CN116701914B - Hardware equipment abnormal use identification method, device, storage device and system - Google Patents
Hardware equipment abnormal use identification method, device, storage device and system Download PDFInfo
- Publication number
- CN116701914B CN116701914B CN202310740084.1A CN202310740084A CN116701914B CN 116701914 B CN116701914 B CN 116701914B CN 202310740084 A CN202310740084 A CN 202310740084A CN 116701914 B CN116701914 B CN 116701914B
- Authority
- CN
- China
- Prior art keywords
- equipment
- hardware
- sampling
- risk
- abnormal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 180
- 238000000034 method Methods 0.000 title claims abstract description 60
- 238000005070 sampling Methods 0.000 claims abstract description 180
- 230000005856 abnormality Effects 0.000 claims abstract description 18
- 238000004590 computer program Methods 0.000 claims description 19
- 238000012216 screening Methods 0.000 claims description 17
- 238000013500 data storage Methods 0.000 claims description 16
- 238000007726 management method Methods 0.000 claims description 14
- 238000012544 monitoring process Methods 0.000 claims description 7
- 238000000605 extraction Methods 0.000 claims description 6
- 238000005086 pumping Methods 0.000 claims description 3
- 230000008569 process Effects 0.000 abstract description 5
- 238000001514 detection method Methods 0.000 abstract description 2
- 230000006872 improvement Effects 0.000 description 13
- 238000004891 communication Methods 0.000 description 5
- 230000006870 function Effects 0.000 description 5
- 238000005406 washing Methods 0.000 description 4
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000007619 statistical method Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/213—Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
- G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- G16Y10/00—Economic sectors
- G16Y10/75—Information technology; Communication
-
- G—PHYSICS
- G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
- G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- G16Y30/00—IoT infrastructure
- G16Y30/10—Security thereof
-
- G—PHYSICS
- G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
- G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- G16Y40/00—IoT characterised by the purpose of the information processing
- G16Y40/10—Detection; Monitoring
-
- G—PHYSICS
- G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
- G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- G16Y40/00—IoT characterised by the purpose of the information processing
- G16Y40/20—Analytics; Diagnosis
-
- G—PHYSICS
- G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
- G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- G16Y40/00—IoT characterised by the purpose of the information processing
- G16Y40/50—Safety; Security of things, users, data or systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Life Sciences & Earth Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Pure & Applied Mathematics (AREA)
- Databases & Information Systems (AREA)
- Mathematical Analysis (AREA)
- Mathematical Optimization (AREA)
- Computer Security & Cryptography (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Computational Mathematics (AREA)
- Mathematical Physics (AREA)
- Computational Linguistics (AREA)
- General Business, Economics & Management (AREA)
- Algebra (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Software Systems (AREA)
- Probability & Statistics with Applications (AREA)
- Operations Research (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- General Health & Medical Sciences (AREA)
- Debugging And Monitoring (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a hardware equipment abnormal use identification method, a device, a storage medium and a system, wherein sampling probability is distributed according to the attribute of hardware equipment to be identified, sampling detection is carried out to obtain an abnormal use identification result of the sampled hardware equipment, equipment associated with the sampled hardware equipment with abnormal use risk is further identified according to an equipment database, and after all risk hardware equipment is determined, corresponding wind control measures are adopted for the risk hardware equipment, so that the hardware equipment abnormal use identification efficiency is improved; furthermore, the hardware equipment to be identified which is determined to be the safety hardware equipment in the process of sampling abnormality identification and further abnormality identification is recorded for directly checking and confirming in a trusted time, so that the identification efficiency of abnormal use of the hardware equipment is further improved.
Description
Technical Field
The present invention relates to the field of hardware equipment abnormal usage recognition technology, and in particular, to a method, an apparatus, a computer readable storage medium and a system for recognizing abnormal usage of a hardware equipment.
Background
The communication hardware equipment can provide a 4G/WIFI and other network access modules, and the communication hardware equipment itself is communicated with the equipment board card in a pulse or serial port mode. Taking a baby machine as an example, the baby machine equipment does not have a networking function, through accessing a product of my department, an end user can pay and start the equipment by scanning a two-dimension code. The background server can issue a control instruction to the Internet of things equipment through the communication hardware equipment, so that the Internet of things equipment can be started. When the internet of things device is used as an abnormal approach, legal risks will result.
In the prior art, illegal use organizing merchants are typically only inspected and monitored through payment channels and purchase records.
However, the prior art still has the following defects: if the number of devices is large, the widespread wind control of the devices obviously creates a significant strain on the servers.
Accordingly, there is a need for a method, apparatus, computer-readable storage medium, and system for hardware device abnormal use identification that overcomes the above-described deficiencies in the prior art.
Disclosure of Invention
The embodiment of the invention provides a hardware equipment abnormal use identification method, a device, a computer readable storage medium and a system, thereby improving the identification efficiency of hardware equipment abnormal use.
An embodiment of the present invention provides a method for identifying abnormal use of a hardware device, where the method includes: acquiring attribute characteristics of hardware equipment to be identified, and distributing sampling probability for each hardware equipment to be identified according to the attribute characteristics; sampling and feature statistics are carried out on all hardware devices to be identified according to the distribution sampling probability and a preset sampling method, and one or more sampling hardware devices and corresponding sampling hardware device features are obtained; judging whether the sampling hardware equipment has abnormal use risks or not according to a preset abnormality identification method and the characteristics of the sampling hardware equipment, and obtaining all risk hardware equipment according to an equipment database and the sampling hardware equipment when the sampling hardware equipment has abnormal use risks; and according to a preset wind control management method, adopting corresponding wind control measures for the risk hardware equipment.
As an improvement of the above solution, the identification method further includes: according to the risk hardware device, the sampling hardware device and the first associated hardware device, obtaining a safety hardware device and a trusted time, and recording the device ID of the safety hardware device and the trusted time in a preset data storage area; and deleting the device ID exceeding the trusted time in the data storage area according to the current timestamp.
As an improvement of the above solution, the identification method further includes: content monitoring is carried out on a preset pneumatic mailbox; when the fact that the mail sent by the pneumatic mail is monitored, a first risk user ID is obtained from mail content of the pneumatic mail, and according to the first risk user ID, matching inquiry is carried out in a preset risk database to obtain a first risk equipment ID; and according to the first risk equipment ID and the wind control management method, corresponding wind control measures are adopted for the first risk equipment.
As an improvement of the above solution, according to a preset abnormality identification method and the characteristics of the sampling hardware device, the method for judging whether the sampling hardware device has an abnormal use risk specifically includes: acquiring a sampling equipment ID and equipment information of the sampling hardware equipment, and matching in the data storage area according to the sampling equipment ID; if the matching is successful, the sampling hardware equipment is determined to have no abnormal use risk; if the matching is unsuccessful, acquiring a corresponding statistical characteristic interval from a preset statistical characteristic database according to the equipment information; judging whether the characteristics of the sampling hardware equipment are abnormal characteristics or not according to the statistical characteristic interval, and acquiring the characteristic quantity of the abnormal characteristics; judging whether the feature quantity reaches an abnormal feature quantity threshold value or not; if not, the sampling hardware equipment is determined to have no abnormal use risk; and if so, recognizing that the sampling hardware equipment has abnormal use risks.
As an improvement of the above solution, determining whether the feature of the sampled hardware device is an abnormal feature according to the statistical feature interval specifically includes: judging whether the characteristics of the sampling hardware equipment exceed the corresponding statistical characteristic intervals; if the characteristic exceeds the characteristic, the characteristic of the sampling hardware equipment is an abnormal characteristic; otherwise, the sampled hardware device feature is not an outlier feature.
As an improvement of the above solution, determining whether the feature of the sampled hardware device is an abnormal feature according to the statistical feature interval specifically includes: judging whether the use interval exceeds the use interval or not, and recognizing the use interval as an abnormal characteristic when the use interval exceeds the use interval; judging whether the single consumption price exceeds a single consumption price interval, and recognizing the single consumption price as an abnormal characteristic when the single consumption price exceeds the single consumption price interval; and calculating the coincidence time length of the busy time interval and the busy time interval, judging whether the proportion of the coincidence time length to the busy time interval is lower than a preset proportion threshold value, and recognizing the using time interval as an abnormal characteristic when the proportion threshold value is lower than the preset proportion threshold value.
As an improvement of the above solution, obtaining a risk hardware device according to the device database and the sampling hardware device, specifically includes: inquiring a first associated hardware device associated with the sampling hardware device in a preset device database; judging whether the first associated hardware equipment has abnormal use risks or not; and outputting the first associated hardware device with the abnormal use risk as a risk hardware device.
As an improvement of the above solution, the attribute features include flow and area.
The invention further provides a hardware equipment abnormal use identification device correspondingly, the identification device comprises a probability distribution unit, a sampling extraction unit, a risk screening unit and a wind control execution unit, wherein the probability distribution unit is used for acquiring attribute characteristics of hardware equipment to be identified and distributing sampling probability for each hardware equipment to be identified according to the attribute characteristics; the sampling extraction unit is used for sampling and counting the characteristics of all hardware devices to be identified according to the distribution sampling probability and a preset sampling method to obtain one or more sampling hardware devices and the characteristics of the corresponding sampling hardware devices; the risk screening unit is used for judging whether the sampling hardware equipment has abnormal use risks or not according to a preset abnormality identification method and the characteristics of the sampling hardware equipment, and obtaining all risk hardware equipment according to an equipment database and the sampling hardware equipment when the sampling hardware equipment has abnormal use risks; the wind control execution unit is used for taking corresponding wind control measures for the risk hardware equipment according to a preset wind control management method.
As an improvement of the above, the identifying device further includes a trusted recording unit for: according to the risk hardware device, the sampling hardware device and the first associated hardware device, obtaining a safety hardware device and a trusted time, and recording the device ID of the safety hardware device and the trusted time in a preset data storage area; and deleting the device ID exceeding the trusted time in the data storage area according to the current timestamp.
As an improvement of the above solution, the identification device further includes an air control triggering unit, and the air control triggering unit is used for: content monitoring is carried out on a preset pneumatic mailbox; when the fact that the mail sent by the pneumatic mail is monitored, a first risk user ID is obtained from mail content of the pneumatic mail, and according to the first risk user ID, matching inquiry is carried out in a preset risk database to obtain a first risk equipment ID; and according to the first risk equipment ID and the wind control management method, corresponding wind control measures are adopted for the first risk equipment.
As an improvement to the above, the risk screening unit is further configured to: acquiring a sampling equipment ID and equipment information of the sampling hardware equipment, and matching in the data storage area according to the sampling equipment ID; if the matching is successful, the sampling hardware equipment is determined to have no abnormal use risk; if the matching is unsuccessful, acquiring a corresponding statistical characteristic interval from a preset statistical characteristic database according to the equipment information; judging whether the characteristics of the sampling hardware equipment are abnormal characteristics or not according to the statistical characteristic interval, and acquiring the characteristic quantity of the abnormal characteristics; judging whether the feature quantity reaches an abnormal feature quantity threshold value or not; if not, the sampling hardware equipment is determined to have no abnormal use risk; and if so, recognizing that the sampling hardware equipment has abnormal use risks.
As an improvement to the above, the risk screening unit is further configured to: judging whether the characteristics of the sampling hardware equipment exceed the corresponding statistical characteristic intervals; if the characteristic exceeds the characteristic, the characteristic of the sampling hardware equipment is an abnormal characteristic; otherwise, the sampled hardware device feature is not an outlier feature.
As an improvement to the above, the risk screening unit is further configured to: judging whether the use interval exceeds the use interval or not, and recognizing the use interval as an abnormal characteristic when the use interval exceeds the use interval; judging whether the single consumption price exceeds a single consumption price interval, and recognizing the single consumption price as an abnormal characteristic when the single consumption price exceeds the single consumption price interval; and calculating the coincidence time length of the busy time interval and the busy time interval, judging whether the proportion of the coincidence time length to the busy time interval is lower than a preset proportion threshold value, and recognizing the using time interval as an abnormal characteristic when the proportion threshold value is lower than the preset proportion threshold value.
As a modification of the above scheme, the preset ratio threshold is 30%.
As an improvement to the above, the risk screening unit is further configured to: inquiring a first associated hardware device associated with the sampling hardware device in a preset device database; judging whether the first associated hardware equipment has abnormal use risks or not; and outputting the first associated hardware device with the abnormal use risk as a risk hardware device.
Another embodiment of the present invention provides a computer readable storage medium, where the computer readable storage medium includes a stored computer program, and when the computer program runs, controls a device where the computer readable storage medium is located to execute a method for identifying abnormal usage of a hardware device as described above.
Another embodiment of the present invention provides a hardware device abnormal use identification system, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor implementing the hardware device abnormal use identification method as described above when executing the computer program.
Compared with the prior art, the technical scheme has the following beneficial effects:
The invention provides a hardware equipment abnormal use identification method, a device, a computer readable storage medium and a system.
Furthermore, the hardware equipment to be identified which is determined to be the safety hardware equipment in the sampling abnormality identification and further abnormality identification processes is recorded for directly checking and confirming in a trusted time, so that the identification efficiency of the abnormal use of the hardware equipment is further improved.
Drawings
FIG. 1 is a flowchart illustrating a method for identifying abnormal use of a hardware device according to an embodiment of the present invention;
FIG. 2 is a flowchart illustrating a method for identifying abnormal use of a hardware device according to an embodiment of the present invention;
Fig. 3 is a schematic structural diagram of a hardware device abnormal use recognition device according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Detailed description of the preferred embodiments
The embodiment of the invention firstly describes a hardware equipment abnormal use identification method. FIG. 1 is a flowchart illustrating a method for identifying abnormal use of a hardware device according to an embodiment of the present invention; fig. 2 is a flowchart of a method for identifying abnormal use of a hardware device according to an embodiment of the present invention.
As shown in fig. 1, the method for identifying abnormal use of a hardware device includes:
And S1, acquiring attribute characteristics of hardware equipment to be identified, and distributing sampling probability for each hardware equipment to be identified according to the attribute characteristics.
In order to improve the efficiency of anomaly identification and avoid huge calculation load caused by carrying out universal wind control analysis on all the equipment to be recorded, in practical application, when anomaly identification is needed, sampling probability is distributed to the equipment according to the flow of the equipment; the equipment with larger flow has larger pumping probability; or sampling according to the area where the device is located, for example, the probability that the device is pumped out in suburban areas is larger than the probability that the device is pumped out in urban centers; for sets requiring higher sampling probabilities, a higher proportion of samples are extracted, and for sets of lower sampling probabilities, a lower proportion is extracted.
In one embodiment, the attribute features include, but are not limited to, flow and area. Taking the flow and the area as statistical characteristics as examples, since the purpose of sampling is to carry out anomaly identification as efficiently as possible, a higher requirement is put forward on the characteristic of anomaly risk of the attribute characteristics, and under the actual use scene, the flow is an important factor for representing whether the operation condition is abnormal in the corresponding scene, and on the basis, the characteristic of the area can further limit the use scene of the hardware equipment to be identified, so that the abnormal use condition of the equipment can be represented to a larger extent through the two attribute characteristics of the flow and the area.
Based on the positioning information of the equipment, the equipment can be divided into business circles, non-business circles and suburban areas according to the area where the equipment is located; the area-to-flow relationship is that the pointer can set different flow thresholds (using times thresholds) for the three areas, so as to judge whether the equipment needs to adjust up or down sampling probability by judging whether the flow attribute and the area attribute of each equipment accord with the normal corresponding relationship. For example, equipment in suburban areas has a large flow rate and may be abnormal. The threshold value may be set at this time according to the flow average of the devices of different classifications, for example, the threshold value is set to 200% average. The area may be further subdivided in addition to the above-described division, for example, schools, hospitals, shops, etc. The determination mode of the area can be determined by comparing the geographic position reported by the equipment with map information.
In order to further improve the efficiency of anomaly identification, the embodiment records after the normal device is identified by sampling, and in the next preset time period, the recorded device is not repeatedly identified, specifically, a table is maintained while data is acquired and sampled, after each sampling, the normal device is written into the table, each data in the table only has the preset time period (for example, 1 month), when the sampling is pumped to a certain device, the device ID of the certain device is firstly searched in the maintained table, if the device is searched, wind control statistics is not executed on the device, so that unnecessary calculation load caused by repeated identification is avoided.
That is, in one embodiment, the identification method further comprises: according to the risk hardware device, the sampling hardware device and the first associated hardware device, obtaining a safety hardware device and a trusted time, and recording the device ID of the safety hardware device and the trusted time in a preset data storage area; and deleting the device ID exceeding the trusted time in the data storage area according to the current timestamp.
And S2, sampling and feature statistics are carried out on all hardware devices to be identified according to the distribution sampling probability and a preset sampling method, and one or more sampling hardware devices and corresponding sampling hardware device features are obtained.
It is to be understood that sampling hardware device features include, but are not limited to: the usage interval, the single consumption price and the usage period (the usage period comprises an idle period and a busy period), and the characteristics of the sampling hardware device are used for directly characterizing the abnormal usage of the device.
The usage interval refers to the shortest interval between two starts of the device, or the time from the start to the end of the device; in the practical application scene, the interval can be set by investigating the normal use interval set by normal equipment and also can be set by counting the average characteristics of the online equipment.
The single consumption price refers to the deducted cost of a single start-up device. For example, a doll machine may require 2 coins to be inserted once, each coin corresponding to 1 yuan, and a single start is 2 yuan. For an abnormal device, 10 coins may be required at a time, each coin being 5 yuan, corresponding to a single consumption of 50.
The use period refers to that 24 hours of a day can be divided when the device is used, for example, for a baby machine, 9 am to 9 pm can be divided into busy periods, and 9 pm to 9 am can be divided into idle periods.
S3, judging whether the sampling hardware equipment has abnormal use risks or not according to a preset abnormality identification method and the characteristics of the sampling hardware equipment, and obtaining all risk hardware equipment according to an equipment database and the sampling hardware equipment when the sampling hardware equipment has abnormal use risks.
On the basis of sampling identification to improve the equipment abnormality identification efficiency, in order to further improve the equipment abnormality identification efficiency, after each sampling confirms that one sampling hardware equipment has no abnormality use risk, recording the equipment ID of the hardware equipment, and keeping a certain time (such as a week or a month, and specifically setting the equipment ID), and during each subsequent detection, firstly, inquiring whether the equipment ID which can be matched with the hardware equipment to be identified exists in the record, thereby avoiding repeated identification. Specifically, in one embodiment, according to a preset abnormality identification method and the characteristics of the sampling hardware device, determining whether the sampling hardware device has an abnormal usage risk includes: acquiring a sampling equipment ID and equipment information of the sampling hardware equipment, and matching in the data storage area according to the sampling equipment ID; if the matching is successful, the sampling hardware equipment is determined to have no abnormal use risk; if the matching is unsuccessful, acquiring a corresponding statistical characteristic interval from a preset statistical characteristic database according to the equipment information; judging whether the characteristics of the sampling hardware equipment are abnormal characteristics or not according to the statistical characteristic interval, and acquiring the characteristic quantity of the abnormal characteristics; judging whether the feature quantity reaches an abnormal feature quantity threshold value or not; if not, the sampling hardware equipment is determined to have no abnormal use risk; and if so, recognizing that the sampling hardware equipment has abnormal use risks.
Wherein the statistical characteristic interval includes, but is not limited to, a usage interval, a single consumption price interval, and a busy period interval; in the practical application scenario, the reference interval included in the statistical characteristic interval is used for comparing and judging with the characteristics of the sampling hardware equipment, so that the reference interval included in the statistical characteristic interval corresponds to the characteristics of the sampling hardware equipment.
In one embodiment, determining whether the sampled hardware device feature is an abnormal feature according to the statistical feature interval specifically includes: judging whether the characteristics of the sampling hardware equipment exceed the corresponding statistical characteristic intervals; if the characteristic exceeds the characteristic, the characteristic of the sampling hardware equipment is an abnormal characteristic; otherwise, the sampled hardware device feature is not an outlier feature.
Specifically, the abnormal use interval which is inconsistent with the use scene of the recording device can characterize the abnormal use condition of the hardware device to be identified to a certain extent.
For example, for a doll machine, the start-up interval is at least greater than 15s. Because the doll machine has a minimum time from start-up to end, the statistical interval of the usage interval is greater than 15s. If the device registered as a doll machine is used for a period of time less than 15s, it may be abnormal. Of course, this usage interval may also be defined as the time of single usage of the device, for example, the device will report information to the server at both start-up and end, and then the start and end times are the time of single usage of the device. For example, a typical use time for a doll machine is a characteristic section of 15 seconds or so, and 60 seconds or so, 15 to 60 seconds or so.
As another example, the use time of the shared washing machine may be varied from 10 minutes to 90 minutes. If a device registered as a washing machine is used for only 1 minute each time, it is obvious that there is an abnormality; further, if the service time of the washing machine is 3 hours, it may also indicate that it is not properly installed on the washing machine, but is used elsewhere, that is, when the service time of the device is out of the range of the generally counted intervals, that is, it is considered that the device may have a risk of abnormal use that the embodiment intends to recognize.
The abnormal consumption amount can also characterize the abnormal use condition of the hardware equipment to be identified, and the abnormal single consumption price of the hardware equipment to be identified using the abnormality can be compared with the normal price. The embodiment characterizes the consumption characteristics of the hardware equipment to be identified through single consumption price.
In addition to the usage interval and the consumption amount, the usage period is also one of the characterizations of whether the hardware device to be identified is abnormally used or not. If the usage time of the device is concentrated in idle periods, it is interpreted as abnormal. The division of the usage period is based on statistics of the operational data of the existing common equipment. The specific division manner may be to divide the corresponding time into the idle period and the busy period according to the average number of times of use of the plurality of devices per hour.
In practical application, the busy periods of all devices with the same device type can be counted firstly, and then, the busy periods of the hardware devices to be identified are counted; and judging whether the busy time periods of the two are coincident or not, if not, obviously operating the hardware equipment to be identified in a high frequency mode in the time period of not being busy, and indicating that the hardware equipment to be identified is abnormal.
The busy periods of the hardware equipment to be identified are partially overlapped with the busy periods of all the equipment with the same equipment type obtained through statistics, but the ratio of the overlapped periods to the total busy periods is still lower than a preset threshold value, and the hardware equipment to be identified is considered to have abnormal use under the actual application scene. That is, in one embodiment, determining whether the sampled hardware device feature is an abnormal feature according to the statistical feature interval specifically includes: judging whether the use interval exceeds the use interval or not, and recognizing the use interval as an abnormal characteristic when the use interval exceeds the use interval; judging whether the single consumption price exceeds a single consumption price interval, and recognizing the single consumption price as an abnormal characteristic when the single consumption price exceeds the single consumption price interval; and calculating the coincidence time length of the busy time interval and the busy time interval, judging whether the proportion of the coincidence time length to the busy time interval is lower than a preset proportion threshold value, and recognizing the using time interval as an abnormal characteristic when the proportion threshold value is lower than the preset proportion threshold value. In one embodiment, the preset ratio threshold is 30%.
Because merchants who use equipment abnormally often arrange more than one equipment or one area, in order to improve recognition efficiency, comprehensive statistical analysis can be performed on the same place (one merchant can divide the equipment into different places for convenient management, and the place can be understood as a set of equipment set by the merchant) and equipment under the same merchant name after finding that one equipment is abnormal. It will be appreciated that the above operation aims at discovering more associated devices by one device, which in fact belongs to a precisely controlled manner, and more abnormal devices can be detected without continuing the comprehensive investigation.
Specifically, in one embodiment, obtaining the risk hardware device according to the device database and the sampling hardware device specifically includes: inquiring a first associated hardware device associated with the sampling hardware device in a preset device database; judging whether the first associated hardware equipment has abnormal use risks or not; and outputting the first associated hardware device with the abnormal use risk as a risk hardware device.
S4, adopting corresponding wind control measures for the risk hardware equipment according to a preset wind control management method.
Configuring a wind control mailbox for receiving the payment channel mail, and monitoring mail content of the wind control mailbox; when the wind control mail sent by the wind control mailbox is monitored, matching the equipment ID in the database according to the user ID information returned by the wind control channel; and carrying out wind control statistics according to the matched equipment ID.
As shown in fig. 2, sampling is performed according to the attribute characteristics of the device, and whether the normal device is sampled in a short period of time is judged; if the equipment is the normal equipment sampled in a short period, judging the risk of the next equipment; if the device is not the normal device sampled in a short period, judging whether the sampled device is normal; if the sampled equipment is abnormal, entering a wind control flow; if the sampled device is normal, a normal device list is written (the record is deleted at a set time).
When the wind control is triggered, monitoring mails of the payment channel, and judging whether the wind control mails are the wind control mails or not from the mail body of the payment channel; if the mail is not the wind control mail, ending the wind control flow; if the mail is the wind control mail, reading the account ID of the wind control in the mail text content, inquiring the corresponding equipment/merchant according to the account ID, and judging whether the equipment/merchant is the equipment or the merchant; if the equipment is a merchant, continuing wind control design on the associated equipment according to the place of the equipment or the merchant of the equipment, taking wind control measures on the equipment with abnormal wind control, and ending wind control after the merchant complaints; if the equipment is the equipment, judging whether the equipment to be sampled is normal or not; if the sampled equipment is normal, writing a normal equipment list; if the sampled equipment is abnormal, entering a wind control flow.
In one embodiment, the identification method further comprises: content monitoring is carried out on a preset pneumatic mailbox; when the fact that the mail sent by the pneumatic mail is monitored, a first risk user ID is obtained from mail content of the pneumatic mail, and according to the first risk user ID, matching inquiry is carried out in a preset risk database to obtain a first risk equipment ID; and according to the first risk equipment ID and the wind control management method, corresponding wind control measures are adopted for the first risk equipment.
Based on the sampling identification and the association identification, in order to quickly and efficiently suppress abnormal use of hardware equipment to be identified, the embodiment directly carries out comprehensive wind control on specific risk merchants under certain conditions. Specifically, in one embodiment, the identification method further includes: acquiring the total number of all the risk hardware devices and first merchant accounts to which each risk hardware device belongs, and counting the number of the risk hardware devices held by each first merchant account; calculating the risk equipment duty ratio of each first merchant account according to the number of the risk hardware equipment and the total number; judging whether the proportion of the risk equipment reaches a preset comprehensive wind control threshold or not, and taking wind control measures for all hardware equipment to be identified held by a first merchant account of which the proportion of the risk equipment reaches the comprehensive wind control threshold.
The embodiment of the invention describes a hardware equipment abnormal use identification method, which comprises the steps of distributing sampling probability according to the attribute of hardware equipment to be identified, carrying out sampling abnormal recognition to obtain an abnormal use identification result of sampling hardware equipment, carrying out further abnormal recognition on equipment associated with the sampling hardware equipment with abnormal use risk according to an equipment database, and after all risk hardware equipment is determined, adopting corresponding wind control measures on the risk hardware equipment; furthermore, the hardware equipment abnormal use identification method described in the embodiment of the invention further records the hardware equipment to be identified which is determined to be the safety hardware equipment in the sampling abnormal identification and further abnormal identification process for directly checking and confirming in a table in a trusted time, so that the identification efficiency of the hardware equipment abnormal use is further improved.
Second embodiment
In addition to the method, the embodiment of the invention also discloses a device for identifying abnormal use of the hardware equipment. Fig. 3 is a schematic structural diagram of a hardware device abnormal use recognition device according to an embodiment of the present invention.
As shown in fig. 3, the recognition device includes a probability distribution unit 11, a sampling extraction unit 12, a risk screening unit 13, and an air control execution unit 14.
The probability distribution unit 11 is configured to obtain attribute characteristics of hardware devices to be identified, and distribute sampling probability to each hardware device to be identified according to the attribute characteristics.
The sampling extraction unit 12 is configured to sample and perform feature statistics on all hardware devices to be identified according to the distributed sampling probability and a preset sampling method, so as to obtain one or more sampling hardware devices and corresponding sampling hardware device features.
The risk screening unit 13 is configured to determine whether the sampling hardware device has an abnormal use risk according to a preset abnormality identification method and the characteristics of the sampling hardware device, and obtain all risk hardware devices according to a device database and the sampling hardware device when the sampling hardware device has an abnormal use risk.
In one embodiment, the risk screening unit 13 is further configured to: acquiring a sampling equipment ID and equipment information of the sampling hardware equipment, and matching in the data storage area according to the sampling equipment ID; if the matching is successful, the sampling hardware equipment is determined to have no abnormal use risk; if the matching is unsuccessful, acquiring a corresponding statistical characteristic interval from a preset statistical characteristic database according to the equipment information; judging whether the characteristics of the sampling hardware equipment are abnormal characteristics or not according to the statistical characteristic interval, and acquiring the characteristic quantity of the abnormal characteristics; judging whether the feature quantity reaches an abnormal feature quantity threshold value or not; if not, the sampling hardware equipment is determined to have no abnormal use risk; and if so, recognizing that the sampling hardware equipment has abnormal use risks.
In one embodiment, the risk screening unit 13 is further configured to: judging whether the characteristics of the sampling hardware equipment exceed the corresponding statistical characteristic intervals; if the characteristic exceeds the characteristic, the characteristic of the sampling hardware equipment is an abnormal characteristic; otherwise, the sampled hardware device feature is not an outlier feature.
In one embodiment, the risk screening unit 13 is further configured to: judging whether the use interval exceeds the use interval or not, and recognizing the use interval as an abnormal characteristic when the use interval exceeds the use interval; judging whether the single consumption price exceeds a single consumption price interval, and recognizing the single consumption price as an abnormal characteristic when the single consumption price exceeds the single consumption price interval; and calculating the coincidence time length of the busy time interval and the busy time interval, judging whether the proportion of the coincidence time length to the busy time interval is lower than a preset proportion threshold value, and recognizing the using time interval as an abnormal characteristic when the proportion threshold value is lower than the preset proportion threshold value. In one embodiment, the preset ratio threshold is 30%.
In one embodiment, the risk screening unit 13 is further configured to: inquiring a first associated hardware device associated with the sampling hardware device in a preset device database; judging whether the first associated hardware equipment has abnormal use risks or not; and outputting the first associated hardware device with the abnormal use risk as a risk hardware device.
The wind control execution unit 14 is configured to take corresponding wind control measures for the risk hardware device according to a preset wind control management method.
In an embodiment, the identification device further comprises a trusted recording unit for: according to the risk hardware device, the sampling hardware device and the first associated hardware device, obtaining a safety hardware device and a trusted time, and recording the device ID of the safety hardware device and the trusted time in a preset data storage area; and deleting the device ID exceeding the trusted time in the data storage area according to the current timestamp.
In one embodiment, the identification device further comprises a wind-controlled triggering unit for: content monitoring is carried out on a preset pneumatic mailbox; when the fact that the mail sent by the pneumatic mail is monitored, a first risk user ID is obtained from mail content of the pneumatic mail, and according to the first risk user ID, matching inquiry is carried out in a preset risk database to obtain a first risk equipment ID; and according to the first risk equipment ID and the wind control management method, corresponding wind control measures are adopted for the first risk equipment.
In one embodiment, the identification device further comprises a comprehensive wind control unit for: acquiring the total number of all the risk hardware devices and first merchant accounts to which each risk hardware device belongs, and counting the number of the risk hardware devices held by each first merchant account; calculating the risk equipment duty ratio of each first merchant account according to the number of the risk hardware equipment and the total number; judging whether the proportion of the risk equipment reaches a preset comprehensive wind control threshold or not, and taking wind control measures for all hardware equipment to be identified held by a first merchant account of which the proportion of the risk equipment reaches the comprehensive wind control threshold.
Wherein the integrated units of the identification means may be stored in a computer readable storage medium if implemented in the form of software functional units and sold or used as separate products. Based on such understanding, the present invention may implement all or part of the flow of the method of the above embodiment, or may be implemented by instructing related hardware by a computer program, where the computer program may be stored in a computer readable storage medium, and the computer program may implement the steps of each of the method embodiments described above when executed by a processor. Another embodiment of the present invention provides a computer readable storage medium, where the computer readable storage medium includes a stored computer program, and when the computer program runs, controls a device where the computer readable storage medium is located to execute a method for identifying abnormal usage of a hardware device as described above.
Wherein the computer program comprises computer program code which may be in source code form, object code form, executable file or some intermediate form etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer Memory, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), an electrical carrier signal, a telecommunications signal, a software distribution medium, and so forth. It should be noted that the computer readable medium contains content that can be appropriately scaled according to the requirements of jurisdictions in which such content is subject to legislation and patent practice, such as in certain jurisdictions in which such content is subject to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.
It should be noted that the above-described apparatus embodiments are merely illustrative, and the units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. In addition, in the drawings of the embodiment of the device provided by the invention, the connection relation between the units indicates that the units have communication connection, and the connection relation can be specifically realized as one or more communication buses or signal lines. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
The embodiment of the invention describes a hardware equipment abnormal use identification device and a computer readable storage medium, wherein the hardware equipment abnormal use identification device is used for acquiring an abnormal use identification result of a sampling hardware equipment by distributing sampling probability according to the attribute of the hardware equipment to be identified and carrying out sampling abnormal identification, further carrying out abnormal identification on equipment associated with the sampling hardware equipment with abnormal use risk according to an equipment database, and after all risk hardware equipment is determined, adopting corresponding wind control measures on the risk hardware equipment; furthermore, the hardware equipment abnormal use identification device and the computer readable storage medium described in the embodiment of the invention further record the hardware equipment to be identified which is determined to be the safety hardware equipment in the process of sampling abnormal identification and further abnormal identification for directly checking and confirming in a table in a trusted time, thereby further improving the identification efficiency of the abnormal use of the hardware equipment.
Detailed description of the preferred embodiments
In addition to the method and the device, the embodiment of the invention also describes a hardware equipment abnormal use identification system.
The identification system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, which when executed implements the hardware device abnormal use identification method as described above.
The Processor may be a central processing unit (Central Processing Unit, CPU), other general purpose Processor, digital signal Processor (DIGITAL SIGNAL Processor, DSP), application SPECIFIC INTEGRATED Circuit (ASIC), off-the-shelf Programmable gate array (Field-Programmable GATE ARRAY, FPGA) or other Programmable logic device, discrete gate or transistor logic device, discrete hardware components, or the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like that is the control center of the device, connecting the various parts of the overall device using various interfaces and lines.
The memory may be used to store the computer program and/or modules, and the processor may implement various functions of the apparatus by running or executing the computer program and/or modules stored in the memory, and invoking data stored in the memory. The memory may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program (such as a sound playing function, an image playing function, etc.) required for at least one function, and the like; the storage data area may store data (such as audio data, phonebook, etc.) created according to the use of the handset, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as a hard disk, memory, plug-in hard disk, smart memory card (SMART MEDIA CARD, SMC), secure Digital (SD) card, flash memory card (FLASH CARD), at least one disk storage device, flash memory device, or other volatile solid-state storage device.
The embodiment of the invention describes a hardware equipment abnormal use identification system, which is used for acquiring an abnormal use identification result of sampling hardware equipment by distributing sampling probability according to the attribute of hardware equipment to be identified and carrying out sampling abnormal recognition, carrying out further abnormal recognition on equipment associated with the sampling hardware equipment with abnormal use risk according to an equipment database, and after all risk hardware equipment is determined, adopting corresponding wind control measures on the risk hardware equipment, wherein the identification system improves the identification efficiency of the abnormal use of the hardware equipment; furthermore, the hardware equipment abnormal use recognition system described in the embodiment of the invention further records the hardware equipment to be recognized, which is determined to be the safety hardware equipment in the sampling abnormal recognition and further abnormal recognition process, for directly checking the table and confirming in the trusted time, so that the recognition efficiency of the hardware equipment abnormal use is further improved.
While the foregoing is directed to the preferred embodiments of the present invention, it will be appreciated by those skilled in the art that changes and modifications may be made without departing from the principles of the invention, such changes and modifications are also intended to be within the scope of the invention.
Claims (6)
1. A method for identifying abnormal use of a hardware device, the method comprising:
acquiring attribute characteristics of hardware equipment to be identified, and distributing sampling probability for each hardware equipment to be identified according to the attribute characteristics;
sampling and feature statistics are carried out on all hardware devices to be identified according to the distribution sampling probability and a preset sampling method, and one or more sampling hardware devices and corresponding sampling hardware device features are obtained;
judging whether the sampling hardware equipment has abnormal use risks or not according to a preset abnormality identification method and the characteristics of the sampling hardware equipment, and obtaining all risk hardware equipment according to an equipment database and the sampling hardware equipment when the sampling hardware equipment has abnormal use risks;
according to a preset wind control management method, corresponding wind control measures are adopted for the risk hardware equipment;
the allocating sampling probability for each hardware device to be identified according to the attribute features comprises the following steps:
distributing sampling probability for each hardware device to be identified according to the flow of each hardware device to be identified, so that the pumping probability of the hardware device to be identified with larger flow is larger;
Or distributing sampling probability for each hardware device to be identified according to the area where each hardware device to be identified is located, so that the probability of extracting the hardware device to be identified in suburb is larger than that of extracting the hardware device to be identified in city center;
The judging whether the sampling hardware device has abnormal use risk according to a preset abnormality identification method and the characteristics of the sampling hardware device specifically comprises the following steps:
acquiring a sampling equipment ID and equipment information of the sampling hardware equipment, and matching in a data storage area according to the sampling equipment ID;
if the matching is successful, the sampling hardware equipment is determined to have no abnormal use risk;
If the matching is unsuccessful, acquiring a corresponding statistical characteristic interval from a preset statistical characteristic database according to the equipment information;
Judging whether the characteristics of the sampling hardware equipment are abnormal characteristics or not according to the statistical characteristic interval, and acquiring the characteristic quantity of the abnormal characteristics;
judging whether the feature quantity reaches an abnormal feature quantity threshold value or not;
if not, the sampling hardware equipment is determined to have no abnormal use risk;
if so, determining that the sampling hardware equipment has abnormal use risks;
Judging whether the characteristics of the sampling hardware equipment are abnormal characteristics according to the statistical characteristic interval, and specifically comprising the following steps:
Judging whether the use interval exceeds the use interval or not, and recognizing the use interval as an abnormal characteristic when the use interval exceeds the use interval;
judging whether the single consumption price exceeds a single consumption price interval, and recognizing the single consumption price as an abnormal characteristic when the single consumption price exceeds the single consumption price interval;
Calculating the coincidence time length of the busy time interval and the busy time interval, judging whether the proportion of the coincidence time length to the busy time interval is lower than a preset proportion threshold value, and recognizing the busy time interval as an abnormal characteristic when the proportion threshold value is lower than the proportion threshold value;
The obtaining risk hardware equipment according to the equipment database and the sampling hardware equipment specifically comprises the following steps:
inquiring a first associated hardware device associated with the sampling hardware device in a preset device database;
judging whether the first associated hardware equipment has abnormal use risks or not;
outputting the first associated hardware equipment with the abnormal use risk as risk hardware equipment;
after corresponding wind control measures are adopted for the risk hardware equipment according to a preset wind control management method, the method further comprises the following steps:
Acquiring the total number of all the risk hardware devices and first merchant accounts to which each risk hardware device belongs, and counting the number of the risk hardware devices held by each first merchant account; calculating the risk equipment duty ratio of each first merchant account according to the number of the risk hardware equipment and the total number; judging whether the proportion of the risk equipment reaches a preset comprehensive wind control threshold or not, and taking wind control measures for all hardware equipment to be identified held by a first merchant account of which the proportion of the risk equipment reaches the comprehensive wind control threshold.
2. The hardware device abnormal use identification method according to claim 1, wherein the identification method further comprises:
According to the risk hardware device, the sampling hardware device and the first associated hardware device, obtaining a safety hardware device and a trusted time, and recording the device ID of the safety hardware device and the trusted time in a preset data storage area;
And deleting the device ID exceeding the trusted time in the data storage area according to the current timestamp.
3. The hardware device abnormal use identification method according to claim 1, wherein the identification method further comprises:
Content monitoring is carried out on a preset pneumatic mailbox;
When the mail sent by the pneumatic mail box is monitored to be the pneumatic mail, a first risk user ID is obtained from the mail content of the pneumatic mail, and according to the first risk user ID, matching inquiry is carried out in a preset risk database to obtain a first risk equipment ID;
and according to the first risk equipment ID and the wind control management method, corresponding wind control measures are adopted for the first risk equipment.
4. A hardware equipment abnormal use recognition device is characterized by comprising a probability distribution unit, a sampling extraction unit, a risk screening unit and a wind control execution unit, wherein,
The probability distribution unit is used for acquiring attribute characteristics of the hardware equipment to be identified and distributing sampling probability for each hardware equipment to be identified according to the attribute characteristics;
the sampling extraction unit is used for sampling and counting the characteristics of all hardware devices to be identified according to the distribution sampling probability and a preset sampling method to obtain one or more sampling hardware devices and the characteristics of the corresponding sampling hardware devices;
The risk screening unit is used for judging whether the sampling hardware equipment has abnormal use risks or not according to a preset abnormality identification method and the characteristics of the sampling hardware equipment, and obtaining all risk hardware equipment according to an equipment database and the sampling hardware equipment when the sampling hardware equipment has abnormal use risks;
the wind control execution unit is used for taking corresponding wind control measures for the risk hardware equipment according to a preset wind control management method;
the allocating sampling probability for each hardware device to be identified according to the attribute features comprises the following steps:
distributing sampling probability for each hardware device to be identified according to the flow of each hardware device to be identified, so that the pumping probability of the hardware device to be identified with larger flow is larger;
Or distributing sampling probability for each hardware device to be identified according to the area where each hardware device to be identified is located, so that the probability of extracting the hardware device to be identified in suburb is larger than that of extracting the hardware device to be identified in city center;
The risk screening unit is further configured to: acquiring a sampling equipment ID and equipment information of the sampling hardware equipment, and matching in a data storage area according to the sampling equipment ID; if the matching is successful, the sampling hardware equipment is determined to have no abnormal use risk; if the matching is unsuccessful, acquiring a corresponding statistical characteristic interval from a preset statistical characteristic database according to the equipment information; judging whether the characteristics of the sampling hardware equipment are abnormal characteristics or not according to the statistical characteristic interval, and acquiring the characteristic quantity of the abnormal characteristics; judging whether the feature quantity reaches an abnormal feature quantity threshold value or not; if not, the sampling hardware equipment is determined to have no abnormal use risk; if so, determining that the sampling hardware equipment has abnormal use risks;
Judging whether the characteristics of the sampling hardware equipment are abnormal characteristics according to the statistical characteristic interval, and specifically comprising the following steps:
Judging whether the use interval exceeds the use interval or not, and recognizing the use interval as an abnormal characteristic when the use interval exceeds the use interval;
judging whether the single consumption price exceeds a single consumption price interval, and recognizing the single consumption price as an abnormal characteristic when the single consumption price exceeds the single consumption price interval;
Calculating the coincidence time length of the busy time interval and the busy time interval, judging whether the proportion of the coincidence time length to the busy time interval is lower than a preset proportion threshold value, and recognizing the busy time interval as an abnormal characteristic when the proportion threshold value is lower than the proportion threshold value;
The risk screening unit is further configured to: inquiring a first associated hardware device associated with the sampling hardware device in a preset device database; judging whether the first associated hardware equipment has abnormal use risks or not; outputting the first associated hardware equipment with the abnormal use risk as risk hardware equipment;
The risk screening unit is further configured to: after corresponding wind control measures are taken for the risk hardware devices according to a preset wind control management method, acquiring the total number of all the risk hardware devices and first merchant accounts to which each risk hardware device belongs, and counting the number of the risk hardware devices held by each first merchant account; calculating the risk equipment duty ratio of each first merchant account according to the number of the risk hardware equipment and the total number; judging whether the proportion of the risk equipment reaches a preset comprehensive wind control threshold or not, and taking wind control measures for all hardware equipment to be identified held by a first merchant account of which the proportion of the risk equipment reaches the comprehensive wind control threshold.
5. A computer readable storage medium, characterized in that the computer readable storage medium comprises a stored computer program, wherein the computer program, when run, controls a device in which the computer readable storage medium is located to execute the hardware device abnormal use identification method according to any one of claims 1 to 3.
6. A hardware device abnormal usage identification system, characterized in that the identification system comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, the processor implementing the hardware device abnormal usage identification method according to any one of claims 1 to 3 when executing the computer program.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310740084.1A CN116701914B (en) | 2023-06-21 | 2023-06-21 | Hardware equipment abnormal use identification method, device, storage device and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310740084.1A CN116701914B (en) | 2023-06-21 | 2023-06-21 | Hardware equipment abnormal use identification method, device, storage device and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116701914A CN116701914A (en) | 2023-09-05 |
| CN116701914B true CN116701914B (en) | 2024-07-05 |
Family
ID=87844879
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310740084.1A Active CN116701914B (en) | 2023-06-21 | 2023-06-21 | Hardware equipment abnormal use identification method, device, storage device and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116701914B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109660529A (en) * | 2018-12-06 | 2019-04-19 | 深圳蓝贝科技有限公司 | Safety wind control method, apparatus, vending machine and system for vending machine |
| CN112215640A (en) * | 2020-10-09 | 2021-01-12 | 浪潮卓数大数据产业发展有限公司 | Network retail platform shop sampling method based on statistical estimation |
| CN115422522A (en) * | 2022-08-31 | 2022-12-02 | 中国工商银行股份有限公司 | Abnormal equipment judgment reference establishment method, abnormal equipment identification method, abnormal equipment judgment reference establishment device, abnormal equipment identification device and abnormal equipment identification device |
Family Cites Families (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106295349B (en) * | 2015-05-29 | 2020-06-05 | 阿里巴巴集团控股有限公司 | Account stolen risk identification method, identification device and prevention and control system |
| CN106686599B (en) * | 2015-11-05 | 2020-10-20 | 创新先进技术有限公司 | Method and equipment for risk management of application information |
| CN107562553B (en) * | 2016-06-30 | 2021-05-07 | 伊姆西公司 | Data center management method and equipment |
| CN107170237A (en) * | 2017-07-20 | 2017-09-15 | 长安大学 | Share the abnormal detection method of bicycle in a kind of city |
| CN107580035B (en) * | 2017-08-23 | 2020-10-09 | 北京摩拜科技有限公司 | Article management method, client, server and system |
| CN108664376A (en) * | 2018-04-03 | 2018-10-16 | 广东小天才科技有限公司 | Equipment use state monitoring method, device and equipment |
| CN110086643B (en) * | 2019-02-18 | 2022-03-11 | 咪咕文化科技有限公司 | Risk identification method, terminal and storage medium |
| CN109992435A (en) * | 2019-02-26 | 2019-07-09 | 上海拍拍贷金融信息服务有限公司 | Equipment uses abnormality determination method, device and computer storage medium |
| CN109976934B (en) * | 2019-02-26 | 2024-03-08 | 上海拍分乐网络科技有限公司 | Device use abnormality determination method, device and computer storage medium |
| CN110224992B (en) * | 2019-05-14 | 2022-11-29 | 北京百度网讯科技有限公司 | Method, apparatus, system and computer readable medium for shared resource restriction reuse |
| CN113570205A (en) * | 2021-07-07 | 2021-10-29 | 北京淇瑀信息科技有限公司 | API risk equipment identification method and device based on single classification and electronic equipment |
| CN113516398A (en) * | 2021-07-22 | 2021-10-19 | 北京淇瑀信息科技有限公司 | Risk equipment identification method and device based on hierarchical sampling and electronic equipment |
| CN114225421A (en) * | 2021-12-16 | 2022-03-25 | 网易（杭州）网络有限公司 | Game transaction data anomaly detection method and device, terminal and readable storage medium |
| CN114840565A (en) * | 2022-03-11 | 2022-08-02 | 神策网络科技（北京）有限公司 | Sampling query method, device, electronic equipment and computer readable storage medium |
| CN114783121B (en) * | 2022-04-13 | 2024-06-25 | 中国银行股份有限公司 | Fault processing method, device and equipment of self-service equipment and readable storage medium |
-
2023
- 2023-06-21 CN CN202310740084.1A patent/CN116701914B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109660529A (en) * | 2018-12-06 | 2019-04-19 | 深圳蓝贝科技有限公司 | Safety wind control method, apparatus, vending machine and system for vending machine |
| CN112215640A (en) * | 2020-10-09 | 2021-01-12 | 浪潮卓数大数据产业发展有限公司 | Network retail platform shop sampling method based on statistical estimation |
| CN115422522A (en) * | 2022-08-31 | 2022-12-02 | 中国工商银行股份有限公司 | Abnormal equipment judgment reference establishment method, abnormal equipment identification method, abnormal equipment judgment reference establishment device, abnormal equipment identification device and abnormal equipment identification device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116701914A (en) | 2023-09-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112801666B (en) | Monitoring management method, system, medium and equipment based on enterprise service bus | |
| CN114185708A (en) | Data analysis method and device based on distributed link tracking and electronic equipment | |
| CN107248082B (en) | Card maintenance identification method and device | |
| CN108923972B (en) | Weight-reducing flow prompting method, device, server and storage medium | |
| WO2019085095A1 (en) | Intelligent voice prompting method and apparatus, electronic device, and medium | |
| CN111368134B (en) | Traffic data processing method and device, electronic equipment and storage medium | |
| CN109739718A (en) | Log alarming method and device | |
| CN113377637A (en) | Performance capacity diagnostic method and device | |
| CN109242658B (en) | Suspicious transaction report generation method, suspicious transaction report generation system, suspicious transaction report generation computer device and suspicious transaction report storage medium | |
| CN113392005A (en) | Large file processing test method and system | |
| CN112819476A (en) | Risk identification method and device, nonvolatile storage medium and processor | |
| CN116701914B (en) | Hardware equipment abnormal use identification method, device, storage device and system | |
| CN108923967B (en) | Duplication-removing flow recording method, duplication-removing flow recording device, server and storage medium | |
| CN109544014B (en) | Anti-fraud method and device based on historical data playback | |
| CN111046632A (en) | Data extraction and conversion method, system, storage medium and electronic equipment | |
| CN111061999B (en) | Data sample acquisition method, device and storage medium | |
| CN113973273A (en) | Charging method and device for network slicing service | |
| CN109598525B (en) | Data processing method and device | |
| CN115391224A (en) | Flow playback method and device, computer equipment and readable storage medium | |
| CN108881591B (en) | Multi-platform information recommendation method and device and storage medium | |
| CN114666390A (en) | Page monitoring method and device of application program, electronic equipment and storage medium | |
| CN112671756A (en) | Method and device for filtering abnormal traffic | |
| CN112131219A (en) | Customer maintenance management method and system | |
| CN111061701A (en) | Information processing method, device, server and computer readable medium | |
| CN112597991B (en) | Data processing method, data processing device, server and client |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |