CN112533209B - Black product identification method and black product identification device - Google Patents
Black product identification method and black product identification device Download PDFInfo
- Publication number
- CN112533209B CN112533209B CN202011435122.5A CN202011435122A CN112533209B CN 112533209 B CN112533209 B CN 112533209B CN 202011435122 A CN202011435122 A CN 202011435122A CN 112533209 B CN112533209 B CN 112533209B
- Authority
- CN
- China
- Prior art keywords
- black
- identified
- mobile phone
- phone number
- account
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 43
- 208000003443 Unconsciousness Diseases 0.000 claims description 154
- 230000006399 behavior Effects 0.000 claims description 42
- 238000004519 manufacturing process Methods 0.000 claims description 30
- 238000012795 verification Methods 0.000 description 25
- 238000004891 communication Methods 0.000 description 10
- 238000006243 chemical reaction Methods 0.000 description 7
- 238000010586 diagram Methods 0.000 description 6
- 230000006870 function Effects 0.000 description 6
- 238000012545 processing Methods 0.000 description 6
- 238000004590 computer program Methods 0.000 description 5
- 210000002268 wool Anatomy 0.000 description 5
- 230000008569 process Effects 0.000 description 4
- 230000001360 synchronised effect Effects 0.000 description 4
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 2
- 230000000977 initiatory effect Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
Abstract
The application provides a black product identification method and a black product identification device. In the technical scheme provided by the application, the mobile phone account and the broadband account in the 3A log data unique to the operator and the related information (on-line time, second change times and the like) thereof are utilized to generate a more accurate black product account library, and the black product is identified based on the black product account library, so that the identification accuracy of the black product can be improved. In the technical scheme of this application, can improve the discernment precision of black product through the accurate matching of the login moment of broadband account. In addition, the technical scheme of the application can also improve the recognition speed through the fuzzy recognition of the mobile phone number.
Description
Technical Field
The application relates to the field of information technology, in particular to a black product identification method and a black product identification device.
Background
The network black product (hereinafter referred to as "black product") refers to illegal actions which take the internet as a medium and take network technology as a main means to bring potential threats (major potential safety hazards) to the safety of a computer information system, the management order of network space and the like.
For example, businesses often offer some form of incentive or preference for goods, such as "play" events and "wool party" when people earn money using this information, and "play" groups, such as "play wool" groups, when the "play wool" is scaled up, that are often used to maximize benefits by using robots to go to wool, such robots are known as black products, and such systems typically include robot registration, pool identity, and wool removal, among other acts.
To protect against black products, in the related art, a business system attacked by black products recognizes black products. The existing black product identification method often has the phenomenon of inaccurate identification such as false identification.
For example, the blackout account verification system recognizes that all accounts are blackout by performing login actions through an IP address after recognizing the IP address as the blackout IP address according to a number of times that a certain internet protocol (internet protocol, IP) address is logged in for a certain period of time exceeds a preset number of times.
Disclosure of Invention
The embodiment of the application provides a black product identification method and a black product identification device, which can improve the identification accuracy of black products by precisely matching the login time of a broadband account, and can also improve the identification speed by fuzzy identification of a mobile phone number, thereby integrally improving the identification accuracy of black products.
In a first aspect, the present application provides a black product identification method, the method comprising: receiving a black product identification request message, wherein the black product identification request message carries a mobile phone number to be identified, login time of the mobile phone number to be identified and an Internet Protocol (IP) address used by the mobile phone number to be identified at the login time; determining a broadband account associated with the mobile phone number to be identified when the IP address is used at the login time as the broadband account to be identified; judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is blackout or not according to the distance between the broadband account to be identified and the blackout broadband account in the blackout account library and the distance between the login time and the blackout time of the blackout broadband account; transmitting a precise black product identification result at the moment, wherein the precise black product identification result at the moment comprises: and the information is used for indicating whether the behavior of the mobile phone number to be identified using the IP address at the login time is black.
In the method, the black product identification is carried out based on the login time of the account corresponding to the mobile phone number and the IP address at the login time, so that the time of login behavior can be accurately reached, the black product identification is not carried out only based on the IP address, the false identification can be avoided, and the accuracy of the black product identification can be improved.
With reference to the first aspect, in a first possible implementation manner, the determining whether the act of using the IP address by the mobile phone number to be identified at the login time is a blackout according to a distance between the broadband account to be identified and a blackout broadband account in a blackout account library and a distance between the login time and a blackout time of the blackout broadband account includes: calculating the accurate matching distance of the moment between the broadband account to be identified and each black-out broadband account in the black-out account library according to the following formula:
x＝1,2,3,…,C
c is the number of black-producing broadband account numbers in the black-producing account library;is->Is a transpose of (2); mu is an adjustment coefficient; l is an autonomous adjustment time range; />The login time is the login time; />For the black time,/o->For the broadband account to be identified, +.>D, for the xth black-producing broadband account number in the black-producing account library x The precise matching distance between the moment of the broadband account to be identified and the x-th black-out broadband account is provided;
and when the minimum moment accurate matching distance in the calculated C moment accurate matching distances is smaller than or equal to a moment accurate matching distance threshold value, determining that the behavior of the mobile phone number to be identified using the IP address at the login time is black.
In the implementation manner, the method for precisely matching the broadband account is described in detail to identify whether the broadband account is a black product account, so that the identification accuracy of the black product can be improved.
In combination with the first possible implementation manner, in a second possible implementation manner, the method further includes, according to a distance between the to-be-identified broadband account and a blackout broadband account in a blackout account library and a distance between the login time and a blackout time of the blackout broadband account, determining whether the act of using the IP address by the to-be-identified mobile phone number at the login time is a blackout state, before: judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is black production or not according to the distance between the mobile phone number to be identified and the black production mobile phone number in the black production account library; transmitting a fuzzy black product identification result, wherein the fuzzy black product identification result comprises: and the information is used for indicating that the behavior of using the IP address by the mobile phone number to be identified at the login time is black.
In the implementation manner, before the accurate black product identification result is provided, the fuzzy black product identification can be rapidly performed, and the fuzzy black product identification result reference is provided.
In combination with the second possible implementation manner, in a third possible implementation manner, the determining, according to a distance between the mobile phone number to be identified and the mobile phone number in the black-office account library, whether the act of using the IP address by the mobile phone number to be identified at the login time is black-office includes: calculating the number of the mobile phone to be identified and the black product according to the following formula fuzzy matching distance between each black-producing mobile phone number in the account library:
k＝1,2,3,…,Ω
wherein omega is the number of the black-out mobile phone numbers in the black-out account library; i. j and t are three-dimensional coordinates of the three-dimensional storage space point of the mobile phone number to be identified respectively, S mi For the last 10 digits of the cell phone number to be identified,d, for the last 10 bits of the kth black-out mobile phone number in the black-out account library k (i, j, t) is a fuzzy matching distance between the mobile phone number to be identified and the kth black-producing mobile phone number, and 'mod' represents a remainder operation;
and when the minimum fuzzy matching distance in the calculated omega fuzzy matching distances is smaller than or equal to a fuzzy matching distance threshold value, determining that the behavior of the mobile phone number to be identified using the IP address at the login time is black.
In the implementation mode, a fuzzy matching method for mobile phone numbers is specifically introduced to identify whether the mobile phone numbers are black-producing accounts, so that the identification speed of black-producing can be improved, and a fuzzy black-producing identification result reference can be provided.
In combination with the third possible implementation manner, in a fourth possible implementation manner, the black-out identification request message further carries identification requirement indication information, where the identification requirement indication information is used to indicate whether to request fuzzy black-out identification;
correspondingly, the determining whether the behavior of using the IP address by the mobile phone number to be identified at the login time is a blackout according to the distance between the mobile phone number to be identified and the blackout mobile phone number in the blackout account library includes: when the identification requirement indication information indicates that fuzzy blackout identification is requested, judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is blackout or not according to the distance between the mobile phone number to be identified and the blackout mobile phone number in the blackout account library.
In the implementation mode, the fuzzy black product identification is performed only under the condition that the fuzzy black product identification is required, so that the waste of resources can be avoided, and the efficiency of the accurate black product identification is improved.
With reference to the first aspect or any one of the foregoing possible implementation manners, in a fifth possible implementation manner, the black-out account library is generated based on a 3A log database of an operator, and the database contains more information, so that a more accurate black-out account library can be generated, thereby improving the accuracy of black-out identification and being beneficial to performing the pre-identification of black-out behaviors.
With reference to the first aspect or any one of the foregoing possible implementation manners, in a sixth possible implementation manner, the precise black product identification result at the moment includes: the mobile phone number to be identified, the broadband account to be identified, the login time and the IP address.
In a second aspect, the present application provides a black product identification device, the device comprising: the mobile phone number identification system comprises a receiving module, a receiving module and a processing module, wherein the receiving module receives a black product identification request message, and the black product identification request message carries a mobile phone number to be identified, login time of the mobile phone number to be identified and an Internet Protocol (IP) address used by the mobile phone number to be identified at the login time; the determining module is used for determining a broadband account associated with the mobile phone number to be identified when the IP address is used at the login time as the broadband account to be identified; the judging module is used for judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is blackout or not according to the distance between the broadband account to be identified and the blackout broadband account in the blackout account library and the distance between the login time and the blackout time of the blackout broadband account; the transmission module is used for transmitting a precise black product identification result at the moment, and the precise black product identification result at the moment comprises the following components: and the information is used for indicating whether the behavior of the mobile phone number to be identified using the IP address at the login time is black.
With reference to the second aspect, in a first possible implementation manner, the determining module is specifically configured to: calculating the accurate matching distance of the moment between the broadband account to be identified and each black-out broadband account in the black-out account library according to the following formula:
x＝1,2,3,…,C
c is the number of black-producing broadband account numbers in the black-producing account library;is->Is a transpose of (2); mu is an adjustment coefficient; l is an autonomous adjustment time range; />The login time is the login time; />For the black time,/o->For the broadband account to be identified, +.>D, for the xth black-producing broadband account number in the black-producing account library x The precise matching distance between the moment of the broadband account to be identified and the x-th black-out broadband account is provided;
and when the minimum moment accurate matching distance in the calculated C moment accurate matching distances is smaller than or equal to a moment accurate matching distance threshold value, determining that the behavior of the mobile phone number to be identified using the IP address at the login time is black.
With reference to the first possible implementation manner, in a second possible implementation manner, the determining module is further configured to: judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is black production or not according to the distance between the mobile phone number to be identified and the black production mobile phone number in the black production account library; the sending module is further configured to send a fuzzy black product identification result, where the fuzzy black product identification result includes: and the information is used for indicating that the behavior of using the IP address by the mobile phone number to be identified at the login time is black.
With reference to the second possible implementation manner, in a third possible implementation manner, the determining module is specifically configured to: calculating the number of the mobile phone to be identified and the black product according to the following formula fuzzy matching distance between each black-producing mobile phone number in the account library:
k＝1,2,3,…,Ω
wherein omega is the number of the black-out mobile phone numbers in the black-out account library; i. j and t are respectively the materials to be treatedThree-dimensional coordinates of three-dimensional storage space points of mobile phone numbers are identified, S mi For the last 10 digits of the cell phone number to be identified,d, for the last 10 bits of the kth black-out mobile phone number in the black-out account library k (i, j, t) is a fuzzy matching distance between the mobile phone number to be identified and the kth black-producing mobile phone number, and 'mod' represents a remainder operation;
and when the minimum fuzzy matching distance in the calculated omega fuzzy matching distances is smaller than or equal to a fuzzy matching distance threshold value, determining that the behavior of the mobile phone number to be identified using the IP address at the login time is black.
In combination with the third possible implementation manner, in a fourth possible implementation manner, the black-out identification request message further carries identification requirement indication information, where the identification requirement indication information is used to indicate whether to request fuzzy black-out identification;
Correspondingly, the judging module is specifically configured to: when the identification requirement indication information indicates that fuzzy blackout identification is requested, judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is blackout or not according to the distance between the mobile phone number to be identified and the blackout mobile phone number in the blackout account library.
With reference to the second aspect or any one of the foregoing possible implementation manners, in a fifth possible implementation manner, the black-out account library is generated based on a 3A log database of an operator, where the database contains more information, and can generate a more accurate black-out account library, so that the black-out identification accuracy can be improved, and the black-out identification is also facilitated.
With reference to the second aspect or any one of the foregoing possible implementation manners, in a sixth possible implementation manner, the precise black product identification result at the moment includes: the mobile phone number to be identified, the broadband account to be identified, the login time and the IP address.
In a third aspect, the present application provides a black product identification device, including: a memory and a processor; the memory is used for storing program instructions; the processor is configured to invoke program instructions in the memory to perform the method according to the first aspect or any of the possible implementations thereof.
Where the apparatus is a computing device, in some implementations the apparatus may further comprise a transceiver or communication interface for communicating with other devices.
Where the apparatus is a chip for a computing device, in some implementations the apparatus may further comprise a communication interface for communicating with other apparatus in the computing device, for example for communicating with a transceiver of the computing device.
In a fourth aspect, the present application provides a computer readable medium storing program code for computer execution, the program code comprising instructions for performing the method of the first aspect or any one of the possible implementations thereof.
In a fifth aspect, the present application provides a computer program product comprising instructions which, when run on a processor, cause the processor to implement the method of the first aspect or any one of the implementations.
In a sixth aspect, the present application provides a black product identification system, including the black product identification device in the second aspect or the third aspect.
Drawings
FIG. 1 is a schematic diagram of a black product identification system according to an embodiment of the present application;
FIG. 2 is a flow chart of a black product identification method according to an embodiment of the present application;
FIG. 3 is a schematic diagram of a black product identification device according to an embodiment of the present application;
fig. 4 is a schematic structural diagram of a black product identification device according to another embodiment of the present application.
Detailed Description
Fig. 1 is a diagram showing a structural example of a black product identification system according to an embodiment of the present application. As shown in fig. 1, the black product identification system of the present embodiment may include a 3A log database of an operator, a data conversion device, a terminal device, a black product account verification system, and a black product account library.
The 3A log is original data information unique to the operator, and includes a broadband account, a mobile phone number associated with the broadband account, a login time of the broadband account when accessing the network each time, an IP address and an online time length after accessing the network each time, how much traffic is used after the broadband account accesses the network, and the like. An example of a login time is a month, day, minute, and second.
The data conversion device generates a black-out account library based on the 3A log data. For example, the data conversion apparatus determines whether a broadband account is a blackout account according to the number of times of conversion of an IP address associated with the broadband account in one period of time in the 3A log data. For another example, the data conversion device determines whether the mobile phone account is a blackout account according to the conversion of the IP address associated with one mobile phone number in a time period in the 3A log data. For another example, the data conversion device determines whether the broadband account is a blackout account according to the average online time length of each IP address associated with the broadband user in the 3A log.
Included in the blackout account library is a broadband account identified as a blackout account. In addition, the cell phone number account associated with the blackout broadband account is also identified as the blackout account. The black production account library can also record the black production behavior occurrence time of each black production broadband account.
The terminal device may access the blackout account identification system through an application (App) or a website. For example, when the terminal device needs to identify whether a certain mobile phone number is a blackout account, the mobile phone number can be sent to the blackout account identification system based on a blackout identification App or a blackout identification website on the terminal device so as to request the blackout account identification system to identify. An example of a terminal device is a mobile phone.
After the mobile phone number sent by the terminal equipment is received by the black-date account identification system, information in the black-date account library can be read, whether the mobile phone number requested to be identified by the terminal equipment is the black-date account or not is identified according to the read information, and an identification result is sent to the terminal equipment.
Fig. 2 is a flowchart of a black product identification method according to an embodiment of the present application. As shown in fig. 2, the method may include S201, S202, S203, S204, S205, and S206.
S201, the terminal equipment sends a black product identification request message to a black product account verification system, wherein the black product identification request message carries a mobile phone number to be identified, the login time of the mobile phone number to be identified and an IP address used by the mobile phone number to be identified at the login time. Accordingly, the blackout account verification system receives the blackout identification request message.
The blackout identification request message is used for requesting the blackout account verification system to verify whether the mobile phone number to be identified is a blackout mobile phone number or not, or is used for requesting the blackout account verification system to verify whether the behavior of the mobile phone number to be identified for logging in by using the IP address at the login time is blackout or not.
The terminal device can be a mobile phone or a computer. The terminal device can send the blackout identification request message to the blackout account verification system through the APP or the website. The mobile phone number to be identified in this embodiment may also be referred to as a mobile phone number that needs to be verified.
In this embodiment, the login time of the mobile phone number to be identified may be understood as a time when the user account associated with the mobile phone number to be identified accesses or logs in to the service system, and the IP address used by the mobile phone number to be identified at the login time may be understood as an IP address used by the user account associated with the mobile phone number to be identified accesses or logs in to the service system at the login time.
The business system in this embodiment may be any system capable of providing services to the user, and may be, for example, a shopping website or a scoring website.
In this embodiment, the IP address may be an IPV4 address or an IPV6 address, where the IP address may be an address allocated by the telecommunications access network for a device (e.g. a mobile phone) used when logging into the service system using the mobile phone number. The address allocated by the telecom access network to the equipment (such as a mobile phone) used when logging in the service system by using the mobile phone number is changed continuously along with the online and offline of the account of the mobile phone number.
S202, judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is black production or not according to the distance between the mobile phone number to be identified and the black production mobile phone number in the black production account library.
The step can be called as carrying out fuzzy matching black product identification on the mobile phone number to be identified, and the identification result is called as a fuzzy black product identification result.
The blackout account library can comprise mobile phone numbers initiating the overblackout behavior, and the mobile phone numbers initiating the overblackout behavior can be called blackout mobile phone numbers.
In one example of fuzzy matching of the mobile phone number to be identified by the black-out account verification system, the following formula may be used to calculate the fuzzy matching distance between the mobile phone number to be identified and each black-out mobile phone number in the black-out account library:
k＝1,2,3,…,Ω
in the formula, omega is the number of the black-out mobile phone numbers in the black-out account library; i. j and t are the three-dimensional coordinates of the three-dimensional storage space point of the mobile phone number to be identified respectively, S mi For the last 10 digits of the cell phone number to be identified,the last 10 bits of the kth black-out mobile phone number in the black-out account library, D k (i, j, t) is a fuzzy matching distance between the mobile phone number to be identified and the kth mobile phone number in the black account library, and 'mod' represents a remainder operation.
After the fuzzy matching distance between the mobile phone number to be identified and each mobile phone number of the black product in the black product account library is calculated by the black product account verification system, the minimum fuzzy matching distance can be selected, and the mobile phone number to be identified is identified as the black product based on the login behavior of the IP address at the login time under the condition that the minimum fuzzy matching distance is smaller than or equal to a preset fuzzy matching distance threshold value. In this case, the fuzzy black yield identification result may include: and the information is used for indicating that the mobile phone number to be identified is identified as black product based on the login behavior of the IP address at the login time.
It can be understood that the above formula for calculating the fuzzy matching distance is only an example, and other formulas for calculating the fuzzy matching distance between the mobile phone number to be identified and the mobile phone number of the black product may be used in the embodiment, for example, the manhattan distance or the cosine distance between the mobile phone number to be identified and the mobile phone number to be identified may be calculated as the fuzzy matching distance.
S203, the black product account verification system sends a fuzzy black product identification result to the terminal equipment. Correspondingly, the terminal equipment receives the fuzzy black product identification result sent by the black product account verification system.
S204, the blackout account verification system determines the broadband account associated with the mobile phone number to be identified when the IP address is used in the login time as the broadband account to be identified according to the information carried in the blackout identification request message.
In this embodiment, the broadband account to be identified may also be referred to as a broadband account associated with the phone number to be identified when the IP address is used at the login time.
For example, a blackout account verification system may determine a broadband account with which the phone number to be identified is associated when the IP address is used at the login time based on a 3A log database of an operator.
S205, the blackout account verification system judges whether the behavior of using the IP address by the mobile phone number to be identified at the login time is blackout or not according to the distance between the broadband account to be identified and the blackout broadband account in the blackout account library and the distance between the login time and the blackout time of the blackout broadband account.
The black-out account library may also include broadband accounts that are over-black-out, which may be referred to as black-out broadband accounts. Further, the black production account library records the black production behavior time of each black production broadband account, and the black production behavior time of the black production broadband account can be called the black production time of the black production broadband account.
This step can be understood as: and the black-produced account verification system performs accurate verification of the annual, daily, time and second granularity on the broadband account to be identified and each black-produced broadband account in the black-produced account library.
For example, the blackout account verification system calculates the time exact matching distance between the broadband account associated with the received phone number and each broadband account in the blackout account library according to the following formula:
x＝1,2,3,…,C
in the formula, C is the number of the black band accounts in the black product account library;is->Is a transpose of (2); mu is an adjustment coefficient; l is an autonomous adjustment time range; />A login time based on the IP address for the mobile phone number to be identified; />For the blackout time of the x-th broadband account in the blackout account library,/->For the broadband account to be identified, +.>D, for the xth black-producing broadband account number in the black-producing account library x For accurate matching distance of moment between the broadband account to be identified and the xth black-producing broadband accountAnd (5) separating. Wherein μ and L are both empirically set.
After the moment accurate matching distance between the broadband account to be identified and each black-produced broadband account in the black-produced account library is calculated, the minimum moment accurate matching distance is found out, and whether the minimum moment accurate matching distance is smaller than or equal to an accurate matching distance threshold value is judged. If the minimum time accurate matching distance is smaller than or equal to the accurate matching distance threshold, the mobile phone number to be identified can be accurately considered to be a black product in the login time based on the login behavior of the IP address. In this case, the obtained accurate black yield identification result for performing the accurate black yield identification may include: and the information is used for indicating that the identification of the mobile phone number to be identified is black at the login time based on the login behavior of the IP address.
Optionally, the accurate black product identification result may further include the mobile phone number to be identified, the login time and the IP address, so that the terminal device can obtain the mobile phone number, the login time and the IP address corresponding to the black product. Further, the accurate black product identification result can also include a broadband account associated with the mobile phone number to be identified.
It will be appreciated that the above formula for calculating the precise matching distance of the time is only an example, and other formulas for calculating the precise matching distance of the time between the broadband account to be identified and the black-producing broadband account may be used in the present embodiment, for example, the manhattan distance between the broadband to be identified and the black-producing broadband account, the manhattan distance between the login time and the black-producing time may be calculated, and the precise matching distance of the time may be calculated according to the manhattan distances.
S206, the black product account verification system sends an accurate black product identification result to the terminal equipment. Correspondingly, the terminal equipment receives the accurate black product identification result.
In this embodiment, the blackout identification request message may further carry identification requirement indication information, where the identification requirement indication information is used to indicate whether to request the blackout account verification system to provide the fuzzy blackout identification result.
If the identification requirement indication information indicates that the blackout account verification system is requested to provide the fuzzy blackout identification result, the blackout account verification system may firstly perform S202 and S203 to provide the fuzzy blackout identification result to the terminal device, and then perform S204 to S206 to provide the accurate blackout identification result to the terminal device.
If the identification requirement indication information indicates that the blackout account verification system is not requested to provide the fuzzy blackout identification result, the blackout account verification system may not perform S202 and S203.
If the blackout identification request message does not carry identification requirement indication information, or the identification requirement request information does not indicate whether the blackout account verification system is requested to provide a fuzzy blackout identification result, the blackout account verification system can determine whether to execute S202 and S203 according to a default setting. The default setting may be to execute S202 and S203 by default, or may not execute S202 and S203 by default.
Fig. 3 is a schematic structural diagram of a black product identification device according to an embodiment of the present application. The apparatus shown in fig. 3 may be used to perform the method described in any of the previous embodiments. As shown in fig. 3, the apparatus 300 of the present embodiment may include: a receiving module 301, a determining module 302, a judging module 303 and a transmitting module 304.
In one example, the apparatus 300 may be used to perform the method described in fig. 2. For example, the receiving module 301 may be used to perform S201, the determining module 302 may be used to perform S204, the judging module 303 may be used to perform S202 and S205, and the transmitting module 304 may be used to perform S203 and S206.
Fig. 4 is a schematic structural diagram of a black product identification device according to another embodiment of the present application. The apparatus shown in fig. 4 may be used to perform the method described in any of the previous embodiments.
As shown in fig. 4, the apparatus 400 of the present embodiment includes: memory 401, processor 402, communication interface 403, and bus 404. The memory 401, the processor 402, and the communication interface 403 are connected to each other by a bus 404.
The memory 401 may be a Read Only Memory (ROM), a static storage device, a dynamic storage device, or a random access memory (random access memory, RAM). The memory 401 may store a program, and the processor 402 is configured to perform the steps of the method shown in fig. 2 when the program stored in the memory 401 is executed by the processor 402.
The processor 402 may employ a general-purpose central processing unit (central processing unit, CPU), microprocessor, application specific integrated circuit (application specific integrated circuit, ASIC), or one or more integrated circuits for executing associated programs to perform the methods of the various embodiments of the present application.
The processor 402 may also be an integrated circuit chip with signal processing capabilities. In implementation, various steps of methods of various embodiments of the present application may be performed by integrated logic circuitry in hardware or by instructions in software in processor 402.
The processor 402 may also be a general purpose processor, a digital signal processor (digital signal processing, DSP), an Application Specific Integrated Circuit (ASIC), an off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components. The disclosed methods, steps, and logic blocks in the embodiments of the present application may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
The steps of a method disclosed in connection with the embodiments of the present application may be embodied directly in hardware, in a decoded processor, or in a combination of hardware and software modules in a decoded processor. The software modules may be located in a random access memory, flash memory, read only memory, programmable read only memory, or electrically erasable programmable memory, registers, etc. as well known in the art. The storage medium is located in the memory 401, and the processor 402 reads the information in the memory 401, and in combination with its hardware, performs the functions necessary for the unit comprised by the apparatus of the present application, for example, the steps/functions of the embodiment shown in fig. 2 can be performed.
Communication interface 403 may enable communication between apparatus 400 and other devices or communication networks using, but is not limited to, a transceiver-like transceiver.
Bus 404 may include a path for transferring information between various components of device 400 (e.g., memory 401, processor 402, communication interface 403).
It should be understood that the apparatus 400 shown in the embodiments of the present application may be a computing device, or may be a chip configured in a computing device.
It should also be appreciated that the memory in embodiments of the present application may be either volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory. The nonvolatile memory may be a read-only memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an electrically Erasable EPROM (EEPROM), or a flash memory. The volatile memory may be random access memory (random access memory, RAM) which acts as an external cache. By way of example but not limitation, many forms of random access memory (random access memory, RAM) are available, such as Static RAM (SRAM), dynamic Random Access Memory (DRAM), synchronous Dynamic Random Access Memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced Synchronous Dynamic Random Access Memory (ESDRAM), synchronous Link DRAM (SLDRAM), and direct memory bus RAM (DR RAM).
The above embodiments may be implemented in whole or in part by software, hardware, firmware, or any other combination. When implemented in software, the above-described embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the processes or functions described in accordance with the embodiments of the present application are all or partially produced. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website site, computer, server, or data center to another website site, computer, server, or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains one or more sets of available media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium may be a solid state disk.
It should be understood that the term "and/or" is merely an association relationship describing the associated object, and means that three relationships may exist, for example, a and/or B may mean: there are three cases, a alone, a and B together, and B alone, wherein a, B may be singular or plural. In addition, the character "/" herein generally indicates that the associated object is an "or" relationship, but may also indicate an "and/or" relationship, and may be understood by referring to the context.
In the present application, "at least one" means one or more, and "a plurality" means two or more. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b, or c may represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c may be single or plural.
It should be understood that, in various embodiments of the present application, the sequence numbers of the foregoing processes do not mean the order of execution, and the order of execution of the processes should be determined by the functions and internal logic thereof, and should not constitute any limitation on the implementation process of the embodiments of the present application.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.
In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk.
The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (8)
1. A black product identification method, comprising:
receiving a black product identification request message, wherein the black product identification request message carries a mobile phone number to be identified, login time of the mobile phone number to be identified and an Internet Protocol (IP) address used by the mobile phone number to be identified at the login time;
determining a broadband account associated with the mobile phone number to be identified when the IP address is used at the login time as the broadband account to be identified;
judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is blackout or not according to the distance between the broadband account to be identified and the blackout broadband account in the blackout account library and the distance between the login time and the blackout time of the blackout broadband account;
transmitting a precise black product identification result at the moment, wherein the precise black product identification result at the moment comprises: information for indicating whether the behavior identification of the mobile phone number to be identified using the IP address is black production at the login time;
The step of judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is a blackout product according to the distance between the broadband account to be identified and the blackout broadband account in the blackout account library and the distance between the login time and the blackout time of the blackout broadband account, comprising:
calculating the accurate matching distance of the moment between the broadband account to be identified and each black-out broadband account in the black-out account library according to the following formula:
c is the number of black-producing broadband account numbers in the black-producing account library;is->Is a transpose of (2); mu is an adjustment coefficient; l is an autonomous adjustment time range; />The login time is the login time; />For the black time,/a->For the broadband account to be identified, +.>D, for the xth black-producing broadband account number in the black-producing account library x For the broadband account to be identified and the firstThe time precise matching distance among x black-producing broadband accounts;
and when the minimum moment accurate matching distance in the calculated C moment accurate matching distances is smaller than or equal to a moment accurate matching distance threshold value, determining that the behavior of the mobile phone number to be identified using the IP address at the login time is black.
2. The method according to claim 1, wherein the determining whether the act of using the IP address by the phone number to be identified at the login time is before the blackout is performed according to a distance between the broadband account to be identified and a blackout broadband account in a blackout account library and a distance between the login time and a blackout time of the blackout broadband account, the method further comprises:
judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is black production or not according to the distance between the mobile phone number to be identified and the black production mobile phone number in the black production account library;
transmitting a fuzzy black product identification result, wherein the fuzzy black product identification result comprises: information for indicating that the behavior of using the IP address by the mobile phone number to be identified at the login time is black;
the step of judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is a black product according to the distance between the mobile phone number to be identified and the black product mobile phone number in the black product account library comprises the following steps:
calculating the number of the mobile phone to be identified and the black product according to the following formula fuzzy matching distance between each black-producing mobile phone number in the account library:
Wherein omega is the number of the black-out mobile phone numbers in the black-out account library; i. j and t are three-dimensional coordinates of the three-dimensional storage space point of the mobile phone number to be identified respectively, S mi For the last 10 digits of the cell phone number to be identified,d, for the last 10 bits of the kth black-out mobile phone number in the black-out account library k (i, j, t) is a fuzzy matching distance between the mobile phone number to be identified and the kth black-producing mobile phone number, and 'mod' represents a remainder operation;
and when the minimum fuzzy matching distance in the calculated omega fuzzy matching distances is smaller than or equal to a fuzzy matching distance threshold value, determining that the behavior of the mobile phone number to be identified using the IP address at the login time is black.
3. The method according to claim 2, wherein the black-out identification request message further carries identification requirement indication information, and the identification requirement indication information is used for indicating whether to request fuzzy black-out identification;
the step of judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is a black product according to the distance between the mobile phone number to be identified and the black product mobile phone number in the black product account library comprises the following steps:
when the identification requirement indication information indicates that fuzzy blackout identification is requested, judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is blackout or not according to the distance between the mobile phone number to be identified and the blackout mobile phone number in the blackout account library.
4. A method according to any one of claims 1 to 3, wherein the black-out account library is generated based on a 3A log database of an operator.
5. A method according to any one of claims 1 to 3, wherein the time accurate black production recognition result comprises: the mobile phone number to be identified, the broadband account to be identified, the login time and the IP address.
6. A black product identification device, comprising:
the mobile phone number identification module is used for receiving a black product identification request message, wherein the black product identification request message carries a mobile phone number to be identified, login time of the mobile phone number to be identified and an Internet Protocol (IP) address used by the mobile phone number to be identified at the login time;
the determining module is used for determining the broadband account associated with the mobile phone number to be identified when the IP address is used at the login time as the broadband account to be identified;
the judging module is used for judging whether the behavior of using the IP address by the mobile phone number to be identified at the login time is black production or not according to the distance between the broadband account to be identified and the black production broadband account in the black production account library and the distance between the login time and the black production time of the black production broadband account;
The sending module is used for sending a precise black product identification result at the moment, and the precise black product identification result at the moment comprises: information for indicating whether the behavior identification of the mobile phone number to be identified using the IP address is black production at the login time;
the judging module is specifically configured to calculate a precise matching distance between the broadband account to be identified and each black-out broadband account in the black-out account library according to the following formula:
c is the number of black-producing broadband account numbers in the black-producing account library;is->Is a transpose of (2); mu is an adjustment coefficient; l is an autonomous adjustment time range; />The login time is the login time;/>for the black time,/a->For the broadband account to be identified, +.>D, for the xth black-producing broadband account number in the black-producing account library x The precise matching distance between the moment of the broadband account to be identified and the x-th black-out broadband account is provided; and when the minimum moment accurate matching distance in the calculated C moment accurate matching distances is smaller than or equal to a moment accurate matching distance threshold value, determining that the behavior of the mobile phone number to be identified using the IP address at the login time is black.
7. A black product identification device, comprising: a memory and a processor;
The memory is used for storing program instructions;
the processor is configured to invoke program instructions in the memory to perform the method of any of claims 1 to 5.
8. A computer readable medium, characterized in that the computer readable medium stores a program code for computer execution, the program code comprising instructions for performing the method of any of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011435122.5A CN112533209B (en) | 2020-12-10 | 2020-12-10 | Black product identification method and black product identification device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011435122.5A CN112533209B (en) | 2020-12-10 | 2020-12-10 | Black product identification method and black product identification device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112533209A CN112533209A (en) | 2021-03-19 |
| CN112533209B true CN112533209B (en) | 2023-07-25 |
Family
ID=74999142
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011435122.5A Active CN112533209B (en) | 2020-12-10 | 2020-12-10 | Black product identification method and black product identification device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112533209B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113535495A (en) * | 2021-06-01 | 2021-10-22 | 成都雅信安科技服务有限公司 | Hardware of intelligent device and component uniqueness judgment method thereof |
| CN113515612B (en) * | 2021-06-23 | 2023-06-02 | 中国联合网络通信集团有限公司 | Method and device for identifying black-birth mobile phone number |
| CN113556748B (en) * | 2021-06-23 | 2023-06-16 | 中国联合网络通信集团有限公司 | Signaling tracing identification method, device and system |
| CN113837303A (en) * | 2021-09-29 | 2021-12-24 | 中国联合网络通信集团有限公司 | Black product user identification method, TEE node and computer readable storage medium |
| CN115967523A (en) * | 2022-10-20 | 2023-04-14 | 天翼数字生活科技有限公司 | Black product user identification method and device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8484730B1 (en) * | 2011-03-10 | 2013-07-09 | Symantec Corporation | Systems and methods for reporting online behavior |
| CN108540431A (en) * | 2017-03-03 | 2018-09-14 | 阿里巴巴集团控股有限公司 | The recognition methods of account type, device and system |
| CN110620770A (en) * | 2019-09-19 | 2019-12-27 | 微梦创科网络科技（中国）有限公司 | Method and device for analyzing network black product account number |
| CN111767315A (en) * | 2020-06-29 | 2020-10-13 | 北京奇艺世纪科技有限公司 | Black product identification method and device, electronic equipment and storage medium |
| CN111783073A (en) * | 2020-07-23 | 2020-10-16 | 北京斗米优聘科技发展有限公司 | Black product identification method and device and readable storage medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10332116B2 (en) * | 2015-10-06 | 2019-06-25 | Netflix, Inc. | Systems and methods for fraudulent account detection and management |
-
2020
- 2020-12-10 CN CN202011435122.5A patent/CN112533209B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8484730B1 (en) * | 2011-03-10 | 2013-07-09 | Symantec Corporation | Systems and methods for reporting online behavior |
| CN108540431A (en) * | 2017-03-03 | 2018-09-14 | 阿里巴巴集团控股有限公司 | The recognition methods of account type, device and system |
| CN110620770A (en) * | 2019-09-19 | 2019-12-27 | 微梦创科网络科技（中国）有限公司 | Method and device for analyzing network black product account number |
| CN111767315A (en) * | 2020-06-29 | 2020-10-13 | 北京奇艺世纪科技有限公司 | Black product identification method and device, electronic equipment and storage medium |
| CN111783073A (en) * | 2020-07-23 | 2020-10-16 | 北京斗米优聘科技发展有限公司 | Black product identification method and device and readable storage medium |
Non-Patent Citations (3)
| Title |
|---|
| Password authentication with secured login interface at application layer;Agrawal VK 等;International Journal of Computer Science&Network Security;全文 * |
| 基于图数据库与机器学习的业务安全风控平台;方国强;包森成;王晨;;网络安全技术与应用(第02期);全文 * |
| 运营商电商业务安全防护体系研究;韩晶;赵锡成;黄文良;;邮电设计技术(第04期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112533209A (en) | 2021-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112533209B (en) | Black product identification method and black product identification device | |
| CN109862018B (en) | Anti-crawler method and system based on user access behavior | |
| EP3373543B1 (en) | Service processing method and apparatus | |
| US20190260839A1 (en) | Method and system for predicting a geographic location of a network entity | |
| CN104144419A (en) | Identity authentication method, device and system | |
| US11283796B2 (en) | Systems and methods for real-time detection of compromised authentication credentials | |
| CN111556059A (en) | Abnormity detection method, abnormity detection device and terminal equipment | |
| CN110609937A (en) | Crawler identification method and device | |
| CN105635126A (en) | Malicious URL access protection method, client side, security server and system | |
| CN110474903B (en) | Trusted data acquisition method and device and block link point | |
| CN110677384B (en) | Phishing website detection method and device, storage medium and electronic device | |
| CN108075888B (en) | Dynamic URL generation method and device, storage medium and electronic equipment | |
| CN109241733A (en) | Crawler Activity recognition method and device based on web access log | |
| CN109582844A (en) | A kind of method, apparatus and system identifying crawler | |
| CN111488626A (en) | Data processing method, device, equipment and medium based on block chain | |
| CN105306202A (en) | Identity verification method and device, server | |
| CN111783073A (en) | Black product identification method and device and readable storage medium | |
| CN104778389A (en) | Numerical value transferring method, terminal, server and system | |
| CN110297948B (en) | Relational network construction method and device | |
| CN105227532A (en) | A kind of blocking-up method of malicious act and device | |
| CN113660257B (en) | Request interception method, apparatus, electronic device and computer readable storage medium | |
| CN113220949B (en) | Construction method and device of private data identification system | |
| CN113674083A (en) | Internet financial platform credit risk monitoring method, device and computer system | |
| CN108847962B (en) | Information auditing method and device | |
| CN107465744B (en) | Data downloading control method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |