CN114783007B - Equipment fingerprint identification method and device and electronic equipment - Google Patents
Equipment fingerprint identification method and device and electronic equipment Download PDFInfo
- Publication number
- CN114783007B CN114783007B CN202210708179.0A CN202210708179A CN114783007B CN 114783007 B CN114783007 B CN 114783007B CN 202210708179 A CN202210708179 A CN 202210708179A CN 114783007 B CN114783007 B CN 114783007B
- Authority
- CN
- China
- Prior art keywords
- features
- equipment
- fingerprint
- effective
- event
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 74
- 238000007477 logistic regression Methods 0.000 claims abstract description 62
- 238000012216 screening Methods 0.000 claims abstract description 28
- 238000000926 separation method Methods 0.000 claims abstract description 18
- 238000012795 verification Methods 0.000 claims abstract description 16
- 238000009826 distribution Methods 0.000 claims abstract description 12
- 230000008569 process Effects 0.000 claims description 27
- 238000004364 calculation method Methods 0.000 claims description 24
- 239000011159 matrix material Substances 0.000 claims description 23
- 238000013145 classification model Methods 0.000 claims description 19
- 238000003860 storage Methods 0.000 claims description 17
- 238000012545 processing Methods 0.000 claims description 8
- 230000006870 function Effects 0.000 claims description 6
- 239000013598 vector Substances 0.000 claims description 6
- 230000006978 adaptation Effects 0.000 claims description 5
- 238000013475 authorization Methods 0.000 claims description 5
- 238000004891 communication Methods 0.000 claims description 4
- 230000008859 change Effects 0.000 abstract description 32
- 238000004519 manufacturing process Methods 0.000 abstract description 4
- 238000010586 diagram Methods 0.000 description 9
- 238000012549 training Methods 0.000 description 9
- 238000012360 testing method Methods 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 5
- 238000011161 development Methods 0.000 description 4
- 230000018109 developmental process Effects 0.000 description 4
- 230000000694 effects Effects 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 230000011218 segmentation Effects 0.000 description 2
- 240000008168 Ficus benjamina Species 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000009933 burial Methods 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 238000011217 control strategy Methods 0.000 description 1
- 238000002790 cross-validation Methods 0.000 description 1
- 238000007599 discharging Methods 0.000 description 1
- 230000007613 environmental effect Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000012417 linear regression Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 238000011112 process operation Methods 0.000 description 1
- 238000010187 selection method Methods 0.000 description 1
- 238000005728 strengthening Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000002123 temporal effect Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/24323—Tree-organised classifiers
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- General Engineering & Computer Science (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Life Sciences & Earth Sciences (AREA)
- Software Systems (AREA)
- Medical Informatics (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Collating Specific Patterns (AREA)
Abstract
The application provides a device fingerprint identification method, a device and electronic equipment. And screening effective features, performing box-separation verification and box-separation gain on the numerical distribution of the effective features to obtain the processed effective features, establishing a logistic regression model by using the processed effective features and label classification, and iterating until an iteration termination condition is met to obtain identification features in the effective features. And acquiring corresponding identification characteristics aiming at the equipment information to be identified, and acquiring the different scores of the equipment according to the logistic regression model so as to judge whether the fingerprint of the equipment is changed. According to the scheme, the change of the characteristics can be extracted as the original characteristics, and a reliable equipment fingerprint identification scheme can be established in a complex production environment through the screening of effective characteristics and the iteration of a logistic regression model, so that the wind control capability of a service scene is enhanced.
Description
Technical Field
The invention relates to the technical field of internet, in particular to a method and a device for identifying a device fingerprint and electronic equipment.
Background
With the rapid development of computer technology and mobile internet, business centers of various industries such as finance, medical treatment, e-commerce and the like are gradually shifted from off-line to on-line, and meanwhile, black-product transactions parasitizing on the mobile internet are gradually started and even reach the flooding step. The black industry chain carries out fraud attack on online business by means of false registration, forged information, account embezzlement and the like, and therefore fraud and profit are achieved.
The original finger of the equipment fingerprint technology can be used for uniquely identifying the equipment characteristics or unique equipment identification of the equipment, the perfect equipment fingerprint technology in the scene can realize the unique authentication of the user, prevent the black product from being disguised as a new user by modifying the equipment parameters to implement fraud, and also prevent the risk of embezzlement of the user account. The traditional device fingerprinting technology adopts a dominant identifier, namely a dominant device ID, to track the device (such as IMEI, IDFA and the like), and collects the implicit attribute information of the device and generates a unique device ID through a specific algorithm to identify the device. With the continuous improvement of the underlying security protocols of various devices and the continuous development of mobile ecology (various small program environments), various explicit device IDs of users are generally not allowed to be collected and transmitted as a key part of private information of the users. Meanwhile, with the continuous development of the black production technology, the device ID has the possibility of being tampered, and the effectiveness of the wind control strategy is affected by excessively depending on the device ID. Under the background, the method is a more feasible and reliable device fingerprint identification scheme under the mobile internet environment by strengthening the device invisible feature acquisition and constructing the device fingerprint by utilizing various analysis modeling and machine learning methods.
However, the problems of complex diversity of the collected information of the device, and the existence of naturally changing features over time, how to quantify the features, and how to select the feature basis beneficial to the fingerprint change identification of the device from the diversified features are still lack of research.
In addition, in the prior art, the device fingerprint tag of the user is usually in a black box state, that is, even if a large amount of user device information is collected from a service scene trigger, it cannot be accurately determined which of the user device information has been changed, that is, an effective tag is not available for verification and modeling. In this scenario, how to solve the modeling cold start problem and the effective feature screening problem is still lack of research.
Disclosure of Invention
The invention aims to provide a device fingerprint identification method, a device fingerprint identification device and an electronic device, which can realize reliable device fingerprint identification and enhance the wind control capability of a business scene.
Embodiments of the invention may be implemented as follows:
in a first aspect, the present invention provides a device fingerprinting method, including:
collecting multiple pieces of equipment information of a user in an event process of operating equipment, wherein each piece of equipment information comprises multiple pieces of characteristic information;
performing label classification on the collected equipment information, performing similarity calculation on corresponding features of adjacent events of the same user, and taking a similarity value as an original feature;
screening effective characteristics from the original characteristics according to the established classification model, and performing box-separation verification and box-separation gain on the numerical distribution of the effective characteristics to obtain the processed effective characteristics;
establishing a logistic regression model by using the processed effective features and label classification, and iterating the logistic regression model until the identification features in the effective features are obtained when iteration termination conditions are met;
the method comprises the steps of obtaining identification characteristics corresponding to equipment information to be identified according to the equipment information to be identified, calculating a dissimilarity score of the equipment according to a coefficient matrix of a logistic regression model when an iteration termination condition is met, identifying whether the fingerprint of the equipment is changed or not according to the dissimilarity score, and updating the fingerprint of the equipment.
In an optional embodiment, the feature information includes a numerical feature, a category feature, a vector feature, a sequence feature, a time feature, and a rate feature, and the similarity values are calculated by using different similarity calculation methods for different types of features.
In an alternative embodiment, the step of screening the original features according to the established classification includes:
establishing a classification model by using an ensemble learning tree model;
calculating the global importance of each original feature based on the accumulated value of MSE square loss reduced after the original feature is adopted to split in each layer of nodes of the tree structure of the classification model and the number of the original features;
and determining the original features with the global importance degree larger than or equal to a preset threshold value as effective features.
In an optional embodiment, the step of performing binning check and binning gain on the numerical distribution of the valid features to obtain processed valid features includes:
sorting the plurality of effective characteristics according to the numerical value, and independently taking each sorted effective characteristic as a group;
calculating the chi-square values of the effective features of the two groups for every two adjacent groups, combining the two adjacent groups with the minimum chi-square value into one group, and according to the method, until the calculated chi-square values are all larger than or equal to the preset chi-square value;
when the number of the obtained groups is more than or equal to 2, independently taking the group with the largest numerical value as a sub-box, and combining the rest groups into a sub-box to obtain two sub-boxes;
and calculating the bad sample rate of the effective features in each box to be used as box gain so as to process the effective features.
In an optional embodiment, the step of establishing a logistic regression model by using the processed effective features and the label classification, and obtaining the identification features in the effective features by iterating the logistic regression model until an iteration termination condition is met includes:
sequentially traversing each processed effective characteristic, gradually adding the effective characteristics by adopting a forward method to establish a logistic regression model, and recording each coefficient value and a KS difference value in a coefficient matrix of the logistic regression model after each effective characteristic is added;
if the KS difference value is within the set range and all coefficient values are positive values, judging the added effective features as identification features;
after multiple iterations, all the identification features in the effective features are determined when the iteration termination condition is met.
In an optional embodiment, the step of calculating a dissimilarity score of the device according to a coefficient matrix of the logistic regression model when the iteration termination condition is satisfied, and identifying whether the fingerprint of the device is changed according to the dissimilarity score includes:
calculating to obtain the different scores of the equipment according to the identification characteristics corresponding to the equipment information to be identified and the coefficient matrix of the logistic regression model when the iteration termination condition is met;
obtaining a score threshold value calculated in advance according to a set box-dividing bad sample rate;
and identifying whether the fingerprint of the equipment is changed or not according to the score threshold value and the calculated different scores.
In an optional embodiment, the step of identifying whether the device fingerprint is changed according to the distinct score and updating the device fingerprint includes:
if the current event device fingerprint of the device information to be identified is not changed compared with the device fingerprint of the previous event, updating the device fingerprint of the previous event to be the latest device fingerprint;
if the current event device fingerprint of the device information to be identified is changed compared with the device fingerprint of the previous event, judging whether the current event device fingerprint is repeated with the device fingerprint in any historical event;
if the current event device fingerprint is not repeated with the device fingerprint in any historical event, updating the current event device fingerprint into a log;
and if the current event device fingerprint is repeated with the device fingerprint in one historical event, updating the device fingerprint in the historical event to be the latest device fingerprint.
In an optional embodiment, the step of collecting multiple pieces of device information of a user in an event process of operating a device includes:
and performing multi-event embedding on a user in the full-flow operation of the event process of operating the equipment so as to acquire equipment information of the user in different event processes, wherein the equipment information comprises basic information, environment information, adaptation information, function support and authorization information and other information.
In a second aspect, the present invention provides an apparatus for fingerprint recognition of a device, the apparatus comprising:
the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring multiple pieces of equipment information of a user in the event process of operating equipment, and each piece of equipment information comprises multiple pieces of characteristic information;
the calculation module is used for carrying out label classification on the acquired equipment information, carrying out similarity calculation on corresponding features of adjacent events of the same user and taking the similarity value as an original feature;
the screening module is used for screening effective features from the original features according to the established classification model, and performing box separation verification and box separation gain on the numerical distribution of the effective features to obtain the processed effective features;
the iteration module is used for establishing a logistic regression model by utilizing the processed effective characteristics and the label classification, and obtaining the identification characteristics in the effective characteristics by iterating the logistic regression model until iteration termination conditions are met;
the identification module is used for obtaining the identification characteristics corresponding to the equipment information to be identified according to the equipment information to be identified, calculating the different scores of the equipment according to the coefficient matrix of the logistic regression model when the iteration termination condition is met, identifying whether the equipment fingerprint is changed or not according to the different scores, and updating the equipment fingerprint.
In a third aspect, the present invention provides an electronic device comprising one or more storage media and one or more processors in communication with the storage media, the one or more storage media storing processor-executable machine-executable instructions that, when executed by the electronic device, are executed by the processors to perform the method steps of any one of the preceding embodiments.
The beneficial effects of the embodiment of the invention include, for example:
the application provides a device fingerprint identification method, a device and electronic equipment. And then screening out effective features from the original features according to the classification model, performing box-separation verification and box-separation gain on the numerical distribution of the effective features to obtain the processed effective features, establishing a logistic regression model by using the processed effective features and label classification, and performing iteration until the identification features in the effective features are obtained when the iteration termination condition is met. And acquiring corresponding identification characteristics aiming at the equipment information to be identified, and acquiring the different scores of the equipment according to the logistic regression model so as to judge whether the fingerprint of the equipment is changed. According to the scheme, the change of the characteristics can be extracted as the original characteristics in a similarity calculation mode, and a reliable equipment fingerprint identification scheme can be established in a complex production environment through screening of effective characteristics and iteration of a logistic regression model, so that the wind control capability of a service scene is enhanced.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained according to the drawings without inventive efforts.
Fig. 1 is a flowchart of a device fingerprint identification method according to an embodiment of the present application;
fig. 2 is a schematic diagram of device information provided in an embodiment of the present application;
FIG. 3 is a flowchart of sub-steps involved in step S103 of FIG. 1;
FIG. 4 is a schematic diagram illustrating feature importance of an ensemble learning tree model according to an embodiment of the present disclosure;
FIG. 5 is another flowchart of the sub-steps involved in step S103 of FIG. 1;
FIG. 6 is a flowchart of sub-steps included in step S104 of FIG. 1;
FIG. 7 is a diagram illustrating model training result data provided in an embodiment of the present application;
FIG. 8 is a diagram illustrating the effect of a logistic regression model provided in an embodiment of the present application;
FIG. 9 is a flowchart of sub-steps involved in step S105 of FIG. 1;
FIG. 10 is a diagram illustrating an example of fingerprint modification of a device according to an embodiment of the present application;
fig. 11 is a block diagram of an electronic device according to an embodiment of the present application;
fig. 12 is a functional block diagram of a device fingerprint identification apparatus according to an embodiment of the present application.
An icon: 110-a storage medium; 120-a processor; 130-device fingerprint recognition means; 131-an acquisition module; 132-a calculation module; 133-a screening module; 134-an iteration module; 135-an identification module; 140-communication interface.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. The components of embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a wide variety of different configurations.
Thus, the following detailed description of the embodiments of the present invention, as presented in the figures, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.
It should be noted that the features of the embodiments of the present invention may be combined with each other without conflict.
Referring to fig. 1, a flowchart of a device fingerprint identification method according to an embodiment of the present application is shown, where method steps defined by a flow related to the device fingerprint identification method may be implemented by an electronic device, for example, a personal computer, a notebook computer, a smart phone, a server, and other devices. The specific process shown in FIG. 1 will be described in detail below.
S101, collecting multiple pieces of equipment information of a user in an event process of operating equipment, wherein each piece of equipment information comprises multiple pieces of characteristic information.
S102, performing label classification on the collected equipment information, performing similarity calculation on corresponding features of adjacent events of the same user, and taking the similarity value as an original feature.
S103, screening effective characteristics from the original characteristics according to the established classification model, and performing box separation verification and box separation gain on the numerical distribution of the effective characteristics to obtain the processed effective characteristics.
And S104, establishing a logistic regression model by using the processed effective features and the label classification, and iterating the logistic regression model until the identification features in the effective features are obtained when iteration termination conditions are met.
S105, aiming at the equipment information to be identified, obtaining the identification characteristics corresponding to the equipment information to be identified, calculating the dissimilarity score of the equipment according to the coefficient matrix of the logistic regression model when the iteration termination condition is met, identifying whether the equipment fingerprint is changed or not according to the dissimilarity score, and updating the equipment fingerprint.
The device fingerprint identification method provided in this embodiment mainly identifies whether the user uses a new device or a suspicious device under a new operation event by performing device fingerprint verification on the device information in the user operation event stream, and therefore, it is necessary to acquire the device information during the event process of operating the device by the user.
In this embodiment, based on a specific network development environment (APP terminal, WEB terminal, mobile applet terminal, etc.), page burial is performed on different events of a user, so as to realize device information acquisition on different events of the user. When the device information is collected, multiple event points can be buried in the whole process operation of the event process of the user in the operation device, so that the device information of the user in different event processes can be collected. Wherein, the event set participating in the buried point can be defined as
。
The device information collected by different system environments is different, and the collected device information can be multiple, that is, the device information can be device information of multiple different types. The device information may include basic information, environmental information, adaptation information, function support and authorization information, and other information.
For example, in the device information scheme based on the wechat applet environment, the collected device information is each field that the applet allows to collect and transfer, as shown in fig. 2.
The basic information mainly includes fields such as device brand, device model, operating system, version, etc. The environment information mainly includes fields such as environment version number, user font size, platform language, etc. The adaptation information mainly includes fields such as pixel density, screen width, platform language, etc. The function support and authorization information mainly includes fields such as whether positioning is supported, whether WIFI is supported, whether Bluetooth is supported, whether notification is allowed, and the like. Other information primarily includes fields such as power level, device performance level, current device network type, etc.
The fields shown in fig. 2 are partial field representations, and the more comprehensive the field is collected, the higher the accuracy of the device fingerprint. In addition, if the user is allowed to exchange through a multi-system environment, for example, the APP side, the applet side, etc., a set of general fields may also be defined to identify the user equipment fingerprint change. In this embodiment, the feature information included in the device information, i.e. the field under the device information, may be defined as
。
And carrying out known label and unknown label classification on the collected equipment information of the user in the event stream, and carrying out subsequent model training on the user. In this embodiment, a device information label with a clear device change meaning is marked with a known label, for example, a device information sample in which the brand of the user device is changed from a to B occurs, it can be clearly known that the sample has a device change and is used as a known sample, and the remaining device information labels are used as unknown samples.
Considering that the number of device fraud samples in the actual service scenario is smaller than that of real samples, the known samples can be preliminarily defined as class 1 (if device change occurs), and the unknown samples can be preliminarily defined as class 0 (if device change does not occur).
Wherein,
represents a set of m class 1 samples,
representing a set of n-m class 0 samples.
Representing the kth device information sample by event
Change to an event
Sequence of similarity values of time, from feature information
And calculating.
In an actual application scenario, the number of class 1 samples is often small, and therefore, when the class 1 samples are insufficient or have a small proportion, a part of the class 1 samples can be determined by adopting a manual marking mode, for example, expansion, deformation and the like can be performed on the basis of the existing class 1 samples to generate new class 1 samples. Thus, the model is ensured to have a cold start modeling basis.
And the similarity value is obtained by calculating the corresponding characteristics of the adjacent events of the same user. The feature information may be divided into a number of different types including, for example, numeric, categorical, vector, temporal, and rate-type features. And the similarity values of the different types of features are calculated by adopting different similarity calculation modes.
In this embodiment, the similarity value between the corresponding feature information of the adjacent events obtained by calculation is used as the original feature, so that the change condition of the feature information between the operation events can be reflected, and an effective basis is provided for the judgment of the fingerprint change of the device.
In view of the fact that some of the obtained original features may not well reflect the change of the device fingerprint, in this embodiment, a classification model is used to screen out effective features from the original features. In addition, in the scene of the device fingerprint, part of the features are only effective in some abrupt sections, for example, the "power level" in the device information may reflect the device fingerprint change only when the change rate is large, but cannot be effective in other numerical bands.
Therefore, in this embodiment, it is considered that effective features screened by using a feature screening method such as an information variance method, a KS method, or the like may fail to determine the effectiveness of the whole feature due to an excessively small proportion of effective segments. Therefore, in this embodiment, the ensemble learning tree model is used to screen the effective features, and the ensemble learning tree model can automatically screen the effective segments by using a feature node segmentation method, and improve the feature effectiveness rating by repeatedly calling in the tree nodes.
And on the basis of obtaining the effective characteristics by screening, performing box separation verification and box separation gain on the numerical value distribution of the effective characteristics to obtain the processed effective characteristics.
On the basis, the identification characteristics which can be used for equipment fingerprint change identification can be determined according to the model at the final iteration termination through the process of optimizing the logistic regression model by using the logistic regression model and based on the effective characteristics.
By the method of processing based on the device information samples in advance, the optimized logistic regression model and the determined identification characteristics for device fingerprint change identification are obtained. Therefore, when the device information to be identified is aimed at, the identification features corresponding to the device information to be identified can be obtained in the same manner, and then the different scores are obtained by combining the logistic regression model obtained through optimization, wherein the different scores represent the degree of dissimilarity of feature information in two adjacent events. That is, the larger the dissimilarity score, the more dissimilar the feature information.
Further, it is possible to determine whether the device fingerprint is changed based on the dissimilarity score, and update the device fingerprint according to the result of the determination.
As can be seen from the above, the feature information in the present embodiment may be divided into a plurality of different types, and for different types of feature information, different calculation methods are adopted when calculating the similarity value.
For the numerical features, when calculating the similarity values of the features corresponding to the adjacent events, the method may use an absolute value or a squared difference, as shown in the following formula:
wherein,x i the value of the degree of similarity is represented,
representing eventsp j The characteristic information of (a) the characteristic information of (b),
representing eventsp j-1 Characteristic information of (1).
For the class-type feature, the similarity value is recorded as 0 when the class is unchanged, and is recorded as 1 otherwise, as follows:
for the sequence type features, the proportion of the elements which are overlapped in the two sequences to all the elements in the two sequences is considered in calculating the similarity value, and the following formula is adopted:
for vector type features, the similarity value is obtained by calculating the euclidean distance between two vectors:
for the time-type feature, the similarity value is calculated according to the following formula:
wherein,
for the original feature varying by an amplitude of
The time required (i.e. the time difference between adjacent events),
in the class 0 set, the variation range of the characteristic of all class 0 sample users is counted, and the variation range is
The median of the time required.
For rate-type features, the similarity value calculation formula is as follows:
in this embodiment, the device fingerprint is calculated by collecting device information by devices in the event stream, so whether the features will naturally change over time, and the validity and reasonableness of the features change over time need to be considered. Taking "environment version number" in the environment information shown in fig. 2 as an example, if the user logs in after a long time of silence, the environment version number may be naturally upgraded, and at this time, if the user information is directly calculated by using a similarity calculation method of numerical or category features, it is considered that the user information is changed too much and is easily identified by mistake as new equipment logging.
Therefore, the time-based feature is introduced, and the actual variation reflected by the variation is measured from the point of view of statistical significance. For example, if the version number of the ue is changed from (3.2.1) to (3.4.4), the change width is (0.2.3), and the time required for the change width to be (0.2.3) is counted in the class 0 users, and the deviation between the change width and the reference value of the user is obtained by using the median (other statistical indexes such as the mean, the mode, and the quantile) as the reference value, which can reflect the actual change amount of the feature.
The rate-type feature takes "power level" in other information as an example, normal power level may naturally float, if the interval time is too long, the change of power level no longer has practical significance (the user may naturally generate active charging and discharging actions to cause feature failure), but if the interval time is changed, the device is most likely to change, so the rate-type feature is introduced to perform similarity calculation.
In addition, in the present embodiment, for the feature having a directional significance, a block coding method may be adopted to perform feature extension, wherein the extension may be performed according to the following method:
as shown in the above formula whenx i With directional significance, the original 1-dimensional features can be expanded to
And
a two-dimensional feature.
Through the above manner, the feature change can be accurately quantified, and the loss of feature information is avoided.
On the basis of calculating the similarity value as the original characteristic, an ensemble tree learning model can be adopted to screen out the effective characteristic. Referring to fig. 3, in the present embodiment, the step of screening the valid features in step S103 can be implemented by the following steps:
and S1031, establishing a classification model by using the ensemble learning tree model.
S1032, aiming at each original feature, calculating to obtain the global importance of the original feature based on the accumulated value of MSE square loss reduced after the original feature is adopted to split in each layer of nodes of the tree structure of the classification model and the number of the original features.
And S1033, determining the original features with the global importance degree larger than or equal to a preset threshold value as effective features.
In this embodiment, an ensemble learning tree model is used to establish a classification model, and feature primary screening is performed according to feature importance (feature importance) of the tree model. The effective features are screened out by calculating the global importance of each original feature and comparing the global importance with a preset threshold.
In this embodiment, the global importance of the original feature is calculated by the following formula:
wherein,
representing the global importance of the original feature j, as measured by the average of the importance of the original feature j in a single tree. L represents a leaf node layer of the constructed tree, L-1 is a layer (non-leaf node) above the leaf node of the tree, and so on;
original features associated with the t-th level nodes;
the MSE squared loss in the t-th level node is reduced after splitting by using the original feature j. Fig. 4 is a schematic diagram illustrating feature importance of the ensemble learning tree model, wherein the abscissa of fig. 4 is feature importance (feature importance) and the ordinate is each feature.
In this embodiment, the original features with the global importance greater than or equal to the preset threshold are determined as valid features for subsequent training. And the original features with the global importance degree smaller than the preset threshold are not valid features.
Referring to fig. 5, on the basis of the screened effective features, in the present embodiment, when performing binning check and binning gain on the effective features in step S103, the following steps may be performed:
s1034, sorting the effective characteristics according to the numerical value, and taking each sorted effective characteristic as a group.
S1035, for every two adjacent groups, calculating chi-square values of the effective features of the two groups, and combining the two adjacent groups with the smallest chi-square value into one group, in this way, until the calculated chi-square values are all greater than or equal to the preset chi-square value.
And S1036, when the number of the obtained groups is greater than or equal to 2, independently taking the group with the largest numerical value as a sub-box, and combining the rest groups into one sub-box to obtain two sub-boxes.
And S1037, calculating a bad sample rate of the effective features in each bin as a bin gain so as to process the effective features.
In this embodiment, after the feature preliminary screening is performed, a ChiMerge method may be used to perform binning verification on the effective features, where ChiMerge is based on the chi-square verification theory. First, feature binning initialization may be performed, i.e., sorting a number of valid features by size. Wherein, the plurality of valid features refers to a plurality of valid features of the same type in a plurality of samples.
Then, feature merging is performed, wherein the preset chi-squared value may be 0.05. And if the number of the finally obtained groups is more than or equal to 2, the characteristics are considered to have segmentation effectiveness, one group with the largest value is reserved and can be marked as a sub-box 2, and the rest groups are combined into a sub-box 1. In this embodiment, only two bins are reserved when there are multiple packets to avoid too high feature sparsity.
In this embodiment, the obtained bad sample rate of binning is calculated as binning gain, and the effective features are processed in the following manner:
wherein,
representing the bad sample rate of bin 2,
representing the bad sample rate of bin 1.
On the basis of the above, in this embodiment, the identification feature that can be finally used for device fingerprint identification is determined by using the logistic regression model in step S104.
Referring to fig. 6, in the present embodiment, the step S104 can be implemented by:
and S1041, sequentially traversing each processed effective feature, gradually adding the effective features by adopting a forward method to establish a logistic regression model, and recording each coefficient value and a KS difference value in a coefficient matrix of the logistic regression model after each effective feature is added.
And S1042, if the KS difference value is within the set range and all coefficient values are positive values, judging the added effective features as the identification features.
And S1043, after multiple iterations, determining all the identification features in the effective features when the iteration termination condition is met.
In this embodiment, a logistic regression model is established by using the processed effective features and sample classification:
wherein,
classifying labels for the samples during the classification of the equipment information labels;
the effective characteristic matrix processed under the sample is obtained;
the linear regression coefficient matrix is also a characteristic weight matrix, and the larger the coefficient is, the stronger the importance of reflecting the characteristic in identifying the fingerprint change of the user equipment is.
In this embodiment, in order to ensure that each coefficient value in the coefficient matrix is a positive value and to remove multiple collinearity between features, in this embodiment, a Forward selection method (Forward selection) is adopted to gradually introduce valid features and iteratively build a logistic regression model. And judging whether the newly introduced valid features are valid or not in a k-fold cross validation mode. In addition, whether the newly introduced valid features are valid can also be judged by adopting a test set verification mode.
Specifically, in this embodiment, each effective feature may be traversed sequentially according to the global importance obtained by the above calculation, and the traversed effective features may be added to the training of the logistic regression model. The logistic regression model effect was recorded after each new addition of valid features, including the average KS values (of the training and test sets) and the individual coefficient values in the coefficient matrix.
And calculating a KS difference value according to the average KS values of the training set and the test set, wherein if the absolute value of the KS difference value is within a set range, such as 0.5 range, and all coefficient values are positive values, the newly introduced effective feature can be judged to be an effective and robust feature.
And selecting newly introduced effective features with the maximum average KS value of the test set from the effective and stable features, and adding the newly introduced effective features into the identification features, and if the average KS values of the test set are the same, selecting the effective features with the maximum global importance to be added into the identification features. And repeating the process until the model effect is not improved any more or effective and stable characteristics can not be found any more, stopping training and obtaining the final logistic regression model.
In the example shown in fig. 7 and fig. 8, after 13 iterations, no more effective and robust feature can be found, so that the iteration is terminated, and finally the found 12-dimensional identification feature can be used as the feature for identifying the fingerprint change of the device. The abscissa of fig. 8 is the iteration round number, the left ordinate is the training set average ks/test set average ks, and the right ordinate is the ks difference.
The above processes are processes of processing equipment information to obtain original features, primarily screening the original features to obtain effective features, binning and processing the effective features, training a logistic regression model based on the effective features, and obtaining identification features for identifying equipment fingerprint changes.
When the device fingerprint change is actually identified, the identification features corresponding to the device information to be identified can be obtained in the same manner, and the obtained logistic regression model is used to obtain the different scores. Referring to fig. 9, in the present embodiment, the step of obtaining the dissimilarity score in step S105 may be implemented by:
s1051, calculating to obtain the different scores of the equipment according to the identification characteristics corresponding to the equipment information to be identified and the coefficient matrix of the logistic regression model when the iteration termination condition is met.
And S1052, obtaining a score threshold value which is obtained by calculation in advance according to the set bin dividing bad sample rate.
And S1053, identifying whether the device fingerprint is changed according to the score threshold and the calculated distinct score.
In this embodiment, after the logistic regression model is established in the above manner, a reasonable score threshold may be determined according to the model effect, and when the dissimilarity score exceeds the score threshold, it may be determined that the device fingerprint has been changed.
The dissimilarity score can be calculated by the following formula:
where f (x) represents a dissimilarity score, with a greater dissimilarity score indicating a greater likelihood of a device fingerprint change between adjacent events. The fraction threshold may be determined in advance when the bad sample rate of the samples meets a certain condition, wherein the bad sample rate of the samples may be obtained based on the ratio of the class 1 sample to the class 0 sample in the samples. In this embodiment, the score threshold may be set to 0.7. That is, when the dissimilarity score exceeds 0.7, it can be determined that the device fingerprint has changed, otherwise, the device fingerprint has not changed.
In this embodiment, in the step S105, when updating the device fingerprint based on the determination result of whether the device fingerprint is changed, the following method may be implemented:
and if the current event device fingerprint of the device information to be identified is not changed from the device fingerprint of the last event, updating the device fingerprint of the last event to be the latest device fingerprint.
And if the current event device fingerprint of the device information to be identified is changed compared with the device fingerprint of the previous event, judging whether the current event device fingerprint is repeated with the device fingerprint in any historical event.
In this embodiment, in this case, it is sequentially determined whether the device fingerprint of the current event is repeated with the device fingerprints of the historical events according to the event proximity.
And if the current event device fingerprint is not repeated with the device fingerprint in any historical event, updating the current event device fingerprint into a log.
And if the current event device fingerprint is repeated with the device fingerprint in one historical event, updating the device fingerprint in the historical event to be the latest device fingerprint.
As shown in fig. 10, in the application event of the sequence 5, if the user recognizes that the device change has occurred in the previous loading event, the fingerprint 2 is added on the basis of the fingerprint 1; in the modified password event of the sequence 7, it is recognized that the device change has occurred in the previous load event, but the fingerprint 1 is the same as the load event of the sequence 4, and therefore, the update operation of the fingerprint 1 is performed without newly adding the device fingerprint.
Through the method, the equipment change state in the user event stream can be determined, once the fact that the user is newly added is found, the user authentication can be initiated in an active authentication or manual verification mode, and the condition that the account is stolen is avoided.
Referring to fig. 11, a schematic diagram of exemplary components of an electronic device according to an embodiment of the present disclosure is provided, where the electronic device may be, for example, a personal computer, a notebook computer, a smart phone, a server, and the like. The electronic device may include a storage medium 110, a processor 120, a device fingerprinting device 130 and a communication interface 140. In this embodiment, the storage medium 110 and the processor 120 are both located in the electronic device and are separately disposed. However, it should be understood that the storage medium 110 may be separate from the electronic device and may be accessed by the processor 120 through a bus interface. Alternatively, the storage medium 110 may be integrated into the processor 120, for example, may be a cache and/or general purpose registers.
The device fingerprinting apparatus 130 may be understood as the electronic device, or the processor 120 of the electronic device, or may be understood as a software functional module which is independent of the electronic device or the processor 120 and implements the device fingerprinting method under the control of the electronic device.
As shown in fig. 12, the device fingerprint identification apparatus 130 may include an acquisition module 131, a calculation module 132, a filtering module 133, an iteration module 134, and an identification module 135. The functions of the functional modules of the device fingerprint identification apparatus 130 are described in detail below.
The acquisition module 131 is configured to acquire multiple pieces of device information of a user in an event process of operating a device, where each piece of device information includes multiple pieces of feature information;
it is understood that the acquiring module 131 can be used to execute the step S101, and for the detailed implementation of the acquiring module 131, reference can be made to the above-mentioned contents related to the step S101.
The calculating module 132 is configured to perform label classification on the acquired device information, perform similarity calculation on corresponding features of adjacent events of the same user, and use a similarity value as an original feature;
it is understood that the calculating module 132 can be used to execute the step S102, and for the detailed implementation of the calculating module 132, reference can be made to the contents related to the step S102.
The screening module 133 is configured to screen effective features from the original features according to the established classification model, and perform binning verification and binning gain on the numerical distribution of the effective features to obtain processed effective features;
it is understood that the screening module 133 can be used to execute the step S103, and for the detailed implementation of the screening module 133, reference can be made to the content related to the step S103.
The iteration module 134 is used for establishing a logistic regression model by using the processed effective features and the label classification, and iterating the logistic regression model until the identification features in the effective features are obtained when iteration termination conditions are met;
it is to be understood that the iteration module 134 can be used to execute the step S104, and for the detailed implementation of the iteration module 134, reference may be made to what is described above with respect to the step S104.
The identification module 135 is configured to obtain, for the device information to be identified, an identification feature corresponding to the device information to be identified, calculate a difference score of the device according to a coefficient matrix of the logistic regression model when an iteration termination condition is satisfied, identify whether the device fingerprint is changed according to the difference score, and update the device fingerprint.
It is understood that the identification module 135 can be used to execute the above step S105, and for the detailed implementation of the identification module 135, reference can be made to the above description of step S105.
In a possible implementation manner, the feature information includes a numerical feature, a category feature, a sequence feature, a vector feature, a time feature and a rate feature, and the similarity values are calculated by using different similarity calculation methods for different types of features.
In a possible implementation, the screening module 133 may be configured to:
establishing a classification model by using an ensemble learning tree model;
calculating the global importance of each original feature based on the accumulated value of MSE square loss reduced after the original feature is adopted to split in each layer of nodes of the tree structure of the classification model and the number of the original features;
and determining the original features with the global importance degree larger than or equal to a preset threshold value as effective features.
In a possible implementation, the screening module 133 may further be configured to:
sorting the effective features according to the numerical value, and independently taking each sorted effective feature as a group;
calculating the chi-square values of the effective features of the two groups for every two adjacent groups, combining the two adjacent groups with the minimum chi-square value into one group, and according to the method, until the calculated chi-square values are all larger than or equal to the preset chi-square value;
when the number of the obtained groups is more than or equal to 2, independently taking the group with the largest numerical value as a sub-box, and combining the rest groups into a sub-box to obtain two sub-boxes;
and calculating the bad sample rate of the effective features in each box to be used as box gain so as to process the effective features.
In one possible implementation, the iteration module 134 may be configured to:
traversing each processed effective characteristic in sequence, gradually adding the effective characteristics by adopting a forward method to establish a logistic regression model, and recording each coefficient value and a KS difference value in a coefficient matrix of the logistic regression model after each effective characteristic is added;
if the KS difference value is within the set range and all coefficient values are positive values, judging the added effective features as identification features;
after multiple iterations, all the identification features in the effective features are determined when the iteration termination condition is met.
In one possible implementation, the identification module 135 may be configured to:
calculating to obtain different scores of the equipment according to the identification characteristics corresponding to the equipment information to be identified and the coefficient matrix of the logistic regression model when the iteration termination condition is met;
obtaining a score threshold value calculated in advance according to a set box-dividing bad sample rate;
and identifying whether the fingerprint of the equipment is changed or not according to the score threshold value and the calculated different scores.
In a possible implementation, the identification module 135 may be further configured to:
if the current event device fingerprint of the device information to be identified is not changed compared with the device fingerprint of the previous event, updating the device fingerprint of the previous event to be the latest device fingerprint;
if the current event device fingerprint of the device information to be identified is changed compared with the device fingerprint of the previous event, judging whether the current event device fingerprint is repeated with the device fingerprint in any historical event;
if the current event device fingerprint is not repeated with the device fingerprint in any historical event, updating the current event device fingerprint into a log;
and if the current event device fingerprint is repeated with the device fingerprint in one historical event, updating the device fingerprint in the historical event to be the latest device fingerprint.
In a possible implementation, the acquisition module 131 may be configured to:
and performing multi-event embedding on a user in the full-flow operation of the event process of operating the equipment so as to acquire equipment information of the user in different event processes, wherein the equipment information comprises basic information, environment information, adaptation information, function support and authorization information and other information.
The description of the processing flow of each module in the device and the interaction flow between the modules may refer to the related description in the above method embodiments, and will not be described in detail here.
Further, an embodiment of the present application also provides a computer-readable storage medium, where a machine-executable instruction is stored in the computer-readable storage medium, and when the machine-executable instruction is executed, the apparatus fingerprint identification method provided by the foregoing embodiment is implemented.
In particular, the computer readable storage medium can be a general storage medium, such as a removable disk, a hard disk, etc., and when executed, the computer program on the computer readable storage medium can execute the above-mentioned device fingerprint identification method. With regard to the processes involved when the executable instructions in the computer-readable storage medium are executed, reference may be made to the related descriptions in the above method embodiments, which are not described in detail herein.
In summary, according to the device fingerprint identification method, the device and the electronic device provided by the embodiment of the application, the device information is acquired in the event process of operating the device by the user, the device information is subjected to label classification, the similarity calculation is performed on the features of adjacent events, and the similarity value is used as the original feature. And then screening effective features from the original features according to the classification model, performing box-separation verification and box-separation gain on the numerical distribution of the effective features to obtain the processed effective features, establishing a logistic regression model by using the processed effective features and label classification, and performing iteration until the identification features in the effective features are obtained when the iteration termination condition is met. And acquiring corresponding identification characteristics aiming at the equipment information to be identified, and acquiring the different scores of the equipment according to the logistic regression model so as to judge whether the fingerprint of the equipment is changed. According to the scheme, the change of the characteristics can be extracted as the original characteristics in a similarity calculation mode, and a reliable equipment fingerprint identification scheme can be established in a complex production environment through screening of effective characteristics and iteration of a logistic regression model, so that the wind control capability of a service scene is enhanced.
The above description is only for the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.
Claims (7)
1. A device fingerprinting method, characterized in that the method comprises:
collecting multiple pieces of equipment information of a user in an event process of operating equipment, wherein each piece of equipment information comprises multiple pieces of characteristic information;
performing label classification on the collected equipment information, performing similarity calculation on corresponding characteristics of adjacent events of the same user, and taking a similarity value as an original characteristic, wherein the adjacent events are two adjacent operation events in an operation event stream of the user;
screening effective features from the original features according to the established classification model, and performing box-separation verification and box-separation gain on the numerical distribution of the effective features to obtain processed effective features;
establishing a logistic regression model by using the processed effective features and label classification, and iterating the logistic regression model until the identification features in the effective features are obtained when iteration termination conditions are met;
aiming at the equipment information to be identified, obtaining the identification characteristics corresponding to the equipment information to be identified, calculating the dissimilarity score of the equipment according to the coefficient matrix of the logistic regression model when the iteration termination condition is met, identifying whether the equipment fingerprint is changed or not according to the dissimilarity score, and updating the equipment fingerprint;
the step of establishing a logistic regression model by using the processed effective features and the label classification, and obtaining the identification features in the effective features by iterating the logistic regression model until an iteration termination condition is met comprises the following steps:
traversing each processed effective feature in sequence, gradually adding the effective features by adopting an advancing method to establish a logistic regression model, recording each coefficient value and a KS difference value in a coefficient matrix of the logistic regression model after each effective feature is added, judging the added effective feature as an identification feature if the KS difference value is within a set range and all the coefficient values are positive values, and determining all the identification features in the effective features after multiple iterations when an iteration termination condition is met;
the step of calculating the dissimilarity score of the equipment according to the coefficient matrix of the logistic regression model when the iteration termination condition is met and identifying whether the fingerprint of the equipment is changed according to the dissimilarity score comprises the following steps:
calculating to obtain different scores of the equipment according to the identification characteristics corresponding to the equipment information to be identified and the coefficient matrix of the logistic regression model when the iteration termination condition is met, obtaining a score threshold value calculated in advance according to the set bin bad sample rate, and identifying whether the fingerprint of the equipment is changed or not according to the score threshold value and the calculated different scores;
the step of identifying whether the device fingerprint is changed according to the different scores and updating the device fingerprint comprises the following steps:
if the device fingerprint of the event of the device information to be identified is not changed, the device fingerprint of the previous event is updated to be the latest device fingerprint, if the device fingerprint of the event of the device information to be identified is changed, then whether the current event device fingerprint is repeated with the device fingerprint of any historical event is judged, if the current event device fingerprint is not repeated with the device fingerprint of any historical event, the current event device fingerprint is updated to a log, and if the current event device fingerprint is repeated with the device fingerprint of one historical event, the device fingerprint of the historical event is updated to be the latest device fingerprint.
2. The device fingerprint identification method according to claim 1, wherein the feature information comprises numerical type features, category type features, sequence type features, vector type features, time type features and rate type features, and similarity values are calculated by different similarity calculation methods for different types of features.
3. The device fingerprinting method of claim 1, wherein the step of screening out valid features from the raw features according to the established classification model comprises:
establishing a classification model by using an ensemble learning tree model;
aiming at each original feature, calculating to obtain the global importance of the original feature based on the accumulated value of MSE square loss reduced after the original feature is adopted to split in each layer of nodes of the tree structure of the classification model and the number of the original feature;
and determining the original features with the global importance degree larger than or equal to a preset threshold value as effective features.
4. The device fingerprint identification method according to claim 1, wherein the step of performing binning check and binning gain on the value distribution of the valid features to obtain the processed valid features comprises:
sorting the effective features according to the numerical value, and independently taking each sorted effective feature as a group;
calculating the chi-square values of the effective features of the two groups for every two adjacent groups, combining the two adjacent groups with the minimum chi-square value into one group, and according to the method, until the calculated chi-square values are all larger than or equal to the preset chi-square value;
when the number of the obtained groups is more than or equal to 2, independently taking the group with the largest numerical value as a sub-box, and combining the rest groups into a sub-box to obtain two sub-boxes;
and calculating the bad sample rate of the effective features in each box to be used as box gain so as to process the effective features.
5. The device fingerprint identification method according to any one of claims 1 to 4, wherein the step of collecting multiple pieces of device information of a user during an event of operating the device comprises:
and performing multi-event embedding on a user in the full-flow operation of the event process of operating the equipment so as to acquire equipment information of the user in different event processes, wherein the equipment information comprises basic information, environment information, adaptation information, function support and authorization information and other information.
6. An apparatus for fingerprint recognition of a device, the apparatus comprising:
the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring multiple pieces of equipment information of a user in the event process of operating equipment, and each piece of equipment information comprises multiple pieces of characteristic information;
the calculation module is used for carrying out label classification on the acquired equipment information, carrying out similarity calculation on corresponding characteristics of adjacent events of the same user, and taking a similarity value as an original characteristic, wherein the adjacent events are two adjacent operation events in an operation event stream of the user;
the screening module is used for screening effective features from the original features according to the established classification model, and performing box separation verification and box separation gain on the numerical distribution of the effective features to obtain the processed effective features;
the iteration module is used for establishing a logistic regression model by utilizing the processed effective characteristics and the label classification, and obtaining the identification characteristics in the effective characteristics by iterating the logistic regression model until iteration termination conditions are met;
the identification module is used for acquiring identification characteristics corresponding to the equipment information to be identified aiming at the equipment information to be identified, calculating a different score of the equipment according to a coefficient matrix of a logistic regression model when an iteration termination condition is met, identifying whether the equipment fingerprint is changed or not according to the different score, and updating the equipment fingerprint;
the iteration module is to:
traversing each processed effective feature in sequence, gradually adding the effective features by adopting an advancing method to establish a logistic regression model, recording each coefficient value and a KS difference value in a coefficient matrix of the logistic regression model after each effective feature is added, judging the added effective feature as an identification feature if the KS difference value is within a set range and all the coefficient values are positive values, and determining all the identification features in the effective features after multiple iterations when an iteration termination condition is met;
the identification module is configured to:
calculating to obtain different scores of the equipment according to the identification characteristics corresponding to the equipment information to be identified and the coefficient matrix of the logistic regression model when the iteration termination condition is met, obtaining a score threshold value calculated in advance according to the set bin bad sample rate, and identifying whether the fingerprint of the equipment is changed or not according to the score threshold value and the calculated different scores;
if the device fingerprint of the event of the device information to be identified is not changed, the device fingerprint of the previous event is updated to be the latest device fingerprint, if the device fingerprint of the event of the device information to be identified is changed, then whether the current event device fingerprint is repeated with the device fingerprint of any historical event is judged, if the current event device fingerprint is not repeated with the device fingerprint of any historical event, the current event device fingerprint is updated to a log, and if the current event device fingerprint is repeated with the device fingerprint of one historical event, the device fingerprint of the historical event is updated to be the latest device fingerprint.
7. An electronic device comprising one or more storage media and one or more processors in communication with the storage media, the one or more storage media storing processor-executable machine-executable instructions that, when executed by the electronic device, are executed by the processors to perform the method steps of any of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210708179.0A CN114783007B (en) | 2022-06-22 | 2022-06-22 | Equipment fingerprint identification method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210708179.0A CN114783007B (en) | 2022-06-22 | 2022-06-22 | Equipment fingerprint identification method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114783007A CN114783007A (en) | 2022-07-22 |
| CN114783007B true CN114783007B (en) | 2022-09-27 |
Family
ID=82421220
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210708179.0A Active CN114783007B (en) | 2022-06-22 | 2022-06-22 | Equipment fingerprint identification method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114783007B (en) |
Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN204480319U (en) * | 2015-04-02 | 2015-07-15 | 汪新淮 | Coin deposit of stamp product on-line trade system |
| CN107622198A (en) * | 2017-07-11 | 2018-01-23 | 上海点融信息科技有限责任公司 | For realizing the method, apparatus and computer-readable recording medium of device-fingerprint |
| CN108875327A (en) * | 2018-05-28 | 2018-11-23 | 阿里巴巴集团控股有限公司 | One seed nucleus body method and apparatus |
| CN110287698A (en) * | 2019-05-29 | 2019-09-27 | 上海派拉软件股份有限公司 | Equipment fingerprint implementation method based on user behavior and hardware information |
| CN110851422A (en) * | 2019-11-06 | 2020-02-28 | 国家计算机网络与信息安全管理中心山西分中心 | Data anomaly monitoring model construction method based on machine learning |
| CN110866819A (en) * | 2019-10-18 | 2020-03-06 | 华融融通（北京）科技有限公司 | Automatic credit scoring card generation method based on meta-learning |
| CN110929224A (en) * | 2019-11-15 | 2020-03-27 | 上海电科智能系统股份有限公司 | Safety index system establishing method based on bus driving safety |
| CN112382392A (en) * | 2020-11-25 | 2021-02-19 | 珠海圣美生物诊断技术有限公司 | System for be used for pulmonary nodule risk assessment |
| CN112966991A (en) * | 2021-05-19 | 2021-06-15 | 南京蜂泰互联网科技有限公司 | Method for establishing scoring card model based on logistic regression model |
| CN113537585A (en) * | 2021-07-09 | 2021-10-22 | 中海石油（中国）有限公司天津分公司 | Oil field production increasing measure recommendation method based on random forest and gradient lifting decision tree |
| CN113554504A (en) * | 2021-06-10 | 2021-10-26 | 浙江惠瀜网络科技有限公司 | Vehicle loan wind control model generation method and device and scoring card generation method |
| CN113869156A (en) * | 2021-09-16 | 2021-12-31 | 军工保密资格审查认证中心 | Radio frequency fingerprint identification method |
| CN113886372A (en) * | 2021-09-08 | 2022-01-04 | 天元大数据信用管理有限公司 | User portrait construction method based on improved analytic hierarchy process |
| CN113920384A (en) * | 2021-10-12 | 2022-01-11 | 平安医疗健康管理股份有限公司 | Feature validity evaluation method, device, equipment and storage medium |
| CN113989859A (en) * | 2021-12-28 | 2022-01-28 | 江苏苏宁银行股份有限公司 | Fingerprint similarity identification method and device for anti-flashing equipment |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9984365B2 (en) * | 2014-12-02 | 2018-05-29 | Ca, Inc. | Device identification based on deep fingerprint inspection |
| CN107220217A (en) * | 2017-05-31 | 2017-09-29 | 北京京东尚科信息技术有限公司 | Characteristic coefficient training method and device that logic-based is returned |
| US11556823B2 (en) * | 2018-12-17 | 2023-01-17 | Microsoft Technology Licensing, Llc | Facilitating device fingerprinting through assignment of fuzzy device identifiers |
| CN111310242B (en) * | 2020-02-03 | 2022-06-07 | 同盾控股有限公司 | Method and device for generating device fingerprint, storage medium and electronic device |
| CN112685799B (en) * | 2020-12-29 | 2022-11-29 | 五八有限公司 | Device fingerprint generation method and device, electronic device and computer readable medium |
-
2022
- 2022-06-22 CN CN202210708179.0A patent/CN114783007B/en active Active
Patent Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN204480319U (en) * | 2015-04-02 | 2015-07-15 | 汪新淮 | Coin deposit of stamp product on-line trade system |
| CN107622198A (en) * | 2017-07-11 | 2018-01-23 | 上海点融信息科技有限责任公司 | For realizing the method, apparatus and computer-readable recording medium of device-fingerprint |
| CN108875327A (en) * | 2018-05-28 | 2018-11-23 | 阿里巴巴集团控股有限公司 | One seed nucleus body method and apparatus |
| CN110287698A (en) * | 2019-05-29 | 2019-09-27 | 上海派拉软件股份有限公司 | Equipment fingerprint implementation method based on user behavior and hardware information |
| CN110866819A (en) * | 2019-10-18 | 2020-03-06 | 华融融通（北京）科技有限公司 | Automatic credit scoring card generation method based on meta-learning |
| CN110851422A (en) * | 2019-11-06 | 2020-02-28 | 国家计算机网络与信息安全管理中心山西分中心 | Data anomaly monitoring model construction method based on machine learning |
| CN110929224A (en) * | 2019-11-15 | 2020-03-27 | 上海电科智能系统股份有限公司 | Safety index system establishing method based on bus driving safety |
| CN112382392A (en) * | 2020-11-25 | 2021-02-19 | 珠海圣美生物诊断技术有限公司 | System for be used for pulmonary nodule risk assessment |
| CN112966991A (en) * | 2021-05-19 | 2021-06-15 | 南京蜂泰互联网科技有限公司 | Method for establishing scoring card model based on logistic regression model |
| CN113554504A (en) * | 2021-06-10 | 2021-10-26 | 浙江惠瀜网络科技有限公司 | Vehicle loan wind control model generation method and device and scoring card generation method |
| CN113537585A (en) * | 2021-07-09 | 2021-10-22 | 中海石油（中国）有限公司天津分公司 | Oil field production increasing measure recommendation method based on random forest and gradient lifting decision tree |
| CN113886372A (en) * | 2021-09-08 | 2022-01-04 | 天元大数据信用管理有限公司 | User portrait construction method based on improved analytic hierarchy process |
| CN113869156A (en) * | 2021-09-16 | 2021-12-31 | 军工保密资格审查认证中心 | Radio frequency fingerprint identification method |
| CN113920384A (en) * | 2021-10-12 | 2022-01-11 | 平安医疗健康管理股份有限公司 | Feature validity evaluation method, device, equipment and storage medium |
| CN113989859A (en) * | 2021-12-28 | 2022-01-28 | 江苏苏宁银行股份有限公司 | Fingerprint similarity identification method and device for anti-flashing equipment |
Non-Patent Citations (5)
| Title |
|---|
| Fingerprint-Based Device-Free Localization in Changing Environments Using Enhanced Channel Selection and Logistic Regression;QIAN LEI等;《IEEE Access》;20171218;第6卷;第2569-2577页 * |
| Quantification of the weight of fingerprint evidence using a ROC-based Approximate Bayesian Computation algorithm for model selection;Jessie Hendricks等;《Electronic Journal of Statistics》;20211231;第15卷;第1228-1262页 * |
| 基于射频信号特征的Wi-Fi设备指纹提取方法研究;庄浩宇;《中国优秀硕士学位论文全文数据库 信息科技辑》;20200615(第（2020）06期);I136-413 * |
| 多标签学习中特征选择和分类问题的研究;黄莉莉;《中国优秀硕士学位论文全文数据库 信息科技辑》;20131215(第（2013）12期);I138-4 * |
| 浏览器用户行为识别技术的研究;蒋鹏飞;《中国优秀硕士学位论文全文数据库 信息科技辑》;20180415(第（2018）04期);I139-555 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114783007A (en) | 2022-07-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8543522B2 (en) | Automatic rule discovery from large-scale datasets to detect payment card fraud using classifiers | |
| WO2020073714A1 (en) | Training sample obtaining method, account prediction method, and corresponding devices | |
| CN111614690A (en) | Abnormal behavior detection method and device | |
| Wang et al. | Representing fine-grained co-occurrences for behavior-based fraud detection in online payment services | |
| CN113011889B (en) | Account anomaly identification method, system, device, equipment and medium | |
| CN110990683B (en) | Microblog rumor integrated identification method and device based on region and emotional characteristics | |
| CN115438102B (en) | Space-time data anomaly identification method and device and electronic equipment | |
| CN114124460B (en) | Industrial control system intrusion detection method and device, computer equipment and storage medium | |
| CN113746780B (en) | Abnormal host detection method, device, medium and equipment based on host image | |
| CN115238815A (en) | Abnormal transaction data acquisition method, device, equipment, medium and program product | |
| CN115688101A (en) | Deep learning-based file classification method and device | |
| CN114139636B (en) | Abnormal operation processing method and device | |
| CN116707859A (en) | Feature rule extraction method and device, and network intrusion detection method and device | |
| CN110290101B (en) | Deep trust network-based associated attack behavior identification method in smart grid environment | |
| CN111444362A (en) | Malicious picture intercepting method, device, equipment and storage medium | |
| CN117938430A (en) | Webshell detection method based on Bert model | |
| CN114783007B (en) | Equipment fingerprint identification method and device and electronic equipment | |
| CN115204322B (en) | Behavior link abnormity identification method and device | |
| CN116541792A (en) | Method for carrying out group partner identification based on graph neural network node classification | |
| CN112966732B (en) | Multi-factor interactive behavior anomaly detection method with periodic attribute | |
| CN109739840A (en) | Data processing empty value method, apparatus and terminal device | |
| CN110990810B (en) | User operation data processing method, device, equipment and storage medium | |
| CN116861226A (en) | Data processing method and related device | |
| CN112463964A (en) | Text classification and model training method, device, equipment and storage medium | |
| CN112667943A (en) | Illegal website identification and locking method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |