CN111724194B - Substitute device detection method, system, mobile terminal and storage medium - Google Patents
Substitute device detection method, system, mobile terminal and storage medium Download PDFInfo
- Publication number
- CN111724194B CN111724194B CN202010382998.1A CN202010382998A CN111724194B CN 111724194 B CN111724194 B CN 111724194B CN 202010382998 A CN202010382998 A CN 202010382998A CN 111724194 B CN111724194 B CN 111724194B
- Authority
- CN
- China
- Prior art keywords
- account
- recharging
- equipment
- value
- acquiring
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0207—Discounts or incentives, e.g. coupons or rebates
- G06Q30/0225—Avoiding frauds
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/018—Certifying business or products
- G06Q30/0185—Product, service or business identity fraud
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Abstract
The invention provides a method, a system, a mobile terminal and a storage medium for detecting a substitute device, wherein the method comprises the following steps: acquiring a device ID of a device to be detected, and acquiring a first account detail for account recharging of a target application based on the device ID; acquiring a network IP of the equipment to be detected, and acquiring a second account detail for account recharging of the target application based on the network IP; the method comprises the steps of obtaining recharging information of all accounts in a first account detail and a second account detail, and calculating abnormal values of equipment according to the recharging information, the first account detail and the second account detail; if the abnormal value of the equipment is larger than the abnormal threshold value, the equipment to be detected is marked as the substitute equipment, and the substitute equipment is limited by recharging in the target application. When the abnormal value of the equipment is larger than the abnormal threshold value, the equipment to be detected is judged as the substitute equipment, the substitute cost is improved by recharging and limiting the substitute equipment, the substitute behavior of a substitute platform can be effectively limited, and the effect of anti-substitute sanction is improved.
Description
Technical Field
The invention belongs to the technical field of substitute charging detection, and particularly relates to a substitute charging equipment detection method, a substitute charging equipment detection system, a mobile terminal and a storage medium.
Background
With the rapid development of the mobile internet, various mobile phone APP applications are continuously released by many internet companies, which continuously change our lives and continuously provide better services for people, including member VIP service, purchase of paid albums of content providers, recharge of virtual commodities of games, and the like, which more or less require users to pay for recharging, which is convenient for the users and also promotes the internet companies to release better contents and services.
The APP application is mainly mobile phone software running at a mobile terminal, two systems with the largest market share of the mobile terminal at present are distributed in an android IOS system and an apple IOS system, which respectively account for about 70% and 30%, when a user and the Internet recharge the mobile terminals such as mobile phones of the IOS system, a payment policy set by an apple company needs to be followed, however, in the recharging process of the APP application of the IOS version, a substitution charging loophole appears, so-called substitution charging is that the user recharges and purchases virtual items such as VIP member services, payment contents or game equipment for own account numbers through a substitution charging platform, after the virtual items reach the account numbers, the substitution charging platform initiates a refund application to the apple company, but the virtual items cannot be refunded to the related Internet company, and the user can obtain the virtual items with dozens of money through a regular channel by paying only little cost in the whole process, the substitution platform can obtain a profit through payment of the substitution user, and the apple company can still charge more than 30% of commission charge to the internet company in spite of successful reimbursement initiation, and the related internet companies bear huge loss in the whole substitution process.
In the existing generation and detection processes, user accounts with generation behaviors are detected, and when the generation behaviors of the user accounts are judged, the generation and the limitation or the number sealing and the like are carried out on the accounts.
Disclosure of Invention
The embodiment of the invention aims to provide a method, a system, a mobile terminal and a storage medium for detecting a substitution device, and aims to solve the problem of poor anti-substitution sanction effect caused by the fact that the substitution behavior of a substitution platform cannot be effectively limited in the existing substitution detection process.
The embodiment of the invention is realized in such a way that a substitute device detection method comprises the following steps:
acquiring a device ID of a device to be detected, and acquiring a first account detail for account recharging of a target application based on the device ID;
acquiring a network IP of the device to be detected, and acquiring a second account detail for account recharging of the target application based on the network IP;
acquiring recharging information of all accounts in the first account detail and the second account detail, and calculating abnormal values of the equipment according to the recharging information, the first account detail and the second account detail;
if the abnormal value of the equipment is larger than the abnormal threshold value, the equipment to be detected is marked as substitute equipment, and the substitute equipment is limited by recharging in the target application.
Further, the step of calculating the abnormal value of the device according to the recharging information, the first account details and the second account details comprises:
acquiring a user login IP address stored in the recharging information, and judging whether a physical address corresponding to the user login IP address is in a preset area range or not;
when any physical address is judged not to be in the preset area range, weighting a preset abnormal value;
acquiring the number of different account numbers in the first account number detail to obtain a first number value, and judging whether the first number value is greater than or equal to a first threshold value;
when the first quantity value is judged to be larger than or equal to the first threshold value, weighting the preset abnormal value;
acquiring the number of different account numbers in the second account number detail to obtain a second number value, and judging whether the second number value is greater than or equal to a second threshold value;
and when the second numerical value is judged to be larger than or equal to the second threshold value, weighting the preset abnormal value.
Still further, the method further comprises:
judging whether a high-risk account is logged in the equipment to be detected;
when the high-risk account number is judged to be logged in the equipment to be detected, whether the high-risk account number has a recharging behavior on the target application on the equipment to be detected is judged;
and when judging that the high-risk account number has a charging behavior on the target application on the equipment to be detected, marking the equipment to be detected as the substitute equipment, and limiting charging on the substitute equipment in the target application.
Further, before the step of judging whether the high-risk account is logged on the device to be detected, the method further includes:
acquiring a recharging log and an operation behavior log of a user account in a target application, and judging whether a basic game execution behavior exists after the user account finishes recharging operation according to the recharging log and the operation behavior log;
when judging that the basic game behavior is not executed after the user account finishes recharging operation, carrying out recharging abnormal marking on the user account;
and when the number of times of the abnormal recharging marks of any user account is greater than the preset number of times, marking the user account as a high-risk account.
Further, before the step of judging whether the high-risk account is logged on the device to be detected, the method further includes:
judging whether a cross-region recharging behavior of the user account exists within a first preset time;
when the fact that the user account has the cross-region recharging behavior within the first preset time is judged, whether the login quantity of the login IP of the user account within the second preset time is larger than a quantity threshold value is judged;
when the login number of the login IP of the user account in the second preset time is judged to be larger than the number threshold, judging whether abnormal login phenomena exist in login equipment which has logged in the user account;
and when judging that the abnormal login phenomenon exists in the login equipment which logs in the user account, marking the user account as the high-risk account.
Further, the step of determining whether the login device logged in the user account has an abnormal login phenomenon includes:
acquiring login times of the login equipment for different accounts of the target application within third preset time, and judging whether the login times of the accounts are greater than a time threshold value;
and when the login times of the account are judged to be larger than the time threshold value, judging that the login equipment has an abnormal login phenomenon.
Still further, the method further comprises:
acquiring an account number for executing overcharging operation on the target application on the device to be detected to obtain a charging account number;
judging whether a basic game execution behavior exists after the recharging account finishes the recharging operation;
and when judging that the basic game behavior is not executed after the recharging account number completes the recharging operation, marking the device to be detected as a substitute device, and performing recharging limitation on the substitute device in the target application.
Another object of an embodiment of the present invention is to provide a substitute device detection system, including:
the device ID acquisition module is used for acquiring the device ID of the device to be detected and acquiring a first account detail for account recharging of the target application based on the device ID;
the network IP acquisition module is used for acquiring the network IP of the equipment to be detected and acquiring second account details for account recharging of the target application based on the network IP;
the abnormal value calculation module is used for acquiring recharging information of all accounts in the first account detail and the second account detail and calculating the abnormal value of the equipment according to the recharging information, the first account detail and the second account detail;
and the recharging limiting module is used for marking the equipment to be detected as the substitute equipment if the abnormal value of the equipment is greater than the abnormal threshold value, and carrying out recharging limitation on the substitute equipment in the target application.
Another object of an embodiment of the present invention is to provide a mobile terminal, which includes a storage device and a processor, where the storage device is configured to store a computer program, and the processor runs the computer program to enable the mobile terminal to execute the above substitute device detection method.
Another object of an embodiment of the present invention is to provide a storage medium, which stores a computer program used in the mobile terminal, wherein the computer program, when executed by a processor, implements the steps of the above-mentioned substitute device detection method.
According to the embodiment of the invention, the abnormal value of the equipment to be detected is calculated according to the recharging information, the first account number detail and the second account number detail, when the abnormal value of the equipment is judged to be larger than the abnormal threshold value, the equipment to be detected is judged to be the substitute equipment, and the substitute equipment is subjected to recharging limitation, so that the substitute cost is increased, the substitute behavior of a substitute platform can be effectively limited, and the anti-substitute sanction effect is improved.
Drawings
Fig. 1 is a flowchart of a method for detecting a substitute device according to a first embodiment of the present invention;
fig. 2 is a flowchart of a method for detecting a substitute device according to a second embodiment of the present invention;
fig. 3 is a flowchart of a method for detecting a substitute device according to a third embodiment of the present invention;
fig. 4 is a flowchart of a method for detecting a substitute device according to a fourth embodiment of the present invention;
fig. 5 is a flowchart of a substitute device detection method according to a fifth embodiment of the present invention;
FIG. 6 is a schematic structural diagram of a detection system of a substitute device according to a sixth embodiment of the present invention;
fig. 7 is a schematic structural diagram of a mobile terminal according to a seventh embodiment of the present invention.
Detailed Description
In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular system structures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. It will be apparent, however, to one skilled in the art that the present application may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.
It will be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
It should also be understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
As used in this specification and the appended claims, the term "if" may be interpreted contextually as "when", "upon" or "in response to" determining "or" in response to detecting ". Similarly, the phrase "if it is determined" or "if a [ described condition or event ] is detected" may be interpreted contextually to mean "upon determining" or "in response to determining" or "upon detecting [ described condition or event ]" or "in response to detecting [ described condition or event ]".
Furthermore, in the description of the present application and the appended claims, the terms "first," "second," "third," and the like are used for distinguishing between descriptions and not necessarily for describing or implying relative importance.
Reference throughout this specification to "one embodiment" or "some embodiments," or the like, means that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," or the like, in various places throughout this specification are not necessarily all referring to the same embodiment, but rather "one or more but not all embodiments" unless specifically stated otherwise. The terms "comprising," "including," "having," and variations thereof mean "including, but not limited to," unless expressly specified otherwise.
Example one
Referring to fig. 1, a flowchart of a method for detecting a substitute device according to a first embodiment of the present invention is shown, which includes the steps of:
step S10, acquiring the equipment ID of the equipment to be detected, and acquiring the first account details for account recharging of the target application based on the equipment ID;
the device ID is a device DeviceID, each device to be detected corresponds to a unique device ID, a user can recharge a user account number which is currently logged in a target application, the device ID on the device to be detected is bound with a payment account number preset by the user in advance, and the payment account number is an application with a payment function, such as a bank card number, a Paibao account number or a WeChat account number;
specifically, in this embodiment, when a user charges a currently logged user account in a target application based on the device ID of the device to be detected, charging information is automatically recorded to generate a charging log, and the charging log is stored with the target application, where the charging log includes the device ID, the currently charged user account, a charging amount, a charging item, and charging time;
therefore, in this step, the recharging log corresponding to the target application is queried based on the device ID to obtain the first account list, where all user accounts performing overcharging on the target application based on the device ID are stored in the first account list;
step S20, acquiring the network IP of the device to be detected, and acquiring a second account detail for account recharging of the target application based on the network IP;
the network IP is a network card IP of the device to be detected, when a user recharges a user account currently logged in a target application, the network IP of the user account logged in is recorded, and the network IP is correspondingly added to a corresponding recharging log;
therefore, in this step, the recharging log corresponding to the target application is queried based on the network IP to obtain the second account list, in which all the user accounts performing the overcharging behavior on the target application based on the network IP are stored;
step S30, obtaining the recharging information of all accounts in the first account detail and the second account detail, and calculating the abnormal value of the equipment according to the recharging information, the first account detail and the second account detail;
the recharging information stores a recharging address of the device to be detected for each recharging of the target application, namely when a user recharges a user account currently logged in the target application through the device to be detected, the current address of the device to be detected is obtained, the current address is set as a recharging address of a current recharging behavior, and the recharging address is added into a corresponding recharging log;
specifically, in the step, whether a transnational recharging behavior, a transprovincial recharging behavior or a recharging behavior across a preset region occurs on the device to be detected aiming at the target application is judged according to the recharging information, and when the transnational recharging behavior, the transprovincial recharging behavior or the recharging behavior across the preset region is judged, a preset abnormal value is weighted;
in this step, the preset abnormal value is weighted again according to the number of accounts in the first account details and the second account details to obtain the abnormal value of the device, it should be noted that weighted values when the preset abnormal value is weighted respectively based on the recharge information, the first account details and the second account details may be the same or different, and the weighted value may be set according to requirements, for example, weighted values of the preset abnormal value according to the recharge information, the first account details and the second account details may be 1, 2, 3 or 4, respectively;
step S40, judging whether the abnormal value of the equipment is larger than an abnormal threshold value;
the abnormal threshold may be set according to requirements, for example, the abnormal threshold may be set to a value of 23 or 4;
if the abnormal value of the equipment is smaller than or equal to the abnormal threshold value, judging that the equipment to be detected is not substitute equipment;
if the abnormal value of the equipment is larger than the abnormal threshold value, executing step S50;
step S50, marking the device to be detected as a substitute device, and performing charging limitation on the substitute device in the target application;
the method comprises the following steps that through the design of charging limitation on a substitute charging device, a user cannot charge an account number of the target application based on the substitute charging device, and the cost of a substitute charging behavior is further improved;
preferably, in the step, a recharging blacklist is generated based on the mark of the substitute device, the recharging blacklist stores the device ID and the network IP of each substitute device, when the user is judged to recharge the target application based on the device ID and the network IP in the recharging blacklist, the recharging behavior is stopped, and a recharging error prompt is sent out;
according to the embodiment, the abnormal value of the equipment to be detected is calculated according to the recharging information, the first account number detail and the second account number detail, when the abnormal value of the equipment is judged to be larger than the abnormal threshold value, the equipment to be detected is judged to be the substitute equipment, the substitute equipment is limited by recharging, so that the substitute cost is increased, the substitute behavior of the substitute platform can be effectively limited, and the anti-substitute filing and sanction effect is improved.
Example two
Referring to fig. 2, a flowchart of a method for detecting a substitute device according to a second embodiment of the present invention is shown, which includes the steps of:
step S11, acquiring the equipment ID of the equipment to be detected, and acquiring the first account details for account recharging of the target application based on the equipment ID;
step S21, acquiring the network IP of the device to be detected, and acquiring a second account detail for account recharging of the target application based on the network IP;
step S31, obtaining the recharging information of all accounts in the first account number detail and the second account number detail, and obtaining the user login IP address stored in the recharging information;
step S41, judging whether the physical address corresponding to the user login IP address is in a preset area range;
the user login IP address is matched with a local pre-stored address database to inquire a corresponding physical address, and the address database stores corresponding relations between different login IP addresses and physical addresses;
preferably, the origin coordinate, the area and the shape of the area of the preset area range may be set as required, for example, the preset area may be set as any one of a designated city area, a designated province area or a designated country area, for example, the preset area may be set as an area corresponding to beijing, shanghai, jiangxi, province or china;
further, in this step, the method further includes:
acquiring the spacing distance between the physical addresses in the adjacent login times, and judging whether the spacing distance is greater than a preset distance;
when it is determined that the separation distance is greater than the preset distance, performing step S51;
for example, if the physical address corresponding to the target application of the device to be tested for the first recharge is a1, and the physical address for the second recharge is a2, the distance between the physical address a1 and the physical address a2 is calculated, preferably, the preset distance may be set according to the requirement, for example, the preset distance may be set to 500 km, 600 km, 1000 km, or the like;
when it is determined that any of the physical addresses is not within the preset area range, performing step S51;
step S51, weighting the preset abnormal value to obtain an equipment abnormal value;
when any physical address is judged not to be in the preset area range, the weighted value for weighting the preset abnormal value can be set according to requirements, the preset abnormal value can also be set according to requirements, the weighted value in the step is 1, and the preset abnormal value is 0;
step S61, acquiring the number of different account numbers in the first account number specification to obtain a first number value;
when the number of the different account numbers stored in the first account number detail is judged to be 4, the first number value is judged to be 4, and when the number of the different account numbers stored in the first account number detail is 5, the first number value is judged to be 5;
step S71, determining whether the first quantity value is greater than or equal to a first threshold;
the first preset value can be set according to requirements, and the first threshold value in the step is set to be 3, that is, whether the first quantity value is greater than or equal to 3 is judged;
when the first quantity value is judged to be greater than or equal to the first threshold value, executing step 51;
when the first quantity value is judged to be greater than or equal to the first threshold value, the weighted value for weighting the preset abnormal value can be set according to requirements, and in the step, the weighted value for weighting the preset abnormal value based on the first quantity value is 1;
step S81, acquiring the number of different account numbers in the second account number specification to obtain a second number value;
when the number of the different account numbers stored in the second account number list is judged to be 4, the second numerical value is judged to be 4, and when the number of the different account numbers stored in the second account number list is 5, the second numerical value is judged to be 5;
step S91, determining whether the second numerical value is greater than or equal to a second threshold;
when the second numerical value is judged to be greater than or equal to the second threshold value, executing step S51;
when the second numerical value is greater than or equal to the second threshold value, the weighting value for weighting the preset abnormal value can be set according to requirements, and in the step, the weighting value for the preset abnormal value based on the second numerical value is 1;
in addition, in this embodiment, when it is determined in step S41 that any of the physical addresses is within the preset region range, the preset abnormal value is not weighted based on the physical address;
when the step S71 determines that the first quantity value is smaller than the first threshold, the preset abnormal value is not weighted based on the first quantity value;
when the step S91 determines that the second numerical value is smaller than the second threshold, the preset abnormal value is not weighted based on the second numerical value;
step S101, judging whether the abnormal value of the equipment is larger than an abnormal threshold value or not;
the abnormality threshold may be set as required, in which the abnormality threshold is set to 2, and the weighted value of the preset abnormality value based on the physical address, the first numerical value and the second numerical value is 1, so that when two or more determination results in step S41, step S71 and step S91 are determined to be yes, the apparatus abnormality value is greater than or equal to the abnormality threshold;
if the abnormal value of the equipment is larger than the abnormal threshold value, executing a step S111;
and step S111, marking the device to be detected as a substitute device, and performing recharge limitation on the substitute device in the target application.
In the embodiment, the abnormal value of the equipment to be detected is calculated according to the recharging information, the first account number detail and the second account number detail, when the abnormal value of the equipment is judged to be larger than the abnormal threshold value, the equipment to be detected is judged to be the replacement equipment, the replacement equipment is limited by recharging, the replacement cost is improved, the replacement behavior of the replacement platform can be effectively limited, and the anti-replacement, charging and sanction effects are improved.
EXAMPLE III
Referring to fig. 3, a flowchart of a method for detecting a substitute device according to a third embodiment of the present invention is shown, which includes the steps of:
step S12, obtaining the recharging log and the operation behavior log of the user account in the target application;
wherein, the recharging log stores the recharging time, the recharging device ID, the recharging network IP, the recharging device amount, the recharging item and the recharging physical address of the user account for the target application each time;
preferably, the operation behavior log stores operation text expressions of the user account in the target application within the corresponding login time, for example, the user account performs a game operation in the target application from 06 o 00 o 'clock 1/2020 to 06 o 20 o' clock 3/1/2020, for example, the user account performs a mall preview operation in the target application from 07 o 'clock 00 o' clock 07 o 'clock 00 o' clock 3/1/2020;
step S22, according to the recharging log and the operation behavior log, judging whether the user account finishes the recharging operation and then has the basic game execution behavior;
wherein the base game behavior specifies a most basic behavior that a curated cognitive game player will undertake;
when it is determined that the basic game behavior is not executed after the user account completes the recharge operation, executing step S32;
step S32, carrying out abnormal recharging marks on the user accounts, and marking the user accounts as high-risk accounts when the times of the abnormal recharging marks of any user account are more than the preset times;
the preset times can be set according to requirements, for example, the preset times can be set to 100 times, when the number of the abnormal recharging marks on any user account is greater than 100 times, the user account is marked as a high-risk account, and it is determined that a recharging behavior may exist in the user account;
preferably, in this embodiment, the clearing operation is performed on the number of times of the abnormal recharge flag on all the user accounts according to a preset time interval, for example, the preset time interval may be set to 1 year, and when the number of times of creation of the user account is every full year, the number of times of the abnormal recharge flag on the user account is cleared, so that the accuracy of determining the high-risk account is improved;
step S42, judging whether a high-risk account is logged on the device to be detected;
when the high-risk account number is judged to be logged in on the device to be detected, executing step S52;
step S52, judging whether the high-risk account has a recharging behavior on the target application on the equipment to be detected;
the method comprises the steps of obtaining a network IP and an equipment ID of equipment to be detected, and matching a recharging log of a high-risk account on the basis of the network IP and the equipment ID to judge whether the high-risk account has recharging behaviors on target application on the equipment to be detected;
when the high-risk account number is judged to have the charging behavior on the target application on the device to be detected, executing step S62;
step S62, marking the device to be detected as the substitute device, and performing charging limitation on the substitute device in the target application;
in the embodiment, the replacement equipment is charged for limitation, so that the replacement cost is improved, the replacement behavior of the replacement platform can be effectively limited, and the anti-generation filling and sanction effect is improved.
Example four
Referring to fig. 4, a flowchart of a method for detecting a substitute device according to a fourth embodiment of the present invention is shown, which includes the steps of:
step S13, judging whether the user account has a cross-region recharging behavior within a first preset time;
the first preset time can be set according to a requirement, for example, the first preset time can be set to 1 week, 1 month, or 1 year;
specifically, in this step, it may be determined whether the user account has a cross-region recharging behavior by determining whether the recharging physical address of the user account is within a preset region range, and preferably, the origin coordinate, the region area, and the region shape of the preset region range may be set as required;
for example, the preset region may be set as any one of a designated city region, a designated province region, or a designated country region, for example, the preset region may be set as a region corresponding to beijing in a city, a region corresponding to shanghai in a city, a region corresponding to Jiangxi in province, or a region corresponding to china in a country;
when it is determined that the user account has a cross-region recharging behavior within the first preset time, executing step S23;
step S23, judging whether the login number of the login IP of the user account in a second preset time is larger than a number threshold;
the second preset time and the number threshold may be set according to requirements, for example, the second preset time may be set to 30 seconds, 1 minute, or 2 minutes, and the number threshold may be set to 5 times, 10 times, or 15 times, and the like;
when the login number of the login IP of the user account in the second preset time is judged to be larger than the number threshold, executing step S33;
step S33, judging whether the abnormal login phenomenon exists in the login equipment logged in the user account;
specifically, in this step, the step of determining whether the login device that has logged in the user account has an abnormal login phenomenon includes:
acquiring login times of the login equipment for different accounts of the target application within third preset time, and judging whether the login times of the accounts are greater than a time threshold value;
and when the login times of the account are judged to be larger than the time threshold value, judging that the login equipment has an abnormal login phenomenon.
When it is determined that the abnormal login phenomenon exists in the login device that has logged in the user account, performing step S43;
step S43, marking the user account as the high-risk account;
step S53, judging whether a high-risk account is logged on the equipment to be detected;
when the high-risk account number is judged to be logged in on the device to be detected, executing step S63;
step S63, judging whether the high-risk account has a recharging behavior on the target application on the device to be detected;
when the high-risk account number is judged to have the charging behavior on the target application on the device to be detected, executing step S73;
step S73, marking the device to be detected as the substitute device, and performing charging limitation on the substitute device in the target application;
in the embodiment, the replacement equipment is charged for limitation, so that the replacement cost is improved, the replacement behavior of the replacement platform can be effectively limited, and the anti-generation filling and sanction effect is improved.
EXAMPLE five
Referring to fig. 5, a flowchart of a method for detecting a substitute device according to a fifth embodiment of the present invention is shown, including the steps of:
step S14, acquiring the equipment ID of the equipment to be detected, and acquiring the first account details for account recharging of the target application based on the equipment ID;
step S24, acquiring the network IP of the device to be detected, and acquiring a second account detail for account recharging of the target application based on the network IP;
step S34, obtaining the recharging information of all accounts in the first account detail and the second account detail, and calculating the abnormal value of the equipment according to the recharging information, the first account detail and the second account detail;
step S44, judging whether the abnormal value of the equipment is larger than an abnormal threshold value;
if the device abnormal value is less than or equal to the abnormal threshold, executing step S54;
step S54, obtaining an account number of the target application on the device to be detected for executing overcharging operation, and obtaining a charging account number;
whether the account number in the account number information is recharged to the target application based on the network IP or the equipment ID of the equipment to be detected or not is judged in sequence, and the account number which is recharged to the target application based on the network IP or the equipment ID is marked as the recharging account number;
step S64, judging whether the recharging account number completes the recharging operation and then has the basic game execution behavior;
the basic game behavior specifies the most basic behavior that the game player who plans to recognize will perform, for example, the basic game behavior may be "a game that has been performed for at least 10 minutes after the completion of the recharging operation" or "an item that has been purchased for at least a preset amount of money after the completion of the recharging operation" or the like;
when the fact that the basic game behavior is executed after the recharging account number completes the recharging operation is judged, the fact that the device to be detected is not a substitute device is judged;
when it is determined that the basic game behavior is not executed after the recharging account completes the recharging operation, executing step S74;
step S74, marking the device to be detected as a substitute device, and performing charging limitation on the substitute device in the target application;
in the embodiment, the replacement equipment is limited by recharging to improve the replacement cost, so that the replacement behavior of the replacement platform can be effectively limited, and the anti-replacement sanction effect is improved.
EXAMPLE six
Referring to fig. 6, a schematic structural diagram of a detection system 100 for a substitute device according to a sixth embodiment of the present invention is shown, including: an equipment ID acquisition module 10, a network IP acquisition module 11, an abnormal value calculation module 12 and a recharge limiting module 13, wherein:
the device ID obtaining module 10 is configured to obtain a device ID of a device to be detected, and obtain a first account detail for account recharging of a target application based on the device ID;
the network IP obtaining module 11 is configured to obtain a network IP of the device to be detected, and obtain a second account detail for performing account recharging on the target application based on the network IP;
and the abnormal value calculating module 12 is configured to obtain recharging information of all accounts in the first account details and the second account details, and calculate an abnormal value of the device according to the recharging information, the first account details and the second account details.
Wherein the outlier calculation module 12 is further configured to: acquiring a user login IP address stored in the recharging information, and judging whether a physical address corresponding to the user login IP address is in a preset area range or not;
when any physical address is judged not to be in the preset area range, weighting a preset abnormal value;
acquiring the number of different account numbers in the first account number detail to obtain a first number value, and judging whether the first number value is greater than or equal to a first threshold value;
when the first quantity value is judged to be larger than or equal to the first threshold value, weighting the preset abnormal value;
acquiring the number of different account numbers in the second account number detail to obtain a second number value, and judging whether the second number value is greater than or equal to a second threshold value;
and when the second numerical value is judged to be larger than or equal to the second threshold value, weighting the preset abnormal value.
And the recharge limiting module 13 is configured to mark the device to be detected as a substitute device if the abnormal value of the device is greater than the abnormal threshold, and perform recharge limitation on the substitute device in the target application.
In addition, in this embodiment, the substitute device detection system 100 further includes:
the high-risk account detection module 14 is used for judging whether a high-risk account is logged in the device to be detected;
when the high-risk account number is judged to be logged in the equipment to be detected, whether the high-risk account number has a recharging behavior on the target application on the equipment to be detected is judged;
and when judging that the high-risk account number has a charging behavior on the target application on the equipment to be detected, marking the equipment to be detected as the substitute equipment, and limiting charging on the substitute equipment in the target application.
Preferably, the high-risk account detection module 14 is further configured to: acquiring a recharging log and an operation behavior log of a user account in a target application, and judging whether a basic game execution behavior exists after the user account finishes recharging operation according to the recharging log and the operation behavior log;
when judging that the basic game behavior is not executed after the user account finishes recharging operation, carrying out recharging abnormal marking on the user account;
and when the number of times of the charging abnormity marking of any user account is larger than the preset number of times, marking the user account as a high-risk account.
Further, the high risk account detection module 14 is further configured to: judging whether a cross-region recharging behavior of the user account exists in a first preset time;
when the fact that the user account has the cross-region recharging behavior within the first preset time is judged, whether the login quantity of the login IP of the user account within the second preset time is larger than a quantity threshold value is judged;
when the login number of the login IP of the user account in the second preset time is judged to be larger than the number threshold, judging whether the login equipment which has logged in the user account has an abnormal login phenomenon;
and when judging that the abnormal login phenomenon exists in the login equipment which logs in the user account, marking the user account as the high-risk account.
Still further, the high-risk account detection module 14 is further configured to: acquiring login times of the login equipment for different accounts of the target application within third preset time, and judging whether the login times of the accounts are greater than a time threshold value or not;
and when the login times of the account are judged to be larger than the time threshold value, judging that the login equipment has an abnormal login phenomenon.
In this embodiment, the substitute device detection system 100 further includes:
the account recharging detection module 15 is configured to obtain an account for performing an overcharging operation on the target application on the device to be detected, and obtain a recharging account;
judging whether a basic game execution behavior exists after the recharging account finishes the recharging operation;
and when judging that the basic game behavior is not executed after the recharging account number completes the recharging operation, marking the device to be detected as a substitute device, and performing recharging limitation on the substitute device in the target application.
According to the method and the device, the abnormal value of the device to be detected is calculated according to the recharging information, the first account number detail and the second account number detail, when the abnormal value of the device to be detected is larger than the abnormal threshold value, the device to be detected is judged to be a substitute device, the substitute device is limited by recharging, so that the substitute cost is increased, the substitute behavior of a substitute platform can be effectively limited, and the anti-substitute substituting and suppressing effect is improved.
EXAMPLE seven
Referring to fig. 7, a mobile terminal 101 according to a seventh embodiment of the present invention includes a storage device and a processor, where the storage device is used to store a computer program, and the processor runs the computer program to enable the mobile terminal 101 to execute the above-mentioned substitute device detection method.
The present embodiment also provides a storage medium on which a computer program used in the above-mentioned mobile terminal 101 is stored, which when executed, includes the steps of:
acquiring a device ID of a device to be detected, and acquiring a first account detail for account recharging of a target application based on the device ID;
acquiring a network IP of the device to be detected, and acquiring a second account detail for account recharging of the target application based on the network IP;
acquiring recharging information of all accounts in the first account detail and the second account detail, and calculating abnormal values of the equipment according to the recharging information, the first account detail and the second account detail;
if the abnormal value of the equipment is larger than the abnormal threshold value, the equipment to be detected is marked as substitute equipment, and the substitute equipment is limited in recharging in the target application. The storage medium, such as: ROM/RAM, magnetic disk, optical disk, etc.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-mentioned division of the functional units and modules is used as an example, in practical applications, the above-mentioned function distribution may be performed by different functional units or modules according to needs, that is, the internal structure of the storage device is divided into different functional units or modules to perform all or part of the above-mentioned functions. Each functional unit and module in the embodiments may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit, and the integrated unit may be implemented in a form of hardware, or may be implemented in a form of software functional unit. In addition, specific names of the functional units and modules are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the present application.
Those skilled in the art will appreciate that the component configuration shown in fig. 6 is not intended to limit the surrogate device detection system of the present invention and may include more or fewer components than shown, or some components in combination, or a different arrangement of components, and that the surrogate device detection methods of fig. 1-5 may be implemented using more or fewer components than shown in fig. 6, or some components in combination, or a different arrangement of components. The units, modules, etc. referred to herein are a series of computer programs that can be executed by a processor (not shown) of the target surrogate device detecting system and that can perform a specific function, and all of them can be stored in a storage device (not shown) of the target surrogate device detecting system.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents and improvements made within the spirit and principle of the present invention are intended to be included within the scope of the present invention.
Claims (9)
1. A method for surrogate device detection, the method comprising:
acquiring a device ID of equipment to be detected, and acquiring a first account detail for account recharging of a target application based on the device ID;
acquiring a network IP of the to-be-detected device, and acquiring a second account detail for account recharging of the target application based on the network IP;
acquiring recharging information of all accounts in the first account detail and the second account detail, and calculating abnormal values of the equipment according to the recharging information, the first account detail and the second account detail;
if the abnormal value of the equipment is larger than the abnormal threshold value, marking the equipment to be detected as substitute equipment, and performing recharging limitation on the substitute equipment in the target application;
the step of calculating the abnormal value of the equipment according to the recharging information, the first account number detail and the second account number detail comprises the following steps:
acquiring a user login IP address stored in the recharging information, and judging whether a physical address corresponding to the user login IP address is in a preset area range or not;
when any physical address is judged not to be in the preset area range, weighting a preset abnormal value;
acquiring the number of different account numbers in the first account number detail to obtain a first number value, and judging whether the first number value is greater than or equal to a first threshold value;
when the first quantity value is judged to be larger than or equal to the first threshold value, weighting the preset abnormal value;
acquiring the number of different account numbers in the second account number detail to obtain a second number value, and judging whether the second number value is greater than or equal to a second threshold value;
and when the second numerical value is judged to be larger than or equal to the second threshold value, weighting the preset abnormal value.
2. The surrogate device detecting method of claim 1, further comprising:
judging whether a high-risk account is logged in the equipment to be detected;
when the fact that the high-risk account number logs in the equipment to be detected is judged, whether the high-risk account number has a recharging behavior on the target application on the equipment to be detected is judged;
and when judging that the high-risk account has a charging behavior on the target application on the equipment to be detected, marking the equipment to be detected as the substitute equipment, and limiting charging on the substitute equipment in the target application.
3. The method for detecting substitute equipment according to claim 2, wherein before the step of determining whether the high-risk account is logged on the equipment to be detected, the method further comprises:
acquiring a recharging log and an operation behavior log of a user account in a target application, and judging whether a basic game execution behavior exists after the user account finishes recharging operation according to the recharging log and the operation behavior log;
when judging that the basic game behavior is not executed after the user account finishes recharging operation, carrying out recharging abnormal marking on the user account;
and when the number of times of the abnormal recharging marks of any user account is greater than the preset number of times, marking the user account as a high-risk account.
4. The method for detecting substitute equipment according to claim 2, wherein before the step of determining whether the high risk account number is logged on the equipment to be detected, the method further comprises:
judging whether a cross-region recharging behavior of the user account exists in a first preset time;
when judging that the cross-region recharging behavior exists in the user account within the first preset time, judging whether the login number of the login IP of the user account within the second preset time is larger than a number threshold value or not;
when the login number of the login IP of the user account in the second preset time is judged to be larger than the number threshold, judging whether abnormal login phenomena exist in login equipment which has logged in the user account;
and when judging that the abnormal login phenomenon exists in the login equipment which logs in the user account, marking the user account as the high-risk account.
5. The method for detecting a substitute device according to claim 4, wherein the step of determining whether the login device that has logged in the user account has an abnormal login phenomenon includes:
acquiring login times of the login equipment for different accounts of the target application within third preset time, and judging whether the login times of the accounts are greater than a time threshold value;
and when the login times of the account are judged to be larger than the time threshold value, judging that the login equipment has an abnormal login phenomenon.
6. The method of surrogate device detection as recited in claim 1, the method further comprising:
acquiring an account number for executing overcharging operation on the target application on the device to be detected to obtain a charging account number;
judging whether a basic game execution behavior exists after the recharging account finishes the recharging operation;
and when judging that the basic game behavior is not executed after the recharging account number completes the recharging operation, marking the device to be detected as a substitute device, and performing recharging limitation on the substitute device in the target application.
7. A surrogate device detection system, the system comprising:
the device ID acquisition module is used for acquiring the device ID of the device to be detected and acquiring a first account detail for account recharging of the target application based on the device ID;
the network IP acquisition module is used for acquiring the network IP of the equipment to be detected and acquiring a second account detail for account recharging of the target application based on the network IP;
the abnormal value calculation module is used for acquiring recharging information of all accounts in the first account detail and the second account detail and calculating the abnormal value of the equipment according to the recharging information, the first account detail and the second account detail;
the recharging limiting module is used for marking the equipment to be detected as the substitute equipment if the abnormal value of the equipment is greater than the abnormal threshold value, and conducting recharging limitation on the substitute equipment in the target application;
the outlier calculation module is further configured to: acquiring a user login IP address stored in the recharging information, and judging whether a physical address corresponding to the user login IP address is in a preset area range or not;
when any physical address is judged not to be in the preset area range, weighting a preset abnormal value;
acquiring the number of different account numbers in the first account number detail to obtain a first number value, and judging whether the first number value is greater than or equal to a first threshold value;
when the first quantity value is judged to be larger than or equal to the first threshold value, weighting the preset abnormal value;
acquiring the number of different account numbers in the second account number detail to obtain a second number value, and judging whether the second number value is greater than or equal to a second threshold value;
and when the second numerical value is judged to be larger than or equal to the second threshold value, weighting the preset abnormal value.
8. A mobile terminal, characterized by comprising a storage device for storing a computer program and a processor for executing the computer program to cause the mobile terminal to perform the surrogate device detecting method according to any one of claims 1-6.
9. A storage medium, characterized in that it stores a computer program for use in a mobile terminal according to claim 8, which computer program, when executed by a processor, implements the steps of the proxy device detection method according to any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010382998.1A CN111724194B (en) | 2020-05-08 | 2020-05-08 | Substitute device detection method, system, mobile terminal and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010382998.1A CN111724194B (en) | 2020-05-08 | 2020-05-08 | Substitute device detection method, system, mobile terminal and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111724194A CN111724194A (en) | 2020-09-29 |
| CN111724194B true CN111724194B (en) | 2022-09-06 |
Family
ID=72564385
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010382998.1A Active CN111724194B (en) | 2020-05-08 | 2020-05-08 | Substitute device detection method, system, mobile terminal and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111724194B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9781152B1 (en) * | 2013-09-11 | 2017-10-03 | Google Inc. | Methods and systems for performing dynamic risk analysis using user feedback |
| CN108171519A (en) * | 2016-12-07 | 2018-06-15 | 阿里巴巴集团控股有限公司 | The processing of business datum, account recognition methods and device, terminal |
| US10148683B1 (en) * | 2016-03-29 | 2018-12-04 | Microsoft Technology Licensing, Llc | ATO threat detection system |
| CN110335098A (en) * | 2019-04-24 | 2019-10-15 | 上海恺英网络科技有限公司 | Order recognition methods and equipment at production payment center service end |
-
2020
- 2020-05-08 CN CN202010382998.1A patent/CN111724194B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9781152B1 (en) * | 2013-09-11 | 2017-10-03 | Google Inc. | Methods and systems for performing dynamic risk analysis using user feedback |
| US10148683B1 (en) * | 2016-03-29 | 2018-12-04 | Microsoft Technology Licensing, Llc | ATO threat detection system |
| CN108171519A (en) * | 2016-12-07 | 2018-06-15 | 阿里巴巴集团控股有限公司 | The processing of business datum, account recognition methods and device, terminal |
| CN110335098A (en) * | 2019-04-24 | 2019-10-15 | 上海恺英网络科技有限公司 | Order recognition methods and equipment at production payment center service end |
Non-Patent Citations (1)
| Title |
|---|
| 《中国优秀硕士学位论文全文数据库》;王耀钧;《中国优秀硕士学位论文全文数据库》;20191230;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111724194A (en) | 2020-09-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107391359B (en) | Service testing method and device | |
| CN107133841A (en) | A kind of charging pile website recommendation method and apparatus | |
| CN108134944B (en) | Identification method and device for anchor user with abnormal income and electronic equipment | |
| CN106886906B (en) | Equipment identification method and device | |
| CN109509020B (en) | Coupon amount checking method and device | |
| CN113112254A (en) | Regional message sharing method and device | |
| CN111050344B (en) | Base station operation and maintenance guarantee method and equipment | |
| CN112150252A (en) | Credit-based service processing method and device | |
| CN110675213B (en) | Method and device for putting credit service product and electronic equipment | |
| CN111275418A (en) | Car rental management method and related equipment | |
| CN111724194B (en) | Substitute device detection method, system, mobile terminal and storage medium | |
| CN113256330A (en) | Information delivery effect attribution method and device | |
| CN110363648B (en) | Multi-dimensional attribute verification method and device based on same geographic type and electronic equipment | |
| CN111163428B (en) | Method and server for generating short message bill | |
| CN111651345A (en) | System testing method and device and electronic equipment | |
| CN111144987A (en) | Abnormal shopping behavior limiting method, limiting assembly and shopping system | |
| CN109658083A (en) | Memory, broadband fee payment method, device and equipment based on wechat small routine | |
| CN111127050A (en) | Content channel evaluation method and device, electronic equipment and storage medium | |
| CN110969493A (en) | Bill amount determining method and device, electronic equipment and storage medium | |
| CN110300000B (en) | Charging mode changing method and device, electronic equipment and readable storage medium | |
| CN111542005B (en) | Charging method, device, equipment and storage medium | |
| CN115131085A (en) | Method, device and equipment for processing super package bills | |
| CN111163051B (en) | Service ordering method, device and terminal equipment | |
| CN108270579B (en) | Method and device for determining expected value of balance | |
| CN112235395A (en) | Data distribution method and system based on network routing |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |