CN114205306A

CN114205306A - Flow identification method, equipment and storage medium

Info

Publication number: CN114205306A
Application number: CN202111423986.XA
Authority: CN
Inventors: 韩腾飞
Original assignee: Alibaba Cloud Computing Ltd
Current assignee: Alibaba Cloud Computing Ltd
Priority date: 2021-11-26
Filing date: 2021-11-26
Publication date: 2022-03-18

Abstract

The embodiment of the application provides a traffic identification method, traffic identification equipment and a storage medium. In the embodiment of the application, the traffic promotion is carried out based on the application program on the terminal equipment, and when the application program runs, the identification of the device group with group control behavior can be performed based on the target network environment information currently accessed by the terminal device running the application program and the network environment list existing around the terminal device, so that the local terminal behavior of the terminal device is combined with the terminal device in the device group, when the local terminal of the terminal equipment has a specific behavior, the popularization flow generated by the terminal equipment based on the application program is determined to be the specific flow, the automatic identification of the specific flow is realized, the accuracy of flow identification is improved, for example, under the condition that the specific flow is false flow, the false flow generated by controlling real equipment can be automatically identified, so that the benefit loss of flow popularization can be reduced, and the interpretability of a flow identification result can be increased.

Description

Flow identification method, equipment and storage medium

Technical Field

The present application relates to the field of internet technologies, and in particular, to a traffic identification method, device, and storage medium.

Background

With the development of internet technology, internet applications have been deeply integrated into people's daily life, and play an important role in communication information, service optimization and the like. To fully exploit the user value of these internet applications, traffic promotion through internet applications is beginning. For example, in internet applications, advertisements are implanted to help advertisers advertise.

In practical applications, statistical advertising traffic is required, for example, advertisers provide advertising commissions to application developers through statistical advertising traffic, and application developers deliver incentives to users viewing advertisements through statistical advertising traffic. However, there may be some spurious traffic in the ad traffic that does not meet the statistical requirements, such as traffic with no conversion value.

At present, a mainstream method for generating false traffic is to control a large amount of real devices to install internet applications and click advertisements implanted in the internet applications, and the traffic can well avoid the traditional false traffic identification method based on an IP address, so a new technical scheme is urgently needed to assist in identifying the false traffic generated by operating the real devices.

Disclosure of Invention

Aspects of the present application provide a traffic identification method, device and storage medium, which are used to identify a false traffic generated by operating a real device, and improve accuracy of traffic identification.

The embodiment of the application provides a traffic identification method, which comprises the following steps: receiving accessed target network environment information reported by a plurality of terminal devices running a first application and a network environment list existing around the terminal devices in the statistical time; identifying a first equipment group with a first association relation among the plurality of terminal equipment according to the plurality of terminal equipment and target network environment information accessed by the terminal equipment; identifying a second equipment group with a second association relation between the plurality of terminal equipment according to the network environment lists existing around the plurality of terminal equipment; and aiming at any terminal equipment in the first equipment group and the second equipment group, when the local terminal of any terminal equipment has a specific behavior, determining that the popularization flow generated by any terminal equipment based on the first application is a specific flow.

An embodiment of the present application further provides a traffic identification device, including: a memory and a processor; a memory for storing a computer program; a processor coupled with the memory for executing the computer program for: receiving accessed target network environment information reported by a plurality of terminal devices running a first application and a network environment list existing around the terminal devices in the statistical time; identifying a first equipment group with a first association relation among the plurality of terminal equipment according to the plurality of terminal equipment and target network environment information accessed by the terminal equipment; identifying a second equipment group with a second association relation between the plurality of terminal equipment according to the network environment lists existing around the plurality of terminal equipment; and aiming at any terminal equipment in the first equipment group and the second equipment group, when the local terminal of any terminal equipment has a specific behavior, determining that the popularization flow generated by any terminal equipment based on the first application is a specific flow.

Embodiments of the present application further provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to implement the steps in the traffic identification method provided in the embodiments of the present application.

Embodiments of the present application further provide a computer program product, which includes a computer program/instruction, and when the computer program/instruction is executed by a processor, the processor is caused to implement the steps in the traffic identification method provided by the embodiments of the present application.

In the embodiment of the application, traffic promotion is performed based on an application program on a terminal device, first, a device group with a group control behavior is identified based on target network environment information currently accessed by the terminal device running the application program and a network environment list existing around the terminal device, further, for the terminal device in the device group, by combining a local terminal behavior of the terminal device, when the local terminal of the terminal device has a specific behavior, it is determined that a promotion traffic generated by the terminal device based on the application program is the specific traffic, automatic identification of the specific traffic is realized, accuracy of traffic identification is improved, for example, when the specific traffic is the false traffic, the false traffic generated by controlling real devices can be automatically identified, which not only can reduce benefit loss of traffic promotion, but also can increase interpretability of a traffic identification result

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the application and together with the description serve to explain the application and not to limit the application. In the drawings:

fig. 1 is a schematic structural diagram of a traffic identification system according to an exemplary embodiment of the present application;

fig. 2 is a schematic flow chart of a traffic identification method according to an exemplary embodiment of the present application;

fig. 3a is a schematic structural diagram of a flow rate identification device according to an exemplary embodiment of the present application;

fig. 3b is a schematic structural diagram of a traffic identification device according to an exemplary embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the technical solutions of the present application will be described in detail and completely with reference to the following specific embodiments of the present application and the accompanying drawings. It should be apparent that the described embodiments are only some of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

In the prior art, the internet application is installed based on a large amount of real devices, and the false traffic generated by the advertisement implanted in the internet application is clicked, so that the traditional false traffic identification method based on the IP address can be avoided well, and therefore a new technical scheme capable of assisting in identifying the false traffic generated by operating the real devices is urgently needed. In the embodiment of the application, the traffic promotion is carried out based on the application program on the terminal equipment, and when the application program runs, firstly, the identification of the equipment group with group control behavior is carried out based on the current accessed target network environment information of the terminal equipment running the application program and the network environment list existing around the terminal equipment, further aiming at the terminal equipment in the equipment group, the local terminal behavior of the terminal equipment is combined, when the local terminal of the terminal equipment has a specific behavior, the popularization flow generated by the terminal equipment based on the application program is determined to be the specific flow, the automatic identification of the specific flow is realized, the accuracy of flow identification is improved, for example, under the condition that the specific flow is false flow, the false flow generated by controlling real equipment can be automatically identified, so that the benefit loss of flow popularization can be reduced, and the interpretability of a flow identification result can be increased.

The technical solutions provided by the embodiments of the present application are described in detail below with reference to the accompanying drawings.

Fig. 1 is a schematic structural diagram of a traffic identification system according to an exemplary embodiment of the present application, and as shown in fig. 1, the traffic identification system includes: a first server device 101 and a plurality of terminal devices 102.

In this embodiment, each terminal device 102 is installed with various applications, and various promotion information can be implanted in the applications, for example, advertisements can be implanted in the applications, users of the applications, and when the applications are opened, or during the use of the applications, the applications can show the advertisements to the users to help advertisers to promote the advertisements. The other information which is provided to the user by the application program and is irrelevant to the content of the application program is a popular information popularization scheme in the internet industry, and can be referred to as traffic popularization for short. For example, in a novel app, commodity information, personal recruitment information, and renting information of a house and the like of the e-commerce platform may be embedded, and these pieces of information are considered to be promotion information provided to a user through the novel app, regardless of the content of the novel app itself. In the embodiment of the present application, other information besides the application program embedded in the application program may be collectively referred to as promotion information, where most of the promotion information may be referred to as advertisement information, and the promotion information in the embodiment is a broad concept, for example, the advertisement information embedded in the application program may be e-commerce information, commodity information on an e-commerce platform, travel information of a travel agency, app information to be promoted, information of a shop to be rented, a house, etc., recruitment information of an individual or a company, and the like. It should be noted that a plurality of applications may be installed on the terminal device 102, where each application may be implanted with promotion information such as advertisements, and certainly, only some applications may be implanted with promotion information such as advertisements, and which application is implanted with promotion information may be determined by a developer of the application. In addition, one kind of advertisement information may be embedded in the same application program, or two or more kinds of advertisement information may be embedded in the same application program. For convenience of description and distinction, in the embodiment of the present application, any application program for embedding promotion information on the terminal device 102 is described as an example, and is referred to as a first application. The type of the first application is not limited, for example, the first application may be a game-like application (e.g., various game apps, applets), a video-like application (e.g., an online live-like app, an applet), a reading-like application (e.g., a novel app, an e-book), or a shopping-like application, and the like, without limitation.

In a traffic promotion scenario, a party providing advertisement information may be referred to as an advertiser, an advertisement league may be formed between advertisers, a developer of an application program may be referred to as a mediator, and the advertiser promotes the advertisement information through the application program of the mediator. The advertiser can provide certain promotion resources, such as advertisement cost, to the media owner according to the promotion flow of the advertisement information, wherein the promotion flow refers to the access amount of the user to the advertisement information, and the definition of effective access of the user to the advertisement information can be different according to different application scenes, for example, in one application scene, the user can consider one effective access to the advertisement information as long as the user clicks a page entering the advertisement information; for another example, in another application scenario, a user not only needs to click on a page of advertisement information, but also needs to browse the page for at least N seconds to consider the page as an effective access to the advertisement information, where N is a natural number greater than or equal to 1; for another example, in yet another application scenario, a user not only clicks into a page of advertisement information but also leaves specified information on the page, such as user name, contact information, etc., to be considered as one effective access to the advertisement information. For the media owner, in order to obtain the promotion resource provided by the advertiser, methods such as some rewards or mini-games are generally adopted to attract users to pay attention to and click on advertisement information embedded in the application program in the process of using the application program, and the types of the rewards are not limited, for example, some application program-related coupons, game coins, flow volumes, even cash and the like can be used. In practical applications, some illegal users may continuously click on the advertisement information by some illegal means in order to obtain the reward provided by the media owner or frequently participate in the mini-game (get a sense of entertainment), so as to generate some false traffic, which means traffic that has no substantial conversion meaning to the advertiser, and has a certain cost to the media owner, no matter the reward or the mini-game. Therefore, it is necessary to identify spurious ones of the promotional traffic, both from the advertiser's perspective and from the media host's perspective. In order to identify false traffic, in the embodiment of the present application, a first server device 101 is additionally provided, and the first server device 101 assists in identifying false traffic in the promotion traffic. It should be noted that, in the embodiment of the present application, the first service-side device 101 may identify other types of traffic in the promoted traffic in addition to the false traffic in the promoted traffic, so that the traffic that needs to be identified is referred to as the specific traffic in the embodiment of the present application.

In this embodiment, the first service-side device 101 may be a cloud server, a regular server, a server array, or the like. The first server device 101 is mainly responsible for identifying the promotion traffic generated by each terminal device 102 based on the first application. Compared with the first application, the first server device 101 may be a server device provided by a third party and specifically used for identifying the promotion traffic generated based on the first application, or may be a server device corresponding to the first application, that is, a server device provided by a first application developer. In the case that the first service device 101 is a service device corresponding to the first application, the first service device 101 may identify the promotion traffic generated by each terminal device 102 based on the first application, and may also provide basic services adapted to the first application for each terminal device 102, for example, provide services such as computation, storage, and the like related to the first application in response to a request from the first application. In the case that the first server device 101 is a server device provided by a third party, the system of this embodiment may further include a server device corresponding to the first application, and for convenience of distinguishing, the server device corresponding to the first application is referred to as a second server device, and the second server device is mainly responsible for providing basic services adapted to the first application for each terminal device 102. In the following embodiments of the present application, the first server device 101 is mainly used to identify the promotion traffic generated by the terminal device 102 based on the first application. The process of providing the basic service adapted to the first application for each terminal device 102 by the second service device or the first service device is not described in detail.

In this embodiment, the terminal device 102 may report the network environment information accessed to the first service-side device 101 when running the first application. The network environment information accessed by the terminal device where the first application is located mainly refers to information of a wireless local area network accessed by the terminal device, and may be wifi network information, for example. For example, in the case that the network environment accessed by the terminal device is a wifi network environment, the network environment information may be information of the wifi network connected by the terminal device, and may include identification information such as a name of the wifi network, a Media Access Control (MAC) address, or a Basic Service Set Identifier (BSSID), and may further include signal strength of the wifi network. For convenience of description and distinction, information of a network environment to which the terminal apparatus 102 where the first application is currently accessed is referred to as target network environment information. In this embodiment, the time when the terminal device 102 reports the target network service information to the first service-side device 101 is not limited. For example, when the first application is started, the terminal device 102 reports the target network environment information accessed by the terminal device to the first service-side device 101. Alternatively, the terminal device 102 may report the target network environment information accessed by the terminal device to the first server device 101 periodically during the first application usage period.

Further, before reporting the accessed target network environment information to the first service end device 101, the terminal device 102 needs to acquire the accessed target network environment information. Optionally, in some application scenarios, the user authorizes the network environment information accessed by the terminal device in advance, that is, each application is allowed to obtain the network environment information, and based on this, the terminal device 102 may directly obtain the target network environment information accessed by the terminal device and report the target network environment information to the first service device 101. In other application scenarios, the terminal device 102 may send an authorization application to a user of the first application (that is, a user of the current terminal device) when the first application is started, where the authorization application is used to inquire whether the first application of the user can obtain the target network environment information currently accessed by the terminal device, and if the user confirms authorization (for example, the user inputs a network access password and clicks a confirmation button), the terminal device may obtain the target network environment information currently accessed and report the target network environment information accessed by the terminal device to the first service-side device 101.

In this embodiment, when the terminal device 102 runs the first application, in addition to reporting the target network environment information accessed by the terminal device to the first service-side device 101, a network environment list corresponding to the terminal device may also be reported to the first service-side device 101. The network environment list includes at least one candidate network environment information existing around the terminal device, the candidate network environment information in the network environment list represents other network environment information existing around the terminal device 102 where the first application is located, and the terminal device 102 may have a right to access the candidate network environment information or may not have the right to access the candidate network environment information. When the target network environment accessed by the terminal device 102 is a wifi network, it may be understood that the network environment list includes other wifi network information existing around the terminal device 102. Similarly, in this embodiment, the time when the terminal device 102 reports the network environment list to the first service-side device 101 is not limited. For example, when the first application is started, the terminal device 102 acquires and reports a list of network environments existing around the terminal device to the first service-side device 101. Alternatively, the terminal device 102 may report the network environment list to the first server device 101 periodically during the first application usage. The reporting of the network environment list and the reporting of the accessed target network environment information to the first service end device 101 by the terminal device 102 may be in the same communication process or in different communication processes, which is not limited herein.

It should be noted that, in this embodiment of the application, a developer of the first application may set a buried point for information acquisition in the first application in advance, and acquire, by using the buried point, target network environment information accessed by the terminal device where the first application is located and a network environment list periodically existing in the target network environment information when the first application is started or in the running process, and report the target network environment information and the network environment list to the first service-side device 101. Alternatively, the developer of the first application may also develop plug-ins, SDKs, or patches for information acquisition, and install these plug-ins, SDKs, or patches on the terminal device where the first application is located by using the update process of the first application, and collect, by these plug-ins, SDKs, or patches, target network environment information accessed by the terminal device where the first application is located and a network environment list that periodically exists thereof, and report to the first service-side device 101. In addition, the first application may also directly invoke a system function of the terminal device where the first application is located, collect target network environment information accessed by the terminal device where the first application is located and a network environment list periodically existing in the terminal device where the first application is located, and report the target network environment information and the network environment list to the first service-side device 101, where the system function has a function of collecting and reporting related information.

In this embodiment, the first service device 101 may receive, within a certain statistical time, target network environment information that is reported by each terminal device 102 running the first application and is accessed by the terminal device 102. In this embodiment, the length of the statistical time is not limited, and may be determined according to a requirement for identifying the promotion traffic generated based on the first application, for example, if the promotion traffic generated based on the first application needs to be identified periodically, the period may be set as the statistical time in this embodiment. For example, if three days, one or two weeks, or even one month is required to identify the promotion flow based on the first application, the statistical time may be three days, one or two weeks, or even one month, accordingly. It should be noted that, during the statistical time, users of different terminal devices 102 may start and use the first application at different time points; of course, for the same user, the first application may be started and used several times within the statistical time, and the target network environment information accessed by the terminal device and the network environment list existing around the terminal device may be different during different use periods. For the terminal device, in each use of the first application process by the user, the target network environment information accessed by the user and the network environment list existing around the user are collected and reported to the first service terminal device. In this embodiment, the terminal device has a strong association with the target network environment information accessed by the terminal device and the network environment list existing around the terminal device, and for different terminal devices which often access the same target network environment information and/or have the same or similar network environment list existing around the terminal device, the terminal device belongs to the same user or company with a high probability. Based on this, after receiving the target network environment information reported by the plurality of terminal devices 102 running the first application and accessed by the first server device 101, the first server device may identify a first device group having the first association relationship between the plurality of terminal devices 102 according to the target network environment information reported by the plurality of terminal devices 102 running the first application and accessed by the plurality of terminal devices 102. The first association relationship may be that different terminal devices 102 need to have the same or similar network environment information within the statistical time, and based on this, the terminal devices having the same or similar network environment information within the statistical time in the plurality of terminal devices 102 may be divided into the same device group, that is, the first device group. It should be noted that the plurality of terminal devices may be divided into a plurality of first device groups according to the target network environment information accessed by the plurality of terminal devices.

In this embodiment, the first service-side device 101 may receive, in addition to the information of the target network environment that is reported by the plurality of terminal devices 102 running the first application and accessed by the first service-side device within the statistical time, a network environment list that exists around the first service-side device and is reported by the plurality of terminal devices 102. The first server apparatus 101 may identify a second apparatus group having a second association relationship between the plurality of terminal apparatuses 102, based on the plurality of terminal apparatuses 102 and a network environment list existing around the terminal apparatuses 102. The second association relationship may be that the same or similar candidate network environment information exists around different terminal devices 102, which is not limited herein. Based on this, terminal devices having the same or similar candidate network environment information around the statistical time among the plurality of terminal devices 102 may be classified into the same device group, i.e., a second device group. The plurality of terminal devices may be divided into the plurality of second device groups according to the candidate network environment information existing around the plurality of terminal devices.

It should be noted that before the terminal device accesses the target network environment information, the password is mostly required to be confirmed, for example, when the target network environment information is wifi, when the terminal device accesses the wifi network, the password corresponding to the wifi network needs to be input, and when the password is verified to be correct, the terminal device can access the target network environment information. Based on this, it can be considered that a strong association relationship exists between the terminal device and the target network environment information, and the target network environment information has a certain distinction to the terminal device. Accordingly, when the terminal device accesses the target network environment information, other candidate network environment information existing around the target network environment information also has a certain distinction to the terminal device. In this embodiment of the present application, a plurality of terminal devices are grouped from two dimensions, namely, target network environment information accessed by the terminal devices and a network environment list existing around the target network environment information, to obtain at least one first device group and at least one second device group, where terminal devices in each device group have a higher similarity in network environment, and therefore, in this embodiment of the present application, it is considered that terminal devices in the device groups have a group control behavior to some extent. The group control behavior means that the terminal devices in the same device group are controlled by the same user by adopting a certain technical means so as to enable the terminal devices to execute the same operation, for example, the terminal devices in the same device group are controlled to collectively click promotion information in the first application, so that false traffic is generated. Therefore, the terminal devices are grouped based on the target network environment information accessed by the terminal devices and the network environment list existing around the terminal devices, and then when the terminal devices belonging to a certain device group perform traffic identification on the popularization traffic generated by the terminal devices based on the first application, the traffic identification result has strong interpretability, namely the traffic identification result can be fully explained, so that the traffic identification result has high recognition degree.

In this embodiment, the same terminal device may belong to only a certain first device group, may belong to only a certain second device group, and may belong to both a first device group and a second device group. In any case, after the first device group and the second device group are identified, the terminal devices in the first device group and the second device group may be merged, and of course, when the traffic identification is performed on the same terminal device located in both device groups, the identification process may be performed only once for the terminal device in order to save resources. Based on this, for any terminal device 102 in the first device group and the second device group, a traffic identification operation is performed, that is, whether the promotion traffic generated by the terminal device 102 based on the first application is a specific traffic is identified; for terminal devices not belonging to the first device group and the second device group, traffic identification operation is not performed, and it is directly considered that the popularization traffic generated by the terminal devices based on the first application is not the specific traffic described in the embodiment of the present application. Further, for any terminal device 102 in the first device group and the second device group, when it is identified whether the promotion traffic generated by the terminal device 102 based on the first application is the specific traffic, the local behavior of the terminal device is combined, and when the local behavior of the terminal device 102 exists, the promotion traffic generated by the terminal device based on the first application is determined to be the specific traffic. Wherein the specific behavior corresponds to a specific traffic. For example, if the specific traffic refers to normal traffic, the specific behavior is normal behavior; conversely, if a particular traffic is false or abnormal, a particular behavior is abnormal. When the specific traffic is false or abnormal traffic, and when the local terminal of the terminal device 102 has an abnormal behavior, it is determined that the promotion traffic generated by the terminal device based on the first application is abnormal traffic.

Wherein the abnormal behavior may be, but is not limited to: the terminal device 102 is provided with a high-risk APP, and the terminal device 102 starts a debugging mode or a barrier-free mode. The high-risk APP refers to an APP with a fraud risk, such as an illegal internet loan APP, an illegal investment APP, or a false red packet APP. When the terminal device starts the debugging mode, the program code corresponding to the first application may be changed, for example, when the traffic promotion is performed through the first application, the program code of the first application may be changed, so that the first application may automatically play the promoted traffic, and therefore, starting the debugging mode may be regarded as an abnormal behavior in this embodiment of the application. The terminal device may automatically perform some operations in the barrier-free mode, for example, a voice prompt may be provided at any position touched by the user, all characters of the current page may be automatically broadcasted, but the clicked traffic in the mode cannot be converted, which is only convenient for the user, especially for the user with visual impairment, and therefore, the terminal device may also be regarded as an abnormal behavior in the embodiment of the present application when the barrier-free mode is opened.

In an optional embodiment, the terminal device may report notification information that a specific behavior exists at the terminal to the first service end device, where the specific behavior may be that a high-risk APP is installed on the terminal device, and the terminal device opens a debugging mode or an obstacle-free mode. The first service end device may receive notification information that the plurality of terminal devices report that the local terminal has the specific behavior, and determine that the local terminal of any terminal device has the specific behavior if the notification information reported by any terminal device is received. It should be noted that the notification message may be sent to the first service end device by a buried point used for information acquisition, a plug-in used for information acquisition, an SDK, or a patch and the like in the first application when a specific behavior is acquired at the local end of the terminal device, or may also be sent to the first service end device by invoking a system function of the terminal device when a specific behavior is acquired at the local end of the terminal device, and for detailed description of the buried point, the plug-in, the SDK, or the patch and the like, reference may be made to the foregoing embodiment, and details are not described here.

The terminal device generating the promotion flow based on the first application means that the first application displays promotion information, such as various advertisement information, on an application page of the terminal device in the process of running the first application, the terminal device enters the page of the promotion information in response to the triggering operation of the promotion information, and further optionally, further network operation can be generated on the page, such as the process of browsing, adding a shopping cart, paying attention to, commenting or filling information and the like. The first application records time and times when the terminal device clicks and enters a page of the promotion information, and operation and other information generated on the page every time, the information can be called log information, the log information can be reported to the server device corresponding to the first application, the server device can be a first server device or a second server device, and the server device stores the log information so that the server device can distinguish and filter promotion flow generated by the terminal devices based on the first application.

In the embodiment of the application, traffic promotion is performed based on an application program on a terminal device, when the application program runs, firstly, a device group with a group control behavior is identified based on target network environment information currently accessed by the terminal device running the application program and a network environment list existing around the terminal device, further, for the terminal device in the device group, when a specific behavior exists at the local terminal of the terminal device, the promotion traffic generated by the terminal device based on the application program is determined to be the specific traffic by combining the terminal side behavior of the terminal device, so that the accuracy of traffic identification is improved, especially in a traffic promotion scene, false traffic generated by controlling real devices can be automatically identified, so that not only can the benefit loss of traffic promotion be reduced, but also the interpretability of a traffic identification result can be increased.

In an optional embodiment, after determining that the popularization traffic generated by any terminal device based on the first application is a specific traffic, identification information of the terminal device may be determined, for example, a MAC address, an IP address, a brand, a model number, or the like of the terminal device, and the first service end device may further filter the specific traffic generated by any terminal device based on the first application from the popularization traffic generated by the first application based on the identification information of the any terminal device. The promotion flow generated by the first application refers to the sum of the promotion flows generated by all terminal devices running the first application within the statistical time. For example, if the specific traffic is false traffic, in a case that it is determined that the popularization traffic generated by the terminal device a1 based on the first application is false traffic, the false traffic generated by the terminal device a1 based on the first application is filtered from the popularization traffic generated by the first application according to the identification information of the terminal device a1, which not only can reduce economic loss of the false traffic to a media owner or an advertiser, but also is beneficial to improving the conversion rate of the residual popularization traffic after filtering.

Further, in the case that the system of this embodiment further includes a second server device corresponding to the first application, after the first server device determines that the popularization traffic generated by any terminal device based on the first application is a specific traffic, the first server device may further provide the identification information of any terminal device to the second server device, and the second server device filters the specific traffic generated by any terminal device based on the first application from the popularization traffic generated by the first application. In this embodiment, the traffic identification operation is performed by the first server device, and the traffic filtering operation is performed by the second server device. Of course, in the case that the second server device is authorized to the first server device, the traffic identification operation and the traffic filtering operation may be performed by the first server device. No matter the first server device executes the traffic filtering operation or the second server device executes the traffic filtering operation, the first server device may continuously perform the traffic identification operation, and continuously accumulate the identification information of the terminal device that generates the specific traffic based on the first application, and then, when the traffic filtering operation needs to be executed, the specific traffic generated by the terminal device based on the first application may be filtered according to the accumulated identification information of the terminal device that generates the specific traffic based on the first application, so as to improve the accuracy of the popularization traffic.

In this embodiment, the implementation manner in which the first service-side device identifies the first device group having the first association relationship between the multiple terminal devices according to the multiple terminal devices and the target network environment information accessed by the multiple terminal devices is not limited. For example, from the dimensions of the terminal devices, it may be compared whether the target network environment information accessed by two terminal devices is the same, and the terminal devices with the same target network environment information are grouped into one group, so as to obtain at least one first device group. In addition, the dimension of the target network environment information may be used to compare whether two pieces of target network environment information are the same, and group the terminal devices corresponding to the same target network environment information into one group, so as to obtain at least one first device group. In addition, in an optional embodiment of the present application, an undirected graph may be constructed by using the plurality of terminal devices and target network environment information accessed by the terminal devices, where the undirected graph is composed of nodes and edges between the nodes, and a first device group having a first association relationship between the plurality of terminal devices is identified based on the undirected graph. Each node in the invalid graph represents either a terminal device or target network environment information; an edge exists between a node representing a terminal device and a node representing target network environment information accessed by the terminal device, and the edge in an undirected graph represents a network access relation existing between two nodes connected by the edge.

Further optionally, considering that some target network environment information may be network hotspots in a specific environment or scene, if the terminal device accessing the network environment information as hotspots is directly determined as a group control device, it is not reasonable, and a large error is brought to traffic identification. For example, for a wifi network of a certain company, all terminal devices of the company access the wifi network, but the terminal devices are generally used by different employees, and it is obviously not reasonable to directly determine the terminal devices as group control devices. For another example, for public wifi networks in public places such as stations and airports, it is obviously unreasonable if the terminal devices accessing these wifi networks are directly determined as group control devices. Based on this, in the embodiment of the present application, before the undirected graph is constructed, specific network environment information existing in target network environment information accessed by multiple terminal devices may be further removed to obtain at least one available network environment information, where it may be directly assumed that the terminal devices accessing the specific network environment information do not generate specific traffic based on the first application, wifi network information of public places such as stations and airports belongs to the specific network environment information in the embodiment of the present application, and for example, wireless local area network information of some companies, for example, wifi network information also belongs to the specific network environment information in the embodiment of the present application. In this embodiment, it is considered that the same terminal device may access different network environment information, and therefore only the specific network environment information is removed, and the terminal device accessing the specific network environment information is not removed. After obtaining at least one piece of available network environment information, constructing a first undirected graph according to a plurality of terminal devices and the at least one piece of available network environment information, wherein the first undirected graph comprises nodes and edges, one terminal device or one piece of available network environment information can be used as a node in the first undirected graph, the edges in the first undirected graph represent two nodes connected with the edges and respectively represent the terminal devices and the available network environment information, and the edges represent access relations between the terminal devices represented by the two nodes connected with the edges and the available network environment information; after the first undirected graph is constructed, at least one maximum connected subgraph existing in the first undirected graph can be identified, any two nodes in each maximum connected subgraph are connected, the nodes in different maximum connected subgraphs are not connected, and the terminal devices represented by the nodes in each maximum connected subgraph can be formed into a first device group with a first incidence relation.

However, the present invention is not limited to the embodiment in which specific network environment information existing in target network environment information accessed by a plurality of terminal devices is removed. The following examples illustrate:

example D1:for each target network environment information, if the number of terminal devices accessing the target network environment information is greater than or equal to the set number threshold, the target network environment information may be considered as hot network environment information, where the hot network environment information may be network environment information with dense access terminal devices in stations, shopping malls, companies, or the likeAs the first device group having the first association relationship, the target network environment information (i.e., the hotspot network environment information) may be eliminated as the specific network environment information.

Example D2:a network information white list may be maintained in advance, where the network information white list includes trusted network environment information, and a terminal device accessing the trusted network environment information may be considered as a terminal device that does not generate a specific behavior, and then considered as a trusted terminal device. And for each target network environment information, if the target network environment information exists in a network information white list maintained in advance, the target network environment information is taken as specific network environment information to be removed. The embodiment of determining the trusted network environment information is not limited. For example, the trusted terminal device may be determined according to the historical popularization traffic generated by the first application on each terminal device, the network environment information accessed to the set number of trusted terminal devices is used as the trusted network environment information, and the trusted network environment information is added to the network information white list; or, it may be determined whether the network environment information is trusted directly according to information of the network environment information, for example, a network environment information IP address, a user name, an operator, or a geographic location, and in a case that the network environment information is determined to be trusted, the network environment information is added to the network information white list.

Example D3:example D1 and example D2 may be combined, and for each piece of target network environment information, if the number of terminal devices accessing the target network environment information is greater than or equal to a set number threshold and the target network environment information exists in a network information white list maintained in advance, the target network environment information is rejected as specific network environment information.

In the embodiment of the present application, the embodiment is not limited to the one in which the second device group having the second association relationship between the plurality of terminal devices is identified based on the network environment list existing between the plurality of terminal devices and the surroundings thereof. For example, the candidate network environment information in the network environment list existing around each two terminal devices may be compared from the dimension of the terminal device, and the terminal devices having the same candidate network environment information or having the same candidate network environment information and having the same candidate network environment information in a number greater than a set number threshold are classified into the same device group, so as to obtain at least one second device group. Or, the candidate network environment information in each two network environment lists may be compared from the dimensionality of the network environment lists, whether the same candidate network environment information exists in the two surrounding environment lists or whether the same candidate network environment information exists and the number of the same candidate network environment information is greater than a set number threshold value is judged, if yes, the two network environment lists are considered to be similar, and the terminal devices corresponding to the two network environment lists are classified into the same device group, so that at least one second device group is obtained. In addition, in an optional embodiment of the present application, a second undirected graph may be constructed by using the plurality of terminal devices and a network environment list existing around the plurality of terminal devices, and a second device group having a second association relationship between the plurality of terminal devices may be identified based on the second undirected graph. The second undirected graph also comprises nodes and edges, wherein the nodes represent a terminal device or represent a candidate network environment information, each edge is connected with two nodes, the two nodes connected with one edge respectively represent the terminal device and the candidate network environment information, and the edge represents that a candidate relationship exists between the terminal device represented by the two nodes connected with the edge and the candidate network environment information. Specifically, a second undirected graph is constructed according to the candidate network environment information in the network environment lists existing around the terminal devices and the terminal devices, wherein nodes in the second undirected graph represent one terminal device and are called terminal device nodes, or nodes in the second undirected graph represent one candidate network environment information and are called network environment nodes, and edges in the second undirected graph represent candidate relations between the terminal devices and the candidate network environment information; and identifying at least one subgraph which is in accordance with a specified core degree k and exists in the second undirected graph, wherein the core degree k represents that any terminal equipment node in the subgraph is connected with at least k network environment nodes, any network environment node in the subgraph is connected with at least k terminal equipment nodes, and at least k network environment nodes which are connected with different terminal equipment nodes in the subgraph can be the same or different. For example, the terminal device node E0 may be connected to the network environment node F1, the network environment node F2 and the network environment node F3, the terminal device node E1 may also be connected to the network environment node F1, the network environment node F2 and the network environment node F3, or the terminal device node E1 may be connected to the network environment node F4, the network environment node F5 and the network environment node F6. The core degree k is a positive integer, and the value of the core degree k may be 3, 5, or 7, and the like, which is not limited to this, the higher the core degree is, the smaller the number of nodes in the subgraph is, and preferably, the value of k is 3. After identifying at least one subgraph meeting the specified core degree k existing in the second undirected graph, the terminal devices represented by the nodes in each subgraph meeting the specified core degree k can be formed into a second device group with a second association relationship.

The embodiment of identifying at least one subgraph meeting the specified Core degree k in the second undirected graph is not limited, for example, a k-Core algorithm may be used to identify at least one subgraph meeting the specified Core degree k in the second undirected graph, and the k-Core algorithm is generally used to perform subgraph division on an initial graph, and the subgraphs meeting the specified Core degree are screened out by removing nodes with the Core degree smaller than k. The specific process of the k-Core algorithm comprises the following steps: removing nodes with the core degree smaller than k in the second undirected graph to obtain candidate subgraphs; and removing nodes with the core degree smaller than k in the candidate subgraphs to obtain at least one subgraph with the specified core degree k. And deleting the nodes in the second undirected graph or the candidate subgraph, and deleting the edges associated with the deleted nodes.

In an optional embodiment, before constructing the second undirected graph according to the plurality of terminal devices and the candidate network environment information in the network environment list existing around the terminal devices, the candidate network environment information in the network environment list needs to be screened, and the plurality of candidate network environment information with strong signal strength are retained to construct the second undirected graph, so that the accuracy of a traffic identification result can be improved, and the interference of the candidate network environment information with strong signal strength is reduced. Specifically, for each terminal device, if the number of candidate network environment information in the network environment list existing around the terminal device is greater than or equal to the first number N (N is a positive integer), N candidate network environment information with the strongest signal strength are retained, and other candidate network environment information are removed.

In the embodiment of the application, in a traffic promotion scene, a device group with a group control behavior is identified based on target network environment information currently accessed by a terminal device running the application and a network environment list existing around the terminal device, further, for the terminal device in the device group, by combining a local terminal behavior of the terminal device, when the local terminal of the terminal device has the specific behavior, it is determined that the promotion traffic generated by the terminal device based on the application is the specific traffic, so that automatic identification of the specific traffic is realized, and accuracy of traffic identification is improved. In addition, in an experimental environment, the effect of the technical scheme of the embodiment of the application is tested, after the technical scheme of the embodiment of the application is deployed, the recognition vacancy of controlling the automatic flow brushing rate of real equipment is effectively made up, the risk recall value is improved by 50%, namely, compared with the traditional scheme, the recall value which is less than 10% and is brought by recognizing the false flow based on the IP address is improved to 60%, the popularization flow after being filtered is also approved as a media master, and the user is rewarded or restricted to participate in activities such as a mini-game and the like based on the popularization flow after being filtered, and can be accepted by the user; in addition, the media owner also reflects the filtered popularization traffic obtained by the technical scheme of the embodiment of the application to the advertiser, and the advertiser indicates that the filtered popularization traffic approves and is willing to pay for the popularization resource.

Fig. 2 is a schematic flow chart of a traffic identification method according to an exemplary embodiment of the present disclosure, where the traffic promotion method is applicable to a traffic promotion device, and the traffic promotion device is applicable to the first service-side device, but is not limited thereto. As shown in fig. 2, the method includes:

201. receiving accessed target network environment information reported by a plurality of terminal devices running a first application and a network environment list existing around the terminal devices in the statistical time;

202. identifying a first equipment group with a first association relation among the plurality of terminal equipment according to the plurality of terminal equipment and target network environment information accessed by the terminal equipment;

203. identifying a second equipment group with a second association relation between the plurality of terminal equipment according to the network environment lists existing around the plurality of terminal equipment;

204. and aiming at any terminal equipment in the first equipment group and the second equipment group, when the local terminal of any terminal equipment has a specific behavior, determining that the popularization flow generated by any terminal equipment based on the first application is a specific flow.

In an optional embodiment, after determining that the promotion traffic generated by any terminal device based on the first application is a specific traffic, the method further includes: and filtering the specific traffic generated by any terminal device based on the first application from the promotion traffic generated by the first application based on the identification information of any terminal device.

In an optional embodiment, identifying, according to environment information of a target network to which a plurality of terminal devices access, a first device group in which a first association relationship exists between the plurality of terminal devices includes: removing specific network environment information existing in target network environment information accessed by a plurality of terminal devices to obtain at least one piece of available network environment information; constructing a first undirected graph according to the plurality of terminal devices and at least one piece of available network environment information, wherein a node in the first undirected graph represents one terminal device or one piece of available network environment information, and an edge in the first undirected graph represents an access relation between the terminal device and the available network environment information; at least one maximum connected subgraph existing in the first undirected graph is identified, and terminal devices represented by nodes in each maximum connected subgraph form a first device group with a first association relationship.

In an optional embodiment, the removing specific network environment information existing in target network environment information accessed by a plurality of terminal devices includes: for each target network environment information, if the number of terminal devices accessing the target network environment information is greater than or equal to a set number threshold, rejecting the target network environment information as specific network environment information; and/or, for each target network environment information, if the target network environment information exists in a pre-maintained network information white list, removing the target network environment information as the specific network environment information.

In an optional embodiment, identifying a second device group having a second association relationship between the plurality of terminal devices according to the list of network environments existing around the plurality of terminal devices includes: constructing a second undirected graph according to the candidate network environment information in the network environment list existing around the plurality of terminal devices, wherein a node in the second undirected graph represents one terminal device or one candidate network environment information, and an edge in the second undirected graph represents a candidate relationship between the terminal device and the candidate network environment information; and identifying at least one subgraph which accords with the specified core degree k and exists in the second undirected graph, wherein terminal equipment represented by nodes in each subgraph which accords with the specified core degree k form a second equipment group with a second association relationship, and k is a positive integer.

In an optional embodiment, before constructing the second undirected graph according to the candidate network environment information in the network environment list existing around the plurality of terminal devices, the method further includes: for each terminal device, if the number of candidate network environment information in the network environment list existing around the terminal device is greater than or equal to a first number N, N candidate network environment information with the strongest signal strength is reserved, and other candidate network environment information is removed, wherein N is a positive integer.

In an optional embodiment, identifying at least one subgraph that meets a specified core degree k that exists in the second undirected graph comprises: removing nodes with the core degree smaller than k in the second undirected graph to obtain candidate subgraphs; and removing nodes with the core degree smaller than k in the candidate subgraphs to obtain at least one subgraph with the specified core degree k.

In an optional embodiment, the method provided in the embodiment of the present application further includes: receiving the notification information of the multiple terminal devices reporting the specific behavior of the local terminal, and determining that the specific behavior of any terminal device exists in the local terminal if the notification information reported by any terminal device is received.

In an alternative embodiment, the specific behavior comprises at least one of: any terminal equipment is provided with a high-risk APP, and the debugging mode or the barrier-free mode is started by any terminal equipment.

It should be noted that the execution subjects of the steps of the methods provided in the above embodiments may be the same device, or different devices may be used as the execution subjects of the methods. For example, the execution subjects of step 201 to step 203 may be device a; for another example, the execution subject of

steps

201 and 202 may be device a, and the execution subject of step 203 may be device B; and so on.

In addition, in some of the flows described in the above embodiments and the drawings, a plurality of operations are included in a specific order, but it should be clearly understood that the operations may be executed out of the order presented herein or in parallel, and the sequence numbers of the operations, such as 201, 202, etc., are merely used for distinguishing different operations, and the sequence numbers do not represent any execution order per se. Additionally, the flows may include more or fewer operations, and the operations may be performed sequentially or in parallel. It should be noted that, the descriptions of "first", "second", etc. in this document are used for distinguishing different messages, devices, modules, etc., and do not represent a sequential order, nor limit the types of "first" and "second" to be different.

Fig. 3a is a schematic structural diagram of a flow rate identification device according to an exemplary embodiment of the present application. As shown in fig. 3a, the flow rate identification apparatus includes: a receiving module 31, an identifying module 32 and a determining module 33. Wherein:

the receiving module 31 is configured to receive, within the statistical time, target network environment information that is reported by the plurality of terminal devices running the first application and accessed by the terminal devices and a network environment list existing around the terminal devices. The identification module 32 is configured to identify a first device group having a first association relationship among the plurality of terminal devices according to the target network environment information of the plurality of terminal devices and the target network environment information to which the plurality of terminal devices are accessed; and identifying a second device group with a second association relation between the plurality of terminal devices according to the network environment lists existing around the plurality of terminal devices. The determining module 33 is configured to determine, for any terminal device in the first device group and the second device group, that the popularization traffic generated by the any terminal device based on the first application is a specific traffic when the local terminal of the any terminal device has a specific behavior.

In an optional embodiment, the apparatus of this embodiment may further include: and a filtering module, configured to filter, by the determining module 33, the specific traffic generated by any terminal device based on the first application from the popularization traffic generated by the first application based on the identification information of any terminal device after determining that the popularization traffic generated by any terminal device based on the first application is the specific traffic.

In an optional embodiment, when identifying, according to the environment information of the target network to which the multiple terminal devices access, a first device group having a first association relationship between the multiple terminal devices, the identifying module 32 is specifically configured to: removing specific network environment information existing in target network environment information accessed by a plurality of terminal devices to obtain at least one piece of available network environment information; constructing a first undirected graph according to the plurality of terminal devices and at least one piece of available network environment information, wherein a node in the first undirected graph represents one terminal device or one piece of available network environment information, and an edge in the first undirected graph represents an access relation between the terminal device and the available network environment information; at least one maximum connected subgraph existing in the first undirected graph is identified, and terminal devices represented by nodes in each maximum connected subgraph form a first device group with a first association relationship.

In an optional embodiment, when removing specific network environment information existing in target network environment information accessed by multiple terminal devices, the identifying module 32 is specifically configured to: for each target network environment information, if the number of terminal devices accessing the target network environment information is greater than or equal to a set number threshold, rejecting the target network environment information as specific network environment information; and/or, for each target network environment information, if the target network environment information exists in a pre-maintained network information white list, removing the target network environment information as the specific network environment information.

In an optional embodiment, the identifying module 32, when identifying, according to the network environment list existing around the plurality of terminal devices, a second device group having a second association relationship between the plurality of terminal devices, is specifically configured to: constructing a second undirected graph according to the candidate network environment information in the network environment list existing around the plurality of terminal devices, wherein a node in the second undirected graph represents one terminal device or one candidate network environment information, and an edge in the second undirected graph represents a candidate relationship between the terminal device and the candidate network environment information; and identifying at least one subgraph which accords with the specified core degree k and exists in the second undirected graph, wherein terminal equipment represented by nodes in each subgraph which accords with the specified core degree k form a second equipment group with a second association relationship, and k is a positive integer.

In an optional embodiment, the identifying module 32, before constructing the second undirected graph according to the candidate network environment information in the network environment list existing in the plurality of terminal devices and their surroundings, is further configured to: for each terminal device, if the number of candidate network environment information in the network environment list existing around the terminal device is greater than or equal to a first number N, N candidate network environment information with the strongest signal strength is reserved, and other candidate network environment information is removed, wherein N is a positive integer.

In an optional embodiment, when identifying at least one sub-graph that meets the specified core degree k in the second undirected graph, the identifying module 32 is specifically configured to: removing nodes with the core degree smaller than k in the second undirected graph to obtain candidate subgraphs; and removing nodes with the core degree smaller than k in the candidate subgraphs to obtain at least one subgraph with the specified core degree k.

In an optional embodiment, the receiving module 31 is further configured to: the method includes receiving notification information that a plurality of terminal devices report that a local terminal has a specific behavior and providing the notification information to the determining module 33, where the determining module 33 is specifically configured to determine that the local terminal of any terminal device has the specific behavior when the receiving module 31 receives the notification information reported by any terminal device.

Fig. 3b is a schematic structural diagram of a traffic identification device according to an exemplary embodiment of the present application. As shown in fig. 3b, the apparatus comprises: a memory 34 and a processor 35.

Memory 34 is used to store computer programs and may be configured to store other various data to support operations on the traffic identification device. Examples of such data include instructions for any application or method operating on the traffic identification device.

The memory 34 may be implemented by any type or combination of volatile or non-volatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.

A processor 35, coupled to the memory 34, for executing the computer program in the memory 34 for: receiving accessed target network environment information reported by a plurality of terminal devices running a first application and a network environment list existing around the terminal devices in the statistical time; identifying a first equipment group with a first association relation among the plurality of terminal equipment according to the plurality of terminal equipment and target network environment information accessed by the terminal equipment; identifying a second equipment group with a second association relation between the plurality of terminal equipment according to the network environment lists existing around the plurality of terminal equipment; and aiming at any terminal equipment in the first equipment group and the second equipment group, when the local terminal of any terminal equipment has a specific behavior, determining that the popularization flow generated by any terminal equipment based on the first application is a specific flow.

In an optional embodiment, the processor 35, after determining that the promotion traffic generated by any of the terminal devices based on the first application is a specific traffic, is further configured to: and filtering the specific traffic generated by any terminal device based on the first application from the promotion traffic generated by the first application based on the identification information of any terminal device.

In an optional embodiment, when identifying, according to the environment information of the target network to which the multiple terminal devices access, a first device group having a first association relationship between the multiple terminal devices, the processor 35 is specifically configured to: removing specific network environment information existing in target network environment information accessed by a plurality of terminal devices to obtain at least one piece of available network environment information; constructing a first undirected graph according to the plurality of terminal devices and at least one piece of available network environment information, wherein a node in the first undirected graph represents one terminal device or one piece of available network environment information, and an edge in the first undirected graph represents an access relation between the terminal device and the available network environment information; at least one maximum connected subgraph existing in the first undirected graph is identified, and terminal devices represented by nodes in each maximum connected subgraph form a first device group with a first association relationship.

In an optional embodiment, when removing specific network environment information existing in target network environment information accessed by the multiple terminal devices, the processor 35 is specifically configured to: for each target network environment information, if the number of terminal devices accessing the target network environment information is greater than or equal to a set number threshold, rejecting the target network environment information as specific network environment information; and/or, for each target network environment information, if the target network environment information exists in a pre-maintained network information white list, removing the target network environment information as the specific network environment information.

In an optional embodiment, when the processor 35 identifies, according to the network environment list existing between the plurality of terminal devices and its surroundings, a second device group having a second association relationship between the plurality of terminal devices, specifically: constructing a second undirected graph according to the candidate network environment information in the network environment list existing around the plurality of terminal devices, wherein a node in the second undirected graph represents one terminal device or one candidate network environment information, and an edge in the second undirected graph represents a candidate relationship between the terminal device and the candidate network environment information; and identifying at least one subgraph which accords with the specified core degree k and exists in the second undirected graph, wherein terminal equipment represented by nodes in each subgraph which accords with the specified core degree k form a second equipment group with a second association relationship, and k is a positive integer.

In an optional embodiment, the processor 35, before constructing the second undirected graph according to the candidate network environment information in the network environment list existing in the plurality of terminal devices and their surroundings, is further configured to: for each terminal device, if the number of candidate network environment information in the network environment list existing around the terminal device is greater than or equal to a first number N, N candidate network environment information with the strongest signal strength is reserved, and other candidate network environment information is removed, wherein N is a positive integer.

In an optional embodiment, when identifying at least one sub-graph that meets the specified core degree k in the second undirected graph, the processor 35 is specifically configured to: removing nodes with the core degree smaller than k in the second undirected graph to obtain candidate subgraphs; and removing nodes with the core degree smaller than k in the candidate subgraphs to obtain at least one subgraph with the specified core degree k.

In an alternative embodiment, processor 35 is further configured to: receiving the notification information of the multiple terminal devices reporting the specific behavior of the local terminal, and determining that the specific behavior of any terminal device exists in the local terminal if the notification information reported by any terminal device is received.

Further, as shown in fig. 3b, the traffic identification apparatus further includes: communication components 36, display 37, power components 38, audio components 39, and the like. Only some of the components are schematically shown in fig. 3b, and it is not meant that the traffic identification device comprises only the components shown in fig. 3 b. It should be noted that the components shown in the dashed line in fig. 3b are optional components, not necessary components, and may be determined according to the product form of the flow rate identification device. The traffic identification device of this embodiment may be implemented as a terminal device such as a desktop computer, a notebook computer, a smart phone, or an IOT device, or may be a server device such as a conventional server, a cloud server, or a server array. If the flow identification device of this embodiment is implemented as a terminal device such as a desktop computer, a notebook computer, a smart phone, etc., the flow identification device may include components within a dashed line frame in fig. 3 b; if the traffic identification device of this embodiment is implemented as a server device such as a conventional server, a cloud server, or a server array, the components in the dashed box in fig. 3b may not be included.

Accordingly, embodiments of the present application also provide a computer readable storage medium storing a computer program, which, when executed by a processor, causes the processor to implement the steps of the method shown in fig. 2.

Embodiments of the present application also provide a computer program product, which includes computer programs/instructions, when executed by a processor, cause the processor to implement the steps of the method shown in fig. 2.

The communication component of fig. 3b described above is configured to facilitate communication between the device in which the communication component is located and other devices in a wired or wireless manner. The device where the communication component is located can access a wireless network based on a communication standard, such as a WiFi, a 2G, 3G, 4G/LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component further includes a Near Field Communication (NFC) module to facilitate short-range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

The display in fig. 3b described above includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

The power supply assembly of fig. 3b provides power to the various components of the device in which the power supply assembly is located. The power components may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device in which the power component is located.

The audio component of fig. 3b, described above, may be configured to output and/or input an audio signal. For example, the audio component includes a Microphone (MIC) configured to receive an external audio signal when the device in which the audio component is located is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal may further be stored in a memory or transmitted via a communication component. In some embodiments, the audio assembly further comprises a speaker for outputting audio signals.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A traffic identification method, comprising:

receiving accessed target network environment information reported by a plurality of terminal devices running a first application and a network environment list existing around the terminal devices in the statistical time;

identifying a first equipment group with a first association relation among the plurality of terminal equipment according to the plurality of terminal equipment and target network environment information accessed by the plurality of terminal equipment;

identifying a second equipment group with a second association relation between the plurality of terminal equipment according to the network environment lists existing around the plurality of terminal equipment;

and determining that the promotion traffic generated by any terminal device based on the first application is specific traffic when a specific behavior exists at the local terminal of any terminal device for any terminal device in the first device group and the second device group.

2. The method according to claim 1, wherein after determining that the promotion traffic generated by any of the terminal devices based on the first application is a specific traffic, the method further comprises:

and filtering the specific traffic generated by any terminal device based on the first application from the promotion traffic generated by the first application based on the identification information of any terminal device.

3. The method of claim 1, wherein identifying a first device group having a first association relationship among the plurality of terminal devices according to the target network environment information of the plurality of terminal devices and the target network environment information to which the plurality of terminal devices access comprises:

removing specific network environment information existing in target network environment information accessed by the plurality of terminal devices to obtain at least one piece of available network environment information;

constructing a first undirected graph according to the plurality of terminal devices and the at least one piece of available network environment information, wherein a node in the first undirected graph represents one terminal device or one piece of available network environment information, and an edge in the first undirected graph represents an access relation between the terminal device and the available network environment information;

and identifying at least one maximum connected subgraph existing in the first undirected graph, wherein the terminal devices represented by the nodes in each maximum connected subgraph form a first device group with a first association relationship.

4. The method of claim 3, wherein removing specific network environment information from the target network environment information accessed by the plurality of terminal devices comprises:

for each target network environment information, if the number of terminal devices accessing the target network environment information is greater than or equal to a set number threshold, rejecting the target network environment information as specific network environment information;

and/or the presence of a gas in the gas,

and for each target network environment information, if the target network environment information exists in a pre-maintained network information white list, removing the target network environment information as specific network environment information.

5. The method of claim 1, wherein identifying a second device group having a second association relationship between the plurality of terminal devices according to a list of network environments existing around the plurality of terminal devices comprises:

constructing a second undirected graph according to the candidate network environment information in the network environment lists existing around the plurality of terminal devices, wherein a node in the second undirected graph represents one terminal device or one candidate network environment information, and an edge in the second undirected graph represents a candidate relationship between the terminal device and the candidate network environment information;

and identifying at least one subgraph which accords with the specified core degree k and exists in the second undirected graph, wherein terminal equipment represented by nodes in each subgraph which accords with the specified core degree k forms a second equipment group with a second association relationship, and k is a positive integer.

6. The method of claim 5, wherein before constructing the second undirected graph according to the candidate network environment information in the network environment lists existing around the plurality of terminal devices, the method further comprises:

for each terminal device, if the number of candidate network environment information in the network environment list existing around the terminal device is greater than or equal to a first number N, N candidate network environment information with the strongest signal strength is reserved, and other candidate network environment information is removed, wherein N is a positive integer.

7. The method of claim 5, wherein identifying at least one subgraph in accordance with a specified core degree k that exists in the second undirected graph comprises:

removing nodes with the core degree smaller than k in the second undirected graph to obtain candidate subgraphs;

and removing the nodes with the core degree smaller than k in the candidate subgraphs to obtain at least one subgraph with the specified core degree k.

8. The method of claim 1, further comprising:

and receiving notification information of the plurality of terminal devices reporting that the local terminal has the specific behavior, and determining that the local terminal of any terminal device has the specific behavior if the notification information reported by any terminal device is received.

9. The method of claim 8, wherein the specific behavior comprises at least one of: install high-risk APP on arbitrary terminal equipment, arbitrary terminal equipment has opened the debugging mode or arbitrary terminal equipment has opened the accessible mode.

10. A flow identification device, comprising: a memory and a processor;

the memory for storing a computer program;

the processor, coupled with the memory, to execute the computer program to: receiving accessed target network environment information reported by a plurality of terminal devices running a first application and a network environment list existing around the terminal devices in the statistical time; identifying a first equipment group with a first association relation among the plurality of terminal equipment according to the plurality of terminal equipment and target network environment information accessed by the plurality of terminal equipment; identifying a second equipment group with a second association relation between the plurality of terminal equipment according to the network environment lists existing around the plurality of terminal equipment; and determining that the promotion traffic generated by any terminal device based on the first application is specific traffic when a specific behavior exists at the local terminal of any terminal device for any terminal device in the first device group and the second device group.

11. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the processor to carry out the steps of the method according to any one of claims 1 to 9.

12. A computer program product comprising computer programs/instructions, characterized in that, when executed by a processor, causes the processor to implement the steps in the method of any of claims 1-9.