CN113568828A - Abnormal terminal equipment identification method and device, electronic equipment and storage medium - Google Patents

Abnormal terminal equipment identification method and device, electronic equipment and storage medium Download PDF

Info

Publication number
CN113568828A
CN113568828A CN202110741403.1A CN202110741403A CN113568828A CN 113568828 A CN113568828 A CN 113568828A CN 202110741403 A CN202110741403 A CN 202110741403A CN 113568828 A CN113568828 A CN 113568828A
Authority
CN
China
Prior art keywords
information
equipment
device information
terminal
abnormal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110741403.1A
Other languages
Chinese (zh)
Inventor
陈英岳
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Dajia Internet Information Technology Co Ltd
Original Assignee
Beijing Dajia Internet Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Dajia Internet Information Technology Co Ltd filed Critical Beijing Dajia Internet Information Technology Co Ltd
Priority to CN202110741403.1A priority Critical patent/CN113568828A/en
Publication of CN113568828A publication Critical patent/CN113568828A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3604—Software analysis for verifying properties of programs
    • G06F11/3608—Software analysis for verifying properties of programs using formal methods, e.g. model checking, abstract interpretation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0635—Risk analysis of enterprise or organisation activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G06F18/232—Non-hierarchical techniques
    • G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
    • G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Human Resources & Organizations (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Quality & Reliability (AREA)
  • General Engineering & Computer Science (AREA)
  • Strategic Management (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Economics (AREA)
  • Evolutionary Biology (AREA)
  • Marketing (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Development Economics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Educational Administration (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Game Theory and Decision Science (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • Operations Research (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Tourism & Hospitality (AREA)
  • General Business, Economics & Management (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Telephone Function (AREA)

Abstract

The disclosure shows an abnormal terminal device identification method, an abnormal terminal device identification device, an electronic device and a storage medium, wherein device information of a terminal device is obtained, and the device information of the terminal device comprises first device information, second device information and third device information; comparing the first device information with preset reference information, and matching the second device information with the third device information; and if the first equipment information is inconsistent with the preset reference information and/or the second equipment information is not matched with the third equipment information, judging that the terminal equipment is abnormal terminal equipment. According to the method and the device, the abnormal terminal device can be identified only by relying on a small amount of device information, and the abnormal account can be identified from the device layer. According to the scheme, the abnormal terminal equipment is determined according to the comparison result of the first equipment information and the preset reference information and the matching result of the second equipment information and the third equipment information, so that the abnormal terminal equipment can be identified more accurately, and the antagonism is enhanced.

Description

Abnormal terminal equipment identification method and device, electronic equipment and storage medium
Technical Field
The present disclosure relates to the field of computer technologies, and in particular, to a method and an apparatus for identifying an abnormal terminal device, an electronic device, and a computer-readable storage medium.
Background
In the related art, the application platform usually issues an electronic resource to a new registered account. In order to obtain more electronic resources, some users may disguise the terminal device by means of changing the terminal device (e.g., modifying the model or IP of the terminal device by an automation technology, etc.) or a simulator, etc., and use different account numbers to log in application software, so that the application platform recognizes the terminal device as a new account number to achieve the purpose of obtaining electronic resources. This behavior causes the loss of electronic resources of the application platform, destroys the fairness of users in participating in the electronic resource activities, and also damages the image of the application platform.
Therefore, identifying abnormal terminal devices is a technical problem that needs to be solved urgently by those skilled in the art.
Disclosure of Invention
The present disclosure provides an abnormal terminal device identification method, apparatus, electronic device and computer readable storage medium, to at least solve the problem of identifying an abnormal terminal device in the related art. The technical scheme of the disclosure is as follows:
according to a first aspect of the present disclosure, there is provided an abnormal terminal device identification method, the method including:
acquiring equipment information of terminal equipment, wherein the equipment information comprises first equipment information, second equipment information and third equipment information;
comparing the first device information with preset reference information;
matching the second device information with the third device information;
and if the first equipment information is inconsistent with the preset reference information and/or the second equipment information is not matched with the third equipment information, judging that the terminal equipment is abnormal terminal equipment.
In an optional implementation manner, the step of matching the second device information with the third device information includes:
if the second device information contains the third device information, the second device information is matched with the third device information;
and if the second device information does not contain the third device information, the second device information is not matched with the third device information.
In an optional implementation manner, the device information further includes fourth device information, and after the step of obtaining the device information of the terminal device, the method further includes:
clustering the plurality of terminal devices according to fourth device information of the plurality of terminal devices to obtain at least one cluster set;
and if the number of the terminal devices in the cluster set is greater than or equal to a preset threshold value, determining that the terminal devices in the cluster set are abnormal terminal devices.
In an optional implementation manner, the first device information includes at least one of: the method comprises the steps of format information of a unique device identifier, format information of an international mobile device identifier, a running path of an application program, file contents under a first preset path, file read-write permission under a second preset path, a detection result of an appointed application and an execution result of a preset command.
In an optional implementation manner, if the second device information is device fingerprint information, the third device information is product model information or version information;
and if the second device information is the running path of the application program, the third device information is the package name of the application program.
In an optional implementation manner, the fourth device information includes at least one of: input method information, application list information, compilation time and start time of the system.
According to a second aspect of the present disclosure, there is provided an abnormal terminal device identification apparatus, the apparatus including:
the terminal equipment comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is configured to acquire equipment information of the terminal equipment, and the equipment information comprises first equipment information, second equipment information and third equipment information;
a comparison module configured to compare the first device information with preset reference information;
a matching module configured to match the second device information with the third device information;
the identification module is configured to determine that the terminal device is an abnormal terminal device if the first device information is inconsistent with the preset reference information and/or the second device information is not matched with the third device information.
In an optional implementation, the matching module is specifically configured to:
if the second device information contains the third device information, the second device information is matched with the third device information;
and if the second device information does not contain the third device information, the second device information is not matched with the third device information.
In an optional implementation manner, the device information further includes fourth device information, and the apparatus further includes: a cluster identification module configured to:
clustering the plurality of terminal devices according to fourth device information of the plurality of terminal devices to obtain at least one cluster set;
and if the number of the terminal devices in the cluster set is greater than or equal to a preset threshold value, determining that the terminal devices in the cluster set are abnormal terminal devices.
In an optional implementation manner, the first device information includes at least one of: the method comprises the steps of format information of a unique device identifier, format information of an international mobile device identifier, a running path of an application program, file contents under a first preset path, file read-write permission under a second preset path, a detection result of an appointed application and an execution result of a preset command.
In an optional implementation manner, if the second device information is device fingerprint information, the third device information is product model information or version information;
and if the second device information is the running path of the application program, the third device information is the package name of the application program.
In an optional implementation manner, the fourth device information includes at least one of: input method information, application list information, compilation time and start time of the system.
According to a third aspect of the present disclosure, there is provided an electronic apparatus comprising:
a processor;
a memory for storing the processor-executable instructions;
wherein the processor is configured to execute the instructions to implement the abnormal terminal device identification method according to the first aspect.
According to a fourth aspect of the present disclosure, there is provided a computer-readable storage medium, wherein instructions, when executed by a processor of an electronic device, enable the electronic device to perform the abnormal terminal device identification method according to the first aspect.
According to a fifth aspect of the present disclosure, there is provided a computer program product, wherein instructions which, when executed by a processor of an electronic device, enable the electronic device to perform the abnormal terminal device identification method according to the first aspect.
The technical scheme provided by the embodiment of the disclosure at least brings the following beneficial effects:
the technical scheme of the disclosure provides an abnormal terminal equipment identification method, an abnormal terminal equipment identification device, electronic equipment and a computer readable storage medium, wherein the abnormal terminal equipment identification method comprises the following steps: acquiring equipment information of terminal equipment, wherein the equipment information of the terminal equipment comprises first equipment information, second equipment information and third equipment information; comparing the first device information with preset reference information, and matching the second device information with the third device information; and if the first equipment information is inconsistent with the preset reference information and/or the second equipment information is not matched with the third equipment information, judging that the terminal equipment is abnormal terminal equipment. According to the technical scheme, the abnormal terminal equipment can be identified only by relying on a small amount of equipment information, the abnormal account can be identified from the equipment layer, and basic equipment risk identification capability is provided for the service side. According to the scheme, the abnormal terminal equipment is determined according to the comparison result of the first equipment information and the preset reference information and the matching result of the second equipment information and the third equipment information, so that the abnormal terminal equipment can be identified more accurately, and the antagonism is enhanced.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure and are not to be construed as limiting the disclosure.
Fig. 1 is a flowchart illustrating an abnormal terminal device identification method according to an exemplary embodiment.
Fig. 2 is a flowchart illustrating another abnormal terminal device identification method according to an exemplary embodiment.
Fig. 3 is a block diagram illustrating a structure of an abnormal terminal device identifying apparatus according to an exemplary embodiment.
FIG. 4 is a block diagram illustrating an electronic device in accordance with an example embodiment.
FIG. 5 is a block diagram illustrating an electronic device in accordance with an example embodiment.
Detailed Description
In order to make the technical solutions of the present disclosure better understood by those of ordinary skill in the art, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings.
It should be noted that the terms "first," "second," and the like in the description and claims of the present disclosure and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the disclosure described herein are capable of operation in sequences other than those illustrated or otherwise described herein. The implementations described in the exemplary embodiments below are not intended to represent all implementations consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.
Fig. 1 is a flowchart illustrating an abnormal terminal device identification method according to an exemplary embodiment, which may include the following steps, as shown in fig. 1.
In step S11, device information of the terminal device is acquired, the device information of the terminal device including the first device information, the second device information, and the third device information.
The execution subject of the present embodiment may be an electronic device such as a server.
Wherein the first device information may include at least one of: format information of a device unique identifier (android id), format information of an International Mobile Equipment Identification Number (IMEI), a running path of an application program, file content under a first preset path, file read-write permission under a second preset path, a detection result of a specified application and an execution result of a preset command.
The second device information may include at least one of device fingerprint information (fingerprint), a running path of an Application (APP), and manufacturer information (manufacturer).
The third device information may include at least one of product model information (product), version information (model), user information, and package name of the application. The application programs can be installed on the mobile phone, and each application program has a complete function capable of running independently.
In a specific implementation, the Build method is executed to extract device hardware and version information, such as device basic information, e.g., product model information, device information (device), version information, manufacturer information, and device fingerprint, from system attributes of the terminal device. In addition, the running environment information of the terminal equipment can be collected, and the collection dimension can comprise the following aspects: package name and operation path of the application program; specifying the detection results of applications such as super, kingCoot, etc.; file contents under a first preset path such as/system/xbin/,/system/bin/,/system/sbin/, and the like; a second preset path such as file read-write permission under the non-built-in application program directory; the execution result of a command such as a su command is preset.
In step S12, the first device information is compared with preset reference information.
When the first device information is of types such as android format information, IMEI format information, or an application program running path, the first device information of each type may correspond to different preset reference information, that is, the preset reference information may be set according to a specific type of the first device information. The preset reference information is first device information in the normal terminal device, and the specific content of the preset reference information is not limited in this embodiment.
For example, when the first device information is a running path of an application, the preset reference information may be a default running path. If the operation path of the application program detected in a certain terminal device is different from the default operation path, the comparison result is that the operation path of the application program is inconsistent with the preset reference information; and if the operation path of the application program detected in a certain terminal device is the same as the default operation path, the comparison result shows that the operation path of the application program is consistent with the preset reference information.
When the first device information is a detection result of a specific application such as a super or a kingboot, the preset reference information may be identification information indicating that the specific application is not detected. If the specified application is detected in a certain terminal device, the comparison result can be that the detection result of the specified application is inconsistent with the preset reference information; if the specific application is not detected in a certain terminal device, the comparison result may be that the detection result of the specific application is consistent with the preset reference information.
In step S13, the second device information is matched with the third device information.
In a specific implementation, the second device information may be, for example, the manufacture information, and the third device information may be user information. If the user information of a certain terminal device is a flash, the flash is an operating system of a manufacturer a, and the manual is a manufacturer B, it may be determined that the second device information of the terminal device is not matched with the third device information.
In an optional implementation manner, it may be determined whether the second device information includes third device information; if so, judging that the second equipment information is matched with the third equipment information; and if not, judging that the second equipment information is not matched with the third equipment information.
For example, if the second device information is device fingerprint information, the third device information may be product model information or version information. Specifically, when the device fingerprint information includes product model information, it may be determined that the device fingerprint information matches the product model information; when the device fingerprint information does not include the product model information, it may be determined that the device fingerprint information does not match the product model information. When the device fingerprint information contains version information, it can be determined that the device fingerprint information matches the version information, and when the device fingerprint information does not contain version information, it can be determined that the device fingerprint information does not match the version information.
If the second device information is a running path of the application program, the third device information may be a package name of the application program. Since the application program running path of the normal terminal device generally includes the package name information of the application program, when the application program running path includes the package name information of the application program, it can be determined that the application program running path matches the package name of the application program, and when the application program running path does not include the package name information of the application program, it can be determined that the application program running path does not match the package name of the application program.
In step S14, if the first device information does not match the preset reference information, and/or the second device information does not match the third device information, it is determined that the terminal device is an abnormal terminal device.
If the first device information of the first terminal device is inconsistent with the preset reference information, it may be determined that the first terminal device is an abnormal terminal device.
If the second device information of the second terminal device is not matched with the third device information, it may be determined that the second terminal device is an abnormal terminal device.
If the first device information of the first terminal device is inconsistent with the preset reference information and the second device information of the second terminal device is not matched with the third device information, it may be determined that the second terminal device is an abnormal terminal device.
The first terminal device and the second terminal device are any terminal devices.
Since the preset reference information is the first device information in the normal terminal device, when the first device information of the first terminal device is inconsistent with the preset reference information, it can be determined that the first terminal device is an abnormal terminal device.
Since the second device information in the normal terminal device matches the third device information, when the second device information of the second terminal device does not match the third device information, it may be determined that the second terminal device is an abnormal terminal device.
In practical application, the abnormal type of the abnormal terminal device can be determined according to the comparison result and the judgment result of the terminal device, for example, if the device fingerprint information of a certain abnormal terminal device is not matched with the product model information or the version information, or the management field is not matched with the user field, the abnormal type of the abnormal terminal device can be the device information inconsistency; if the application program running path of some abnormal terminal equipment is inconsistent with the package name of the application program, the abnormal type of the abnormal terminal equipment can be environmental abnormality; if a certain abnormal terminal device detects a specified application super, the abnormal type of the abnormal terminal device can be Root environment; and so on. In practical application, the exception type of the abnormal terminal device may be adjusted according to a service requirement, and this embodiment is not limited.
The abnormal terminal equipment is identified through the equipment information, on one hand, each abnormal terminal equipment can be accurately identified, so that an account for logging in the abnormal terminal equipment can be determined as an abnormal account (such as a cheating account), electronic resources are prevented from being issued to the abnormal account, and the pressure of operation and customer complaint is relieved; on the other hand, the identification result of the abnormal equipment can be further used as a label of a clustering means, and the accuracy and recall rate of clustering identification are improved.
According to the abnormal terminal equipment identification method provided by the embodiment of the disclosure, the abnormal terminal equipment can be identified only by relying on a small amount of equipment information, the abnormal account can be identified from the equipment layer, and the basic equipment risk identification capability is provided for the service side. According to the scheme, the abnormal terminal equipment is determined according to the comparison result of the first equipment information and the preset reference information and the matching result of the second equipment information and the third equipment information, so that the abnormal terminal equipment can be identified more accurately, and the antagonism is enhanced. In addition, since the abnormal terminal device identification method provided by the embodiment can be performed at the server side, the countermeasure capability at the client side can be enhanced.
In an alternative implementation manner, the device information of the terminal device may further include fourth device information, and referring to fig. 2, after step S11, the method may further include:
in step S21, the plurality of terminal devices are clustered according to the fourth device information of the plurality of terminal devices, and at least one cluster set is obtained.
Wherein the fourth device information may include at least one of: input method information, application list information, compilation time and start time of the system.
Clustering refers to the process of dividing a collection of physical or abstract objects into classes composed of similar objects, and the set of a set of data objects, i.e., a set of clusters, is generated by clustering.
In this embodiment, any one of a K-means clustering algorithm, a mean shift clustering algorithm, a DBSCAN clustering algorithm, an expectation maximization clustering algorithm using a gaussian mixture model, a hierarchical clustering algorithm, and the like may be used to cluster the plurality of terminal devices.
In step S22, if the number of terminal devices in the cluster set is greater than or equal to the preset threshold, it is determined that the terminal devices in the cluster set are set as abnormal terminal devices.
In practical application, the system compilation time of a plurality of normal terminal devices should be dispersed, when the system compilation time of a larger number of terminal devices acquired within a certain time period is concentrated within a certain time period, a cluster set formed by the terminal devices can be acquired through clustering, and when the number of the terminal devices in the cluster set exceeds a preset threshold value, the terminal devices in the cluster set can be judged to be abnormal terminal devices. The specific value of the preset threshold may be determined according to a statistical result of the system compiling time of the plurality of normal terminal devices, which is not limited in this embodiment.
For example, the system compilation times of a plurality of terminal devices are clustered to obtain a cluster set, the system compilation times of the terminal devices in one cluster set are the same or relatively close to each other, and one cluster set comprises thirty thousand terminal devices. The statistical result of the system compiling times of a plurality of normal terminal devices shows that the terminal devices in a cluster set generally do not exceed 1000, and the preset threshold value can be set to 1000. Therefore, thirty thousand terminal devices in this cluster set may be determined as abnormal terminal devices. These terminal devices may be terminal devices disguised by means of an emulator or the like.
This implementation further discerns unusual terminal equipment according to fourth equipment information, realizes discerning unusual terminal equipment from a plurality of dimensions, can obviously promote the recognition effect, strengthens the antagonism.
Fig. 3 is a block diagram illustrating an abnormal terminal device identification apparatus according to an exemplary embodiment. Referring to fig. 3, may include:
an obtaining module 31 configured to obtain device information of a terminal device, where the device information includes first device information, second device information, and third device information;
a comparison module 32 configured to compare the first device information with preset reference information;
a matching module 33 configured to match the second device information with the third device information;
the identification module 34 is configured to determine that the terminal device is an abnormal terminal device if the first device information is inconsistent with the preset reference information and/or the second device information is not matched with the third device information.
In an optional implementation, the matching module is specifically configured to:
if the second device information contains the third device information, the second device information is matched with the third device information;
and if the second device information does not contain the third device information, the second device information is not matched with the third device information.
In an optional implementation manner, the device information further includes fourth device information, and the apparatus further includes: a cluster identification module configured to:
clustering the plurality of terminal devices according to fourth device information of the plurality of terminal devices to obtain at least one cluster set;
and if the number of the terminal devices in the cluster set is greater than or equal to a preset threshold value, determining that the terminal devices in the cluster set are abnormal terminal devices.
In an optional implementation manner, the first device information includes at least one of: the method comprises the steps of format information of a unique device identifier, format information of an international mobile device identifier, a running path of an application program, file contents under a first preset path, file read-write permission under a second preset path, a detection result of an appointed application and an execution result of a preset command.
In an optional implementation manner, if the second device information is device fingerprint information, the third device information is product model information or version information;
and if the second device information is the running path of the application program, the third device information is the package name of the application program.
In an optional implementation manner, the fourth device information includes at least one of: input method information, application list information, compilation time and start time of the system.
With regard to the apparatus in the above-described embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.
Fig. 4 is a block diagram of one type of electronic device 800 shown in the present disclosure. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, an exercise device, a personal digital assistant, and the like.
Referring to fig. 4, electronic device 800 may include one or more of the following components: a processing component 802, a memory 804, a power component 806, a multimedia component 808, an audio component 810, an input/output (I/O) interface 812, a sensor component 814, and a communication component 816.
The processing component 802 generally controls overall operation of the electronic device 800, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. Processing component 802 may include one or more processors 820 to execute instructions to perform all or a portion of the steps of the anomalous terminal device identification method described in any of the embodiments. Further, the processing component 802 can include one or more modules that facilitate interaction between the processing component 802 and other components. For example, the processing component 802 can include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.
The memory 804 is configured to store various types of data to support operation at the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phonebook data, messages, pictures, videos, and so forth. The memory 804 may be implemented by any type or combination of volatile or non-volatile memory devices, such as Static Random Access Memory (SRAM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.
The power supply component 806 provides power to the various components of the electronic device 800. The power components 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 800.
The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and a user. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front facing camera and/or a rear facing camera. The front-facing camera and/or the rear-facing camera may receive external multimedia data when the device 800 is in an operating mode, such as a shooting mode or a video mode. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.
The audio component 810 is configured to output and/or input audio signals. For example, the audio component 810 includes a Microphone (MIC) configured to receive external audio signals when the electronic device 800 is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may further be stored in the memory 804 or transmitted via the communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.
The I/O interface 812 provides an interface between the processing component 802 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to: a home button, a volume button, a start button, and a lock button.
The sensor assembly 814 includes one or more sensors for providing various aspects of state assessment for the electronic device 800. For example, the sensor assembly 814 may detect an open/closed state of the device 800, the relative positioning of components, such as a display and keypad of the electronic device 800, the sensor assembly 814 may also detect a change in the position of the electronic device 800 or a component of the electronic device 800, the presence or absence of user contact with the electronic device 800, orientation or acceleration/deceleration of the electronic device 800, and a change in the temperature of the electronic device 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 may access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G, or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 further includes a Near Field Communication (NFC) module to facilitate short-range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
In an exemplary embodiment, the electronic device 800 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic components for performing the abnormal terminal device identification method described in any of the embodiments.
In an exemplary embodiment, a non-transitory computer-readable storage medium comprising instructions, such as the memory 804 comprising instructions, executable by the processor 820 of the electronic device 800 to perform the abnormal terminal device identification method of any of the embodiments is also provided. For example, the non-transitory computer readable storage medium may be a ROM, a Random Access Memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.
In an exemplary embodiment, a computer program product is also provided, which comprises readable program code executable by the processor 820 of the apparatus 800 to perform the abnormal terminal device identification method according to any of the embodiments. Alternatively, the program code may be stored in a storage medium of the apparatus 800, which may be a non-transitory computer readable storage medium, for example, ROM, Random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.
Fig. 5 is a block diagram of one type of electronic device 1900 shown in the present disclosure. For example, the electronic device 1900 may be provided as a server.
Referring to fig. 5, electronic device 1900 includes a processing component 1922 further including one or more processors and memory resources, represented by memory 1932, for storing instructions, e.g., applications, executable by processing component 1922. The application programs stored in memory 1932 may include one or more modules that each correspond to a set of instructions. Further, the processing component 1922 is configured to execute instructions to perform the abnormal terminal device identification method according to any of the embodiments.
The electronic device 1900 may also include a power component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input/output (I/O) interface 1958. The electronic device 1900 may operate based on an operating system, such as Windows Server, MacOSXTM, UnixTM, LinuxTM, FreeBSDTM, or the like, stored in memory 1932.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.
It will be understood that the present disclosure is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims (10)

1. An abnormal terminal device identification method is characterized by comprising the following steps:
acquiring equipment information of terminal equipment, wherein the equipment information comprises first equipment information, second equipment information and third equipment information;
comparing the first device information with preset reference information;
matching the second device information with the third device information;
and if the first equipment information is inconsistent with the preset reference information and/or the second equipment information is not matched with the third equipment information, judging that the terminal equipment is abnormal terminal equipment.
2. The method according to claim 1, wherein the step of matching the second device information with the third device information includes:
if the second device information contains the third device information, the second device information is matched with the third device information;
and if the second device information does not contain the third device information, the second device information is not matched with the third device information.
3. The method for identifying an abnormal terminal device according to claim 1, wherein the device information further includes fourth device information, and after the step of obtaining the device information of the terminal device, the method further includes:
clustering the plurality of terminal devices according to fourth device information of the plurality of terminal devices to obtain at least one cluster set;
and if the number of the terminal devices in the cluster set is greater than or equal to a preset threshold value, determining that the terminal devices in the cluster set are abnormal terminal devices.
4. The method according to any one of claims 1 to 3, wherein the first device information includes at least one of: the method comprises the steps of format information of a unique device identifier, format information of an international mobile device identifier, a running path of an application program, file contents under a first preset path, file read-write permission under a second preset path, a detection result of an appointed application and an execution result of a preset command.
5. The method according to any one of claims 1 to 3, wherein if the second device information is device fingerprint information, the third device information is product model information or version information;
and if the second device information is the running path of the application program, the third device information is the package name of the application program.
6. The method according to claim 3, wherein the fourth device information includes at least one of: input method information, application list information, compilation time and start time of the system.
7. An abnormal terminal device identification apparatus, the apparatus comprising:
the terminal equipment comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is configured to acquire equipment information of the terminal equipment, and the equipment information comprises first equipment information, second equipment information and third equipment information;
a comparison module configured to compare the first device information with preset reference information;
a matching module configured to match the second device information with the third device information;
the identification module is configured to determine that the terminal device is an abnormal terminal device if the first device information is inconsistent with the preset reference information and/or the second device information is not matched with the third device information.
8. An electronic device, characterized in that the electronic device comprises:
a processor;
a memory for storing the processor-executable instructions;
wherein the processor is configured to execute the instructions to implement the method of any of claims 1 to 6.
9. A computer-readable storage medium whose instructions, when executed by a processor of an electronic device, enable the electronic device to perform the abnormal terminal device identification method of any one of claims 1 to 6.
10. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the method for abnormal terminal device identification according to any one of claims 1 to 6.
CN202110741403.1A 2021-06-30 2021-06-30 Abnormal terminal equipment identification method and device, electronic equipment and storage medium Pending CN113568828A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110741403.1A CN113568828A (en) 2021-06-30 2021-06-30 Abnormal terminal equipment identification method and device, electronic equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110741403.1A CN113568828A (en) 2021-06-30 2021-06-30 Abnormal terminal equipment identification method and device, electronic equipment and storage medium

Publications (1)

Publication Number Publication Date
CN113568828A true CN113568828A (en) 2021-10-29

Family

ID=78163271

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110741403.1A Pending CN113568828A (en) 2021-06-30 2021-06-30 Abnormal terminal equipment identification method and device, electronic equipment and storage medium

Country Status (1)

Country Link
CN (1) CN113568828A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114595264A (en) * 2022-03-17 2022-06-07 杭州云深科技有限公司 Identification system of target abnormal app

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2014186647A (en) * 2013-03-25 2014-10-02 Optim Corp User terminal, user related information providing system, user related information display method and program for user terminal
CN107094296A (en) * 2016-11-09 2017-08-25 北京小度信息科技有限公司 device identification method and device
CN107622406A (en) * 2016-07-14 2018-01-23 精硕科技（北京）股份有限公司 Identify the method and system of virtual unit
CN107800678A (en) * 2017-02-16 2018-03-13 平安科技（深圳）有限公司 The method and device that detection terminal is registered extremely
CN109670665A (en) * 2018-09-26 2019-04-23 平安普惠企业管理有限公司 Method, assessment equipment and the storage medium of identification terminal batch registration account behavior
CN110209551A (en) * 2019-05-24 2019-09-06 北京奇艺世纪科技有限公司 A kind of recognition methods of warping apparatus, device, electronic equipment and storage medium
CN110737881A (en) * 2018-07-18 2020-01-31 马上消费金融股份有限公司 Fingerprint verification method and device for intelligent devices
CN112000559A (en) * 2020-07-30 2020-11-27 瑞数信息技术（上海）有限公司 Abnormal equipment detection method and device

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2014186647A (en) * 2013-03-25 2014-10-02 Optim Corp User terminal, user related information providing system, user related information display method and program for user terminal
CN107622406A (en) * 2016-07-14 2018-01-23 精硕科技（北京）股份有限公司 Identify the method and system of virtual unit
CN107094296A (en) * 2016-11-09 2017-08-25 北京小度信息科技有限公司 device identification method and device
CN107800678A (en) * 2017-02-16 2018-03-13 平安科技（深圳）有限公司 The method and device that detection terminal is registered extremely
CN110737881A (en) * 2018-07-18 2020-01-31 马上消费金融股份有限公司 Fingerprint verification method and device for intelligent devices
CN109670665A (en) * 2018-09-26 2019-04-23 平安普惠企业管理有限公司 Method, assessment equipment and the storage medium of identification terminal batch registration account behavior
CN110209551A (en) * 2019-05-24 2019-09-06 北京奇艺世纪科技有限公司 A kind of recognition methods of warping apparatus, device, electronic equipment and storage medium
CN112000559A (en) * 2020-07-30 2020-11-27 瑞数信息技术（上海）有限公司 Abnormal equipment detection method and device

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114595264A (en) * 2022-03-17 2022-06-07 杭州云深科技有限公司 Identification system of target abnormal app
CN114595264B (en) * 2022-03-17 2024-08-30 杭州云深科技有限公司 Recognition system of target abnormal app

Similar Documents

Publication Publication Date Title
EP3188066B1 (en) A method and an apparatus for managing an application
CN109219036B (en) Method and device for unbinding equipment and electronic equipment
US20170171321A1 (en) Methods and devices for managing accounts
CN105512545B (en) Access rights management method and device
CN106372204A (en) Push message processing method and device
CN110569777A (en) Image processing method and device, electronic equipment and storage medium
CN104636453A (en) Illegal user data identification method and device
CN105094904A (en) Application program installation method and device
CN109814942A (en) A kind of parameter processing method and device
CN107330391A (en) Product information reminding method and device
CN107316207B (en) Method and device for acquiring display effect information
CN112256563A (en) Android application stability testing method and device, electronic equipment and storage medium
CN111614990A (en) Method and device for acquiring loading duration and electronic equipment
CN111338971A (en) Application testing method and device, electronic equipment and storage medium
CN104899059B (en) Operating system update method and device
CN108347401B (en) Method and device for processing login information
CN110213062B (en) Method and device for processing message
US10133911B2 (en) Method and device for verifying fingerprint
CN113568828A (en) Abnormal terminal equipment identification method and device, electronic equipment and storage medium
CN115951944A (en) Shortcut key setting method and device, electronic equipment and storage medium
CN110502714B (en) Information detection method and device, electronic equipment and storage medium
CN109511114B (en) Method and device for configuring seed IMSI/Ki associated key
CN106502719A (en) The method and device of the component of management application program
CN107526683B (en) Method and device for detecting functional redundancy of application program and storage medium
CN108228433A (en) Electronic equipment, mobile application visit time stay time statistical method and device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination