greater than a first visits threshold as an abnormal user; identify the number of visits to the specific domain name to be less than the first visits threshold The user to be identified is taken as the first user to be identified; the mobile phone number of the first user to be identified is extracted, and if the number of visits to the specific domain name by the same mobile phone number is greater than the second threshold of visit times, the first user to be identified will be Identifying the user as an abnormal user, wherein the second visit times threshold is less than the first visit times threshold; the first user to be identified who visits the specific domain name with the same mobile phone number less than the second visit times threshold As the second user to be identified; extract the mobile phone terminal information of the second user to be identified, the mobile terminal information includes: mobile phone terminal manufacturer and model; If the number of visits to a specific domain name is greater than the third threshold of visits, the second user to be identified is identified as an abnormal user, wherein the third threshold of visits is less than the second threshold of visits; The second user to be identified whose number of visits to the specific domain name by the mobile phone terminal of the same model is less than the third access times threshold is taken as the third user to be identified; the location information of the mobile phone terminal of the third user to be identified is extracted, if If the displacement variation of the position of the mobile phone terminal within the preset time interval t is smaller than a preset distance threshold, the third user to be identified is identified as an abnormal user.

Specifically, the identification unit 4 is used to identify the user to be identified whose number of visits to a specific domain name is greater than the first visit times threshold as an abnormal user according to the number of visits to a specific domain name in the session record information; the identification unit 4 is used to The user to be identified whose number of visits to the specific domain name is less than the threshold of the first number of visits is taken as the first user to be identified; the identification unit 4 is used to extract the mobile phone number of the first user to be identified, if the same mobile phone number has If the number of visits to a specific domain name is greater than the second threshold of visits, the first user to be identified is identified as an abnormal user, wherein the second threshold of visits is smaller than the first threshold of visits; the identification unit 4 is used to identify the same The first user to be identified whose mobile phone number visits the specific domain name is less than the second access times threshold is used as the second user to be identified; the identification unit 4 is used to extract the mobile phone terminal information of the second user to be identified, the The mobile phone terminal information includes: mobile phone terminal manufacturer and model; identification unit 4 is used for if the mobile phone terminal of the same described mobile phone terminal manufacturer and model visits the specific domain name more than the third visit times threshold, then the second The user to be identified is identified as an abnormal user, wherein the third visit times threshold is less than the second visit times threshold; the identification unit 4 is used to identify the mobile terminal of the same mobile phone terminal manufacturer and model for the specific domain name The second user to be identified whose number of visits is less than the threshold of the third number of visits is used as the third user to be identified; the identification unit 4 is used to extract the location information of the mobile phone terminal of the third user to be identified, if the location of the mobile phone terminal is within If the displacement variation generated within the preset time interval t is smaller than a preset distance threshold, the third user to be identified is identified as an abnormal user.

The abnormal behavior user identification device provided by the embodiment of the present invention ensures the accuracy of the identification effect by successively identifying abnormal behavior users.

The abnormal behavior user identification device provided in this embodiment can be specifically used to execute the processing procedures of the above-mentioned method embodiments, and its functions will not be described in detail here, and reference can be made to the detailed description of the above-mentioned method embodiments.

FIG. 4 is a schematic diagram of the physical structure of the device provided by the embodiment of the present invention. As shown in FIG. 4 , the neighboring cell optimization processing device includes: a processor (processor) 401, a memory (memory) 402, and a bus 403;

Wherein, the processor 401 and the memory 402 complete mutual communication through the bus 403;

The processor 401 is used to call the program instructions in the memory 402 to execute the methods provided by the above method embodiments, for example, including: the overall network rate, network element rate and service flow value; according to the current network State information, preset time interval t and observation time i, to determine whether there are users with abnormal behaviors in the current network; if there are users with abnormal behaviors in the current network, then obtain the session record information of the user to be identified and the terminal information of the user to be identified ; Identifying the abnormal behavior user according to the session record information and the user terminal information.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by the computer, the computer The methods provided by the above-mentioned method embodiments can be executed, for example, including: the overall network rate, the network element rate and the service flow value; according to the state information of the current network, the preset time interval t and the observation time i, determine the current Whether there is an abnormal behavior user in the network; if there is an abnormal behavior user in the current network, then obtain the session record information of the user to be identified and the user terminal information to be identified; according to the session record information and the user terminal information, the Abnormal behavior users are identified.

This embodiment provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided in the above method embodiments, for example, including : the overall network rate, network element rate and service flow value; according to the state information of the current network, the preset time interval t and the observation time i, determine whether there is an abnormal behavior user in the current network; if there is an abnormality in the current network Behavioral users, obtain the session record information of the user to be identified and the user terminal information to be identified; identify the user with abnormal behavior according to the session record information and the user terminal information.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

The above-described embodiments such as the abnormal behavior user identification device are only illustrative, and the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physically separated. A unit can be located in one place, or it can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, not to limit them; although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, those skilled in the art The skilled person should understand that: it is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the present invention The scope of the technical solution of each embodiment of the embodiment.

Claims (10)

1. a kind of abnormal behaviour user identification method, which is characterized in that including：

The status information of current network is obtained, the status information includes：The whole network rate, network element rate and Business Stream magnitude；

According to the status information of the current network, prefixed time interval t and observing time i, whether the current network is judged There are abnormal behaviour users；

If the current network obtains user conversation record information to be identified and the use to be identified there are abnormal behaviour user Family end message；

According to the conversation recording information and the user terminal information, the abnormal behaviour user is identified.

It is 2. according to the method described in claim 1, it is characterized in that, the status information according to the current network, default Time interval t and observing time i judges that the current network whether there is abnormal behaviour user, including：

According to the whole network rate of the current network, prefixed time interval t and observing time i, the complete of the current network is judged Whether network speed rate declines；

If judging to know the whole network rate of the current network as decline state, judging the network element rate of the current network is No decline；

If judging to know the network element rate of the current network as decline state, according to the size of the Business Stream magnitude, choosing Preceding m Business Stream magnitude is selected in the Business Stream magnitude as Business Stream magnitude to be selected；

According to the prefixed time interval t and the Business Stream magnitude to be selected, the industry to be selected corresponding to the business to be selected is calculated Business rate；

Judge whether the service rate to be selected of the current network declines；

If judging to know the service rate to be selected of the current network as decline state, it is abnormal to judge that the current network exists Behavior user.

It is 3. according to the method described in claim 2, it is characterized in that, the whole network rate according to the current network, default Time interval t and observing time i, judges whether the whole network rate of the current network declines, including：

According to prefixed time interval t and observing time i, the number of observation n in the prefixed time interval t is obtained, wherein, institute Observing time i is stated to be located between the initial time corresponding to the prefixed time interval t and termination time；

According to the number of observation n and the whole network rate of the current network, the whole network speed in the prefixed time interval t is calculated The average value of rate；

According to the average value of the whole network rate and the whole network rate of the current network, the whole network for calculating the current network is fast Rate declines percentage；

If the whole network rate of the current network, which declines percentage, is more than or equal to default the whole network rate percentage, described work as is judged The whole network rate of preceding network is decline state.

4. according to the method described in claim 2, it is characterized in that, described, judge the current network network element rate whether Decline, including：

According to the number of observation n and the network element rate of the current network, the network element speed in the prefixed time interval t is calculated The average value of rate；

According to the average value of the network element rate and the network element rate of the current network, the network element for calculating the current network is fast Rate declines percentage；

If the network element rate of the current network, which declines percentage, is more than or equal to default network element rate percentage, described work as is judged The network element rate of preceding network is decline state.

5. according to the method described in claim 2, it is characterized in that, the service rate to be selected of the judgement current network is No decline, including：

According to the service rate to be selected and service traffics number m to be selected, the average value of the calculating service rate to be selected；

According to the average value of the service rate to be selectedThe service rate V to be selected_ijWith the average value of the network element rateIf pass through formulaThe result of calculating is 1, then judges the to be selected of the current network Service rate is decline state.

It is 6. according to the method described in claim 1, it is characterized in that, described whole according to the conversation recording information and the user The abnormal behaviour user is identified in client information, including：

According to the certain domain name access times in the conversation recording information, the certain domain name access times are more than first and are visited The user identifier to be identified for asking frequency threshold value is abnormal user；

The user to be identified that the certain domain name access times are less than to the first access times threshold value is to be identified as first User；

The phone number of the described first user to be identified is extracted, if same phone number is more than the certain domain name access times Described first user identifier to be identified is then abnormal user by the second access times threshold value, wherein, the second access times threshold Value is less than the first access times threshold value；

Same phone number is less than the described first to be identified of the second access times threshold value to the certain domain name access times User is as the second user to be identified；

The information of mobile phone terminal of the described second user to be identified is extracted, the information of mobile phone terminal includes：Mobile phone terminal producer and Model；

If the mobile phone terminal of the identical mobile phone terminal producer and model is more than the 3rd to the certain domain name access times Described second user identifier to be identified is then abnormal user by access times threshold value, wherein, the 3rd access times threshold value is small In the second access times threshold value；

The mobile phone terminal of the identical mobile phone terminal producer and model is less than the 3rd to the certain domain name access times Described second user to be identified of access times threshold value is as the 3rd user to be identified；

The location information of the 3rd user mobile phone terminal to be identified is extracted, if the position of the mobile phone terminal is when described default Between be spaced the displacement variable generated in t and be less than pre-determined distance threshold value, then be abnormal use by the 3rd user identifier to be identified Family.

7. a kind of abnormal behaviour customer identification device, which is characterized in that including：

Network information acquiring unit, for obtaining the status information of current network, the status information includes：The whole network rate, net First rate and Business Stream magnitude；

Judging unit, for status information, prefixed time interval t and the observing time i according to the current network, described in judgement Current network whether there is abnormal behaviour user；

User information acquiring unit, if obtaining user conversation to be identified there are abnormal behaviour user for the current network Record information and the user terminal information to be identified；

Recognition unit, for according to the conversation recording information and the user terminal information, to the abnormal behaviour user into Row identification.

8. device according to claim 7, which is characterized in that the judging unit is used for：

According to the whole network rate of the current network, prefixed time interval t and observing time i, the complete of the current network is judged Whether network speed rate declines；

If judging to know the whole network rate of the current network as decline state, judging the network element rate of the current network is No decline；

If judging to know the network element rate of the current network as decline state, according to the size of the Business Stream magnitude, choosing Preceding m Business Stream magnitude is selected in the Business Stream magnitude as Business Stream magnitude to be selected；

According to the prefixed time interval t and the Business Stream magnitude to be selected, the industry to be selected corresponding to the business to be selected is calculated Business rate；

Judge whether the service rate to be selected of the current network declines；

If judging to know the service rate to be selected of the current network as decline state, it is abnormal to judge that the current network exists Behavior user.

9. device according to claim 8, which is characterized in that the judging unit is additionally operable to：

According to the service rate to be selected and service traffics number m to be selected, the average value of the calculating service rate to be selected；

According to the average value of the service rate to be selectedThe service rate V to be selected_ijWith the average value of the network element rateIf pass through formulaThe result of calculating is 1, then judges the to be selected of the current network Service rate is decline state.

10. device according to claim 7, which is characterized in that the recognition unit is used for：

According to the certain domain name access times in the conversation recording information, the certain domain name access times are more than first and are visited The user identifier to be identified for asking frequency threshold value is abnormal user；

The user to be identified that the certain domain name access times are less than to the first access times threshold value is to be identified as first User；

The phone number of the described first user to be identified is extracted, if same phone number is more than the certain domain name access times Described first user identifier to be identified is then abnormal user by the second access times threshold value, wherein, the second access times threshold Value is less than the first access times threshold value；

Same phone number is less than the described first to be identified of the second access times threshold value to the certain domain name access times User is as the second user to be identified；

The information of mobile phone terminal of the described second user to be identified is extracted, the information of mobile phone terminal includes：Mobile phone terminal producer and Model；

If the mobile phone terminal of the identical mobile phone terminal producer and model is more than the 3rd to the certain domain name access times Described second user identifier to be identified is then abnormal user by access times threshold value, wherein, the 3rd access times threshold value is small In the second access times threshold value；

The mobile phone terminal of the identical mobile phone terminal producer and model is less than the 3rd to the certain domain name access times Described second user to be identified of access times threshold value is as the 3rd user to be identified；

The location information of the 3rd user mobile phone terminal to be identified is extracted, if the position of the mobile phone terminal is when described default Between be spaced the displacement variable generated in t and be less than pre-determined distance threshold value, then be abnormal use by the 3rd user identifier to be identified Family.