WO2020019483A1 - 一种模拟器识别方法、识别设备及计算机可读介质 - Google Patents

一种模拟器识别方法、识别设备及计算机可读介质 Download PDF

Info

Publication number
WO2020019483A1
WO2020019483A1 PCT/CN2018/107746 CN2018107746W WO2020019483A1 WO 2020019483 A1 WO2020019483 A1 WO 2020019483A1 CN 2018107746 W CN2018107746 W CN 2018107746W WO 2020019483 A1 WO2020019483 A1 WO 2020019483A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
target terminal
preset
device information
simulator
Prior art date
Application number
PCT/CN2018/107746
Other languages
English (en)
French (fr)
Inventor
李骁
董晓琼
胡定耀
王智浩
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020019483A1 publication Critical patent/WO2020019483A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45537—Provision of facilities of other operating environments, e.g. WINE
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a simulator identification method, an identification device, and a computer-readable medium.
  • the Android emulator is an application that can simulate the operating environment of the Android system on various platforms such as Windows and Linux. Users can run the Android system application on the Android emulator in a terminal such as a personal computer. When using the application of the Android system, for certain services, such as those requiring risk monitoring, it is not desired to be run on the simulator, so it is necessary to identify whether the terminal is running in the Android simulator environment. At present, the risk recognition device has limited recognition ability of the Android simulator, and cannot effectively identify whether the terminal is running in the simulator environment.
  • the application provides a simulator recognition method, a recognition device and a computer-readable medium, which help to improve the flexibility and accuracy of the simulator recognition.
  • the present application provides a simulator identification method, including:
  • a target simulator recognition rule corresponding to the target wind control scene is determined from a plurality of preset simulator recognition rules, and the multiple simulations
  • the device identification rule is determined based on the device information of the terminal running in the simulator environment in the historical record;
  • the target simulator recognition rule When the device information of the target terminal hits the target simulator recognition rule, it is determined that the target terminal is running in a simulator environment.
  • the present application provides an identification device including a unit for performing the method of the first aspect.
  • the present application provides another identification device, including a processor, a user interface, a communication interface, and a memory, and the processor, the user interface, the communication interface, and the memory are connected to each other, where the memory is used for storing support
  • a computer program that identifies the device to execute the method the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.
  • the present application provides a computer-readable storage medium, where the computer storage medium stores a computer program, the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute The method of the first aspect described above.
  • the embodiment of the present application can determine the simulator recognition rule corresponding to the wind control scenario in which the terminal is located by acquiring the wind control scenario in which the terminal is located, and then according to the preset correspondence between different wind control scenarios and simulator recognition rules After obtaining the device information of the terminal, by detecting whether the device information hits the determined simulator recognition rule for simulator recognition, it enables simulator recognition in combination with different wind control scenarios, which helps prevent illegal elements from learning Tampering with related device information after a certain identification rule leads to the situation that the simulator cannot be identified in time, which improves the flexibility and accuracy of simulator recognition.
  • FIG. 1 is a schematic flowchart of a simulator recognition method according to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of another simulator recognition method according to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of another simulator identification method according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an identification device according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of another identification device according to an embodiment of the present application.
  • the technical solution of the present application can be applied to an identification device, which can include various terminals, servers, or risk identification products (devices) connected to the terminal, etc., for identifying the behavior of the simulator in the terminal (referred to as " Simulator recognition ") to identify whether the terminal (or an application in the terminal, such as an application embedded in the SDK) is running in the simulator environment, or is called identifying whether the terminal is logged in using the simulator.
  • the simulator may refer to an Android simulator or another simulator.
  • the terminals involved in this application may be mobile phones, computers, tablets, personal computers, smart watches, etc., and this application is not limited.
  • this application may determine a wind control scenario where a target terminal is located, so as to determine a simulator recognition rule for simulator recognition according to the wind control scenario, and then obtain device information of the terminal, such as a connected Wi- Fi hotspot information, model information, CPU manufacturer information, module configuration information, memory space information, number of installed applications, number of stored files, network system used, system file abnormal information, running status, etc.
  • device information of the terminal such as a connected Wi- Fi hotspot information, model information, CPU manufacturer information, module configuration information, memory space information, number of installed applications, number of stored files, network system used, system file abnormal information, running status, etc.
  • FIG. 1 is a schematic flowchart of a simulator recognition method provided by an embodiment of the present application. Specifically, as shown in FIG. 1, the simulator recognition method may include the following steps:
  • the target terminal may be any terminal that needs to be identified by the simulator, such as a terminal connected to a risk identification product, or a terminal in a specific risk control scenario, or triggered (such as by a preset button or gesture or preset Other triggering methods) are terminals identified by the simulator, etc., which are not limited in this application.
  • the risk control scenario may include a login scenario, a transaction scenario, an APP preferential field scenario, or the like; or alternatively, the risk control scenario may also be determined according to the type of the APP, and the risk control scenario may include various types Risk control scenarios corresponding to the APP, etc.
  • the division of the risk control scenario is not limited in this application.
  • the recognition device may identify the target wind control scene based on the wind control scene information by acquiring the wind control scene information of the target terminal.
  • the wind control scene information may include a wind control scene identifier and / or scene description information, etc., and is used to indicate a wind control scene in which the terminal is located.
  • the risk control scenario identifier may include a login identifier, a transaction identifier, and the like; for another example, the scenario description information may include description information in which the terminal is in a login state, description information in which a terminal is in a transaction state, and the like, which are not listed here one by one .
  • the plurality of simulator recognition rules may be determined according to device information of a terminal running in the simulator environment in a historical record, so as to improve the efficiency and reliability of simulator recognition.
  • the recognition device can generate multiple simulator recognition rules according to the common characteristics of various types of Android simulators, and separately determine the simulator rules used in different wind control scenarios, and identify each simulator recognition rule and its corresponding wind. Control scene information for associative storage. Furthermore, the recognition device can determine the simulator recognition rule used by the terminal target in combination with the wind control scenario where the terminal is actually located, and then perform simulator recognition based on the simulator recognition rule. Optionally, the simulator recognition rules in different wind control scenarios may be different, so that the recognition device performs simulator recognition according to the specific wind control scenario to improve the reliability of the simulator recognition.
  • the plurality of simulator recognition rules may include at least two of the following:
  • Rule 1 The name of the router of the Wi-Fi hotspot to which the terminal to be identified is the same as the name of the router in the preset first blacklist;
  • Rule 2 The MAC address of the router of the Wi-Fi hotspot to which the terminal to be identified belongs is a set of MAC addresses in a preset second blacklist;
  • detecting whether a MAC address is in a preset MAC address set can also be referred to as detecting whether the MAC address is the same as the MAC address in the MAC address set; accordingly, a MAC address in the MAC address set can refer to the MAC address and the MAC Any MAC address in the address set is the same.
  • Rule 3 The model of the terminal to be identified is the same as any terminal model in the preset third blacklist
  • Rule 4 The brand of the terminal to be identified is the same as any terminal brand in the preset fourth blacklist
  • the device information included in the above blacklists may be the terminals identified as simulators in the historical data (that is, identified as running on Device information corresponding to the terminal in the simulator environment, such as the first L with the most statistics (L is an integer greater than 0, such as taking 8) device information (router name, MAC address, model or brand, etc.), or statistics
  • L is an integer greater than 0, such as taking 8
  • device information router name, MAC address, model or brand, etc.
  • the first blacklist includes the names that are counted more frequently among the names of routers connected to the terminals identified as simulators in the historical data, such as the top M with the most counts (M is an integer greater than 0, such as 10) Names, or names whose number of counts is greater than a preset number threshold (first threshold);
  • the second blacklist includes historical data that has more counts in the MAC address of the router connected to the terminal identified as the simulator MAC address or a set of MAC addresses composed of the MAC address, such as the first N (N is an integer greater than 0, such as 50) MAC addresses with the highest number of statistics, or the number of statistics greater than a preset number threshold (second threshold) MAC addresses, or a set of MAC addresses determined by these MAC addresses, etc., are not limited in this application.
  • the first threshold and the second threshold can be preset.
  • the white list may include the identifications of one or more legal CPU manufacturers.
  • the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor;
  • the preset module may be a module that is not configured in the terminal identified as the simulator according to historical data statistics, such as a Bluetooth module, a temperature sensor, and a light sensor. Therefore, if it is recognized that the terminal is not configured with the preset module, it may be an emulator.
  • Rule 7 The memory space value of the terminal to be identified is less than a preset memory threshold
  • Rule 8 The first number of applications installed on the terminal to be identified is less than a preset first number threshold
  • Rule 9 The second number of files stored by the terminal to be identified is less than a preset second number threshold
  • the first number threshold and the second number threshold can be preset.
  • Rule 10 The network standard used by the terminal to be identified is different from all the network standards in the preset network standard list;
  • the identification device may determine which network standards are normal in combination with the target area where the terminal to be identified is located, such as a target terminal, for example, by pre-configuring different areas and their corresponding network standard lists to determine the network standard corresponding to the target area List, the network standard in the network standard list is the normal network standard of the target area. If it is detected that the network standard used by the target terminal is not the network standard in its corresponding network standard list, the target terminal may run in the simulator environment because the simulator may tamper with the network standard information.
  • Rule 11 a system file with a preset path and name exists in the system of the terminal to be identified;
  • the abnormal system file can include system files with the following paths and names: / dev / qemu_pipe, / dev / socket / qemud, /system/lib/libc_malloc_debug_qemu.so, / sys / qemu_trace, / proc / tty / drivers / goldfish and more.
  • Rule 12 The running state of the terminal to be identified is the root state. If it is detected that the target terminal is in the Android root state, it may be an emulator.
  • the terminal to be identified is a terminal that needs to perform simulator identification by determining simulator identification rules that are hit by its device information, such as the aforementioned target terminal.
  • the simulator recognition rule set may be a single simulator recognition rule such as Rule 3 or 4 described above to quickly identify whether it is a simulator.
  • the simulator recognition rule set may be a single simulator recognition rule such as rule 1 or 2 above, in order to quickly identify whether it is an simulator and ensure recognition reliability, etc. Wait, not list them here.
  • the device information hitting simulator recognition rules may also be called that the device information meets the simulator recognition rules or conforms to the simulator recognition rules, etc., which are not listed here one by one.
  • the obtained device information of the target terminal may include the name of the router of the Wi-Fi hotspot connected to the target terminal, the MAC address of the router, the model, brand, CPU manufacturer ID, and memory space of the target terminal. Any one or more of the value, the first number of installed applications, the second number of stored files, the network system used, and the running state, and the device information corresponding to the target simulator recognition rule is the target terminal ’s Some information in the device information.
  • the identifying device may obtain multiple device information of the target terminal ’s device, for example, the device information may include one or more of the following: router information (including router name) of the connected Wi-Fi hotspot (Or Wi-Fi name) such as Wi-Fi ssid, router MAC address (or Wi-Fi MAC address) such as Wi-Fi BSSS, etc.), model (model and / or brand), CPU manufacturer information, Bluetooth information, Sensor information, user trace information such as memory space value, network system used, Android state (or called running state, such as whether it is root), system file exception information (such as whether there is a system file with a preset path and name) , Number of installed applications, number of stored files, package name of the connected app, version number of the connected app, version number of the SDK, operating system type, operating system version, device unique identification code (UDID), whether Jailbreak (such as 1 means jailbroken, 0 means not jailbroken), latitude and longitude information, network type, whether the specified app is
  • router information including router name
  • the recognition device may use part of the obtained device information item corresponding to the target simulator recognition rule according to the target simulator recognition rule for simulator recognition, that is, the obtained device information item is more than the device information that needs to be used Item, which makes it impossible for illegal elements to determine what information to use for simulator identification, which helps prevent illegal elements from tampering with related device information after learning a certain identification rule, which prevents the simulator from being identified in a timely manner.
  • the recognition rules were cracked, which improved the reliability of simulator recognition.
  • the device information of the target terminal is device information corresponding to the target simulator recognition rule. That is, the identification device can only obtain device information for simulator identification, that is, the device information corresponding to the target simulator recognition rule for simulator recognition without having to obtain other device information, which saves equipment Overhead.
  • the target simulator recognition rule corresponding to the target wind control scenario where the target terminal is located and obtaining device information it can be detected whether the device information hits the target simulator recognition rule. If it is, it can be identified as a simulator. That is, the target terminal runs in the simulator environment. For example, suppose that the preset simulator identification rule corresponding to the wind control scenario 1 such as the APP discount collection scenario is Rule 5 described above, and the simulator identification rule corresponding to the wind control scenario 2 such as the transaction scenario is Rule 2 described above, and the wind control scenario 3 For example, the simulator recognition rule corresponding to the login scenario is Rule 3 described above.
  • the device information corresponding to rule 3 that is, the device information including the model of the target terminal
  • the device information corresponding to rule 3 can be detected, and it can be detected whether the model of the target terminal and the third terminal are the same.
  • the terminal models in the blacklist are the same. If the model of the target terminal is the same as that of any terminal in the third blacklist, that is, when the device information hits the target simulator recognition rule, it can be determined that the target terminal is running in the simulator environment.
  • the recognition device can determine the correspondence with the wind control scenario in which the terminal is located by obtaining the corresponding relationship between different wind control scenarios and simulator recognition rules by acquiring the wind control scenario in which the terminal is located.
  • the emulator recognizes the rule and obtains the device information of the terminal, it detects whether the device information hits the determined simulator recognition rule to perform simulator recognition.
  • the embodiments of the present application can identify simulators in combination with different risk control scenarios, which helps prevent illegal elements from tampering with related device information after learning a certain identification rule, which prevents the simulator from being identified in a timely manner, and improves the flexibility of simulator recognition. Sex and accuracy.
  • FIG. 2 is a schematic flowchart of another simulator recognition method provided by an embodiment of the present application. Specifically, as shown in FIG. 2, the simulator recognition method may include the following steps:
  • steps 201-202 reference may be made to the related description of steps 101-102 in the embodiment shown in FIG. 1 above, and details are not described herein.
  • the simulator recognition rules corresponding to each wind control scenario can be set to one or more, and each wind control scenario and one or more can be set in advance. Correspondence between multiple simulator recognition rules. Therefore, in some risk control scenarios, such as those with higher risk levels, or more important risk control scenarios, such as those preset for specific APPs, through multiple simulator recognition rules set for them Performing simulator recognition can further improve the reliability of simulator recognition, and avoid situations in which the simulator cannot be identified in a timely manner by tampering with related equipment information after an illegal element learns a certain recognition rule.
  • the switching conditions of the multiple simulator recognition rules may be further set, such as identifying rules in the multiple simulators at preset time intervals. Random switching.
  • the switching order of the plurality of simulator recognition rules may be set, for example, the priorities of the plurality of simulator recognition rules are set in advance. When the simulator recognition rules are switched, the priorities are switched from high to low or from low to high. Go high for switching and more. This can further improve the reliability of simulator recognition.
  • the obtained device information includes the device information corresponding to the target simulator identification rule (this part of the information can also be included, and other information can also be obtained, which is not described here), that is, the target simulator is used to identify the required device information.
  • Device Information there may be one or more target simulator recognition rules corresponding to the target wind control scenario.
  • the target terminal device is sequentially detected according to a preset time interval and a preset plurality of priorities of the target simulator recognition rules. Whether the information hits multiple of the target simulator recognition rules.
  • the recognition device may switch the target simulator recognition rules at preset time intervals to achieve simulator recognition.
  • the switching may be a random switching or a switching in a specific switching order.
  • the recognition device may switch according to the preset priorities of the multiple target simulator recognition rules to perform simulator recognition, so that the simulator recognition reliability is high.
  • the device information corresponding to each target simulator recognition rule may be obtained after determining multiple target simulator recognition rules corresponding to the target wind control scenario, or, Separate acquisition, for example, after the use conditions of a target simulator recognition rule are reached, is not limited in this application.
  • the multiple target simulator recognition rules when there are multiple target simulator recognition rules, and the multiple target simulator recognition rules are switched to perform simulator recognition, it is detected that the corresponding device information hits any one of the multiple target simulator recognition rules.
  • a target simulator recognizes a rule it can be determined that the target terminal is running in the simulator environment, and the steps of detecting whether the device information of the target terminal hits a plurality of the target simulator recognition rules can be stopped to reduce equipment overhead.
  • F F is a positive integer greater than 1 target simulator recognition rules, It is then determined that the target terminal is running in the simulator environment, and the detection can be stopped, which is not repeated here.
  • the device information of the target terminal hits the target simulator identification rule, including: the name of the router connected to the Wi-Fi hotspot of the terminal is the same as the router name in the preset first blacklist; or The MAC address of the Wi-Fi hotspot router is in the preset MAC address set in the second blacklist; or, the target terminal model is the same as any terminal model in the preset third blacklist; or, the target The brand of the terminal is the same as any terminal brand in the preset fourth blacklist; or, the manufacturer ID of the central processing unit CPU of the target terminal is different from all the manufacturer IDs in the preset whitelist; or ,
  • the target terminal is not configured with a preset module, the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; or the memory space value of the target terminal is less than a preset memory threshold; or, the The first number of applications installed by the target terminal is less than a preset first number threshold; or, the second number of files stored by the target terminal is less than
  • the preset simulator recognition rules corresponding to the wind control scenario 1 such as the APP discount collection scenario are rules 1, 7, and 9, and the preset is related to wind control
  • the simulator recognition rule corresponding to the login scenario is rule 3
  • the preset simulator recognition rule corresponding to the wind control scenario 3 such as the trading scenario is rule 3, 4, 5, 6.
  • the recognition device can dynamically switch the simulator recognition rules randomly in the rules 3, 4, 5, 6 according to a preset time interval, such as 10 minutes, to detect the target terminal's Whether the device information matches the corresponding rule.
  • rule 3, rule 4, rule 5, and rule 6 are used in order to identify the simulator.
  • the identification device may sequentially Rule 3, rule 5, rule 4, and rule 6 are used for simulator identification, and details are not described here.
  • the recognition device can also dynamically change the recognition rules only according to a preset time interval.
  • the reliability of the simulator recognition can be further improved to prevent illegal elements from learning about a certain Tampering with related device information after an identification rule leads to a situation where the simulator cannot be identified in a timely manner.
  • the recognition device can determine the simulator recognition rule corresponding to the wind control scene in which the terminal is located by acquiring the wind control scene in which the terminal is located. If there are multiple identified simulator recognition rules, Recognition equipment can also dynamically change recognition rules, such as dynamic changes according to preset time intervals and rule priorities, which improves the reliability of simulator recognition and helps prevent illegal elements from learning about a certain recognition rule. Tampering with related device information has resulted in a situation where the simulator cannot be identified in a timely manner.
  • FIG. 3 is a schematic flowchart of another simulator identification method according to an embodiment of the present application. Specifically, as shown in FIG. 3, the simulator recognition method may include the following steps:
  • steps 301-302 reference may be made to the related description of steps 101-102 in the embodiment shown in FIG. 1 and steps 201-202 in the embodiment shown in FIG. 2, and details are not described herein.
  • the recognition device can also detect Whether the device information for simulator recognition has been tampered with to ensure that simulator recognition is performed based on real device information.
  • the device information for detecting whether the tampering is performed may be only the device information corresponding to the target simulator identification rule, so as to reduce the device overhead.
  • the identification device can identify the tampering behavior by detecting whether a function corresponding to the device information is hooked.
  • the flag value can be used to mark the state of the objective function.
  • the state can refer to a state that has been tampered with, or can refer to a read-write state, a blocking and non-blocking state, an exit process or program state, and / or a change.
  • the status of the content of the file, etc., so that whether the objective function is hooked can be determined according to the flag value.
  • Each function has a corresponding flag.
  • the flag is a variable. When a function is hooked, the flag corresponding to the function will change. Therefore, the identification device can determine whether the function is hooked by detecting whether the flag of the function has changed, that is, whether the device information corresponding to the function has been tampered with.
  • the value of the flag may be stored in a memory corresponding to the objective function.
  • the recognition device may compare a character at a preset position in the flag value with a preset fixed character; when the comparison obtains the preset position When the character of is different from the fixed character, it is determined that the objective function is hooked.
  • the number of characters of the character at the preset position is the same as the number of characters of the fixed character, so as to facilitate matching and comparison. That is, the change in the flag may refer to a change in one or more bits of the flag value, and the one or more bits may refer to one or more bits in a preset position of the flag. Therefore, the recognition device can compare one or more bits at the preset position of the obtained flag value with the fixed character when it has not been tampered with. If the one or more bits of the flag value change, that is, one bit of the flag value If one or more bits are different from the fixed character, it indicates that the objective function is hooked, that is, the device information corresponding to the objective function has been tampered with.
  • some Xposed plugins set a bit at a fixed position of the function's flag value to 1 when a function is hooked; For tampered functions, this bit of the flag value is 0 (the fixed character described above). Therefore, by detecting whether the fixed bit of the flag value of the function is 0, it can be known whether the function is hooked by the Xposed plugin. That is, if the fixed bit of the flag value of the measurement function is not 0, it can indicate that the function is hooked and the function is tampered with.
  • the recognition device may also perform a logical operation on the flag value according to a preset logic algorithm to obtain an operation result value; when the operation result value is a positive integer
  • the objective function is hooked.
  • the logic algorithm may be determined according to a preset character string and a jump address when a native function in the system is executed. That is to say, the value processed by the flag can also be compared with a fixed character such as 0 when it has not been tampered with according to a preset logic algorithm. If the value after processing changes, it is not 0, such as a positive value. An integer indicates that the function is hooked.
  • the function may be tampered with; if the result of the logical calculation is equal to 0 (that is, a fixed character), then Indicates that the function has not been tampered with.
  • the EntryPointFromJni may refer to a jump address when a native function such as a native function is executed, and AccessFlags is the above-mentioned flag.
  • the identification device may determine a system version used by the target terminal target, and then select the target terminal to determine the target based on the flag value according to the system version of the target terminal. Whether the function is hooked to improve the efficiency of hook detection.
  • the correspondence between the system version and the way of hook detection can be set in advance.
  • the function pointer and the hooked function are stored in different fields in the same block of memory, and there is a mapping relationship between different function pointers and the original function, or a mapping relationship between different function pointers and the storage address of the original function.
  • the hooked target function may also be restored, so as to determine the real device information corresponding to the target function.
  • a function pointer corresponding to the objective function can be quickly obtained from its memory, that is, the objective function pointer described above, so as to determine the objective function according to the objective function pointer.
  • Corresponding primitive functions, such as native APIs, are real functions that have not been hooked.
  • the original function corresponding to the target function pointer can be further determined, that is, the actual Method. Furthermore, the original function can be used to replace the objective function to achieve the reduction of the hooked function. Therefore, the identification device can determine the real device information corresponding to the target terminal through the original function, and perform simulator identification based on the real device information. That is, the embodiment of the present application can obtain the real time information when the device information is tampered with. Device identification based on real device information, thereby improving the accuracy and reliability of simulator identification.
  • the original function pointer stored in the memory will not be tampered with.
  • the original information of the function will be backed up and stored at a specific address in memory, that is, The address to which the objective function pointer points. Once these backup information has also been tampered with, the Xposed plugin will not work properly. Therefore, the original function obtained at the specific address pointed by the target function pointer must be the correct function, and it cannot be tampered with.
  • the real original device information After the real original device information is determined, it can be determined whether the original device information hits the corresponding target simulator recognition rule, and then the simulator recognition is performed according to the hit result.
  • the recognition method is the same as the above according to the device information and the target simulator recognition rule.
  • the method for identifying the simulator is similar. For details, refer to the description of steps 103-104 in the embodiment shown in FIG. 1 and steps 204-205 in the embodiment shown in FIG. 2, and details are not described herein.
  • the simulator recognition rule corresponding to the target wind control scenario where the target terminal is located is Rule 1 described above, and the device information includes the name of the router. If it is detected that the function corresponding to the name of the router is hooked, the name of the real original router can be restored, and then the simulator can be identified based on the name of the real original router. That is, it is detected whether the name of the original router is the same as the name of the router in the first blacklist. If they are the same, it can be determined that the rule 1 is hit, and the target terminal is determined to be running in the simulator environment.
  • the identification device may generate alarm information for risk control.
  • the alarm information may include one or more of a risk level, user information, and malicious behavior of the device.
  • the risk level can be determined according to the target risk control scenario of the terminal, and the corresponding relationship between different risk control scenarios and risk levels can be specifically set in advance; or the risk level can be determined according to the application that the terminal target runs, and can be specifically determined in advance.
  • the risk level can also be determined according to the number of hooked functions of the terminal, and specific correspondences between different numbers of hooks and risk levels can be set in advance; or, It can be determined according to the priority of the tampered device information of the terminal. Specifically, the priority of different device information can be set in advance, and the corresponding relationship between each priority and risk level, etc., is not limited in this application.
  • the risk level can be classified as high-risk, medium-risk, low-risk, or first-, second-, third-, and so on.
  • the user information may include a user identification (UID), a mobile phone number, an ID number (if collected during registration of an application), and the like.
  • the malicious behavior may include tampering with the MAC address, tampering with the CPU manufacturer, tampering with the model and brand of the mobile phone, tampering with the mobile phone number, etc., which can be specifically determined through the aforementioned hook detection.
  • the identification device may also issue an instruction to the target terminal according to the alarm information to control operations on the target terminal (such as an APP client running on the terminal). For example, if the identification device determines that the risk level is low-risk, the identification device may issue an instruction to instruct the client to output a prompt to require the user to enter verification information.
  • the verification method includes, but is not limited to, a short message verification code, a picture verification code, and the like. If the verification fails, no further operation is possible.
  • the identification device may issue an instruction instructing the client to prohibit the user from requesting access in the target risk control scenario (such as logging in, receiving red envelopes, redeeming coupons, spending, transferring money, etc.) operating.
  • the identification device may issue an instruction to instruct the client to prohibit the user from requesting all access operations, etc., which are not listed here one by one.
  • using the simulator can obtain stronger performance than a mobile phone (actually a game cheating).
  • This application can identify whether the game application is running in the simulator environment through the above identification method, and can timely Discover the behavior of the game running in the simulator, which can stop the behavior and prevent the loss of cheating to the user.
  • the risk control strategy of a small loan launched by a financial institution is to allow only users in specific areas, such as the user of Beishangguang. Illegal users may use simulators to modify GPS positioning to bypass the risk control strategy and deceive them. loan. Therefore, the present application can identify whether the device is running in the simulator environment through the above identification method, and reject the user's loan request after determining that the device is running in the simulator environment. Further, this application can also restore the GPS positioning by using the above-mentioned hook detection method to obtain the user's true positioning information.
  • illegal persons set up information such as the phone model, brand, and manufacturer in the simulator to achieve the purpose of one simulator software to simulate multiple different Android phones, thereby creating fake identity to cheat preferential activities, registration rewards, and so on.
  • the real mobile phone model, brand, and manufacturer and other information can be restored and the simulator can be identified, so as to identify whether the device operation is timely.
  • the simulator environment When running in the simulator environment, and when it is recognized that it is running in the simulator environment, it can stop the behavior in time and avoid causing losses to legitimate users.
  • the identification device can obtain the wind control scenario in which the terminal is located, and then determine the simulator identification rule corresponding to the wind control scenario in which the terminal is located, and obtain the device information of the terminal. Whether the information has been tampered with, and real device information is restored in a timely manner when tampering is detected, and simulator recognition is performed based on the real device information and the determined simulator recognition rules, which improves the accuracy of simulator recognition .
  • FIG. 4 is a schematic structural diagram of an identification device according to an embodiment of the present application.
  • the recognition device in the embodiment of the present application includes a unit for executing the above-mentioned simulator recognition method.
  • the identification device 400 in this embodiment may include: an obtaining unit 401 and a processing unit 402. among them,
  • An obtaining unit 401 configured to obtain a target wind control scene in which a target terminal is located;
  • a processing unit 402 is configured to determine a target simulator recognition rule corresponding to the target wind control scenario from a plurality of preset simulator recognition rules according to a preset correspondence relationship between different wind control scenarios and simulator recognition rules.
  • the plurality of simulator recognition rules are determined according to device information of a terminal running in the simulator environment in a historical record;
  • the obtaining unit 401 is further configured to obtain device information of the target terminal;
  • the processing unit 402 is configured to detect whether device information of the target terminal hits the target simulator recognition rule, and determine the target terminal when the device information of the target terminal hits the target simulator recognition rule. Run in the simulator environment.
  • the processing unit 402 is specifically configured to, when there are multiple target simulator recognition rules corresponding to the target wind control scenario, according to a preset time interval and a preset multiple target simulators Recognition rule priority, sequentially detecting whether the device information of the target terminal hits multiple target simulator recognition rules; when the device information of the target terminal hits any of the target simulator recognition rules When the processor recognizes the rule, the detection is stopped and it is determined that the target terminal is running in a simulator environment.
  • the device information of the target terminal includes a name of a router of a wireless fidelity Wi-Fi hotspot connected to the target terminal, a media access control MAC address of the router, a model, a brand, and a center of the target terminal. Any one or more of a manufacturer's identifier of the processor CPU, a memory space value, a first number of installed applications, a second number of stored files, a used network standard, and a running state, and the target simulator
  • the device information corresponding to the identification rule is part of the device information of the target terminal; or, the device information of the target terminal is device information corresponding to the target simulator identification rule.
  • the device information of the target terminal hitting the target simulator identification rule includes:
  • the name of the router of the Wi-Fi hotspot connected to the terminal is the same as the name of the router in the preset first blacklist;
  • the MAC address of the router of the Wi-Fi hotspot connected to the target terminal is in a preset MAC address set in the second blacklist;
  • the model of the target terminal is the same as the model of any terminal in the preset third blacklist; or
  • the brand of the target terminal is the same as any terminal brand in the preset fourth blacklist; or
  • the manufacturer identification of the central processing unit CPU of the target terminal is different from all the manufacturer identifications in the preset white list; or,
  • the target terminal is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; or
  • the memory space value of the target terminal is less than a preset memory threshold
  • the first number of applications installed by the target terminal is less than a preset first number threshold
  • the second number of files stored by the target terminal is less than a preset second number threshold
  • the network standard used by the target terminal is different from all the network standards in the preset network standard list; or
  • a system file of a preset path and name exists in the system of the target terminal; or,
  • the running state of the target terminal is the root state.
  • the identification device further includes: a hook detection unit 403 and a reduction unit 404;
  • the obtaining unit 401 is further configured to obtain a flag value of an objective function corresponding to the device information of the target terminal after obtaining the device information of the target terminal;
  • a hook detection unit 403 configured to determine whether the objective function is hooked according to the flag value
  • the obtaining unit 401 is further configured to obtain an objective function pointer corresponding to the objective function from the memory of the objective function when it is determined that the objective function is hooked;
  • a restoration unit 404 configured to determine an original function corresponding to the target function pointer according to a corresponding relationship between function pointers and functions stored in advance, and determine original device information according to the original function;
  • the processing unit 402 is specifically configured to detect whether the original device information hits the target simulator recognition rule.
  • the hook detection unit 403 is specifically configured to compare a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as that of the character at the preset position.
  • the number of characters of the fixed character is the same; when the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.
  • the hook detection unit 403 is specifically configured to perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, where the logical algorithm is based on a preset string and a system
  • the jump address when the native function is executed is determined; when the value of the operation result is a positive integer, it is determined that the target function is hooked.
  • the recognition device may implement some or all steps in the simulator recognition method in the embodiments shown in FIG. 1 to FIG. 3 by using the foregoing units. It should be understood that the embodiments of the present application are device embodiments corresponding to the method embodiments, and the description of the method embodiments is also applicable to the embodiments of the present application.
  • FIG. 5 is a schematic structural diagram of another identification device according to an embodiment of the present application.
  • the identification device is used to perform the method described above.
  • the identification device 500 in this embodiment may include: one or more processors 501 and a memory 502.
  • the identification device may further include one or more user interfaces 503, and / or, one or more communication interfaces 504.
  • the processor 501, the user interface 503, the communication interface 504, and the memory 502 may be connected through a bus 505, or may be connected through other methods.
  • FIG. 5 illustrates the examples by using a bus method.
  • the memory 502 is configured to store a computer program, where the computer program includes program instructions, and the processor 501 is configured to execute the program instructions stored in the memory 502.
  • the processor 501 may be used to call the program instructions to perform the following steps: identifying the target wind control scenario where the target terminal is located; and according to the preset corresponding relationship between different wind control scenarios and simulator recognition rules, the preset multiple simulators A target simulator recognition rule corresponding to the target wind control scenario is determined in the recognition rules, and the multiple simulator recognition rules are determined according to device information of a terminal running in the simulator environment in historical records; acquiring the Device information of the target terminal, and detecting whether the device information of the target terminal hits the target simulator recognition rule; when the device information of the target terminal hits the target simulator recognition rule, determining that the target terminal is running at Emulator environment.
  • the processor 501 invokes the program instruction to execute the detection of whether the device information of the target terminal matches the target simulator recognition rule, the following steps are specifically performed: when the target corresponding to the target wind control scenario When there are multiple simulator recognition rules, according to a preset time interval and preset priorities of the target simulator recognition rules, it is sequentially detected whether the device information of the target terminal hits a plurality of the target simulators. Identification rules
  • the processor 501 invokes the program instructions to execute when the device information of the target terminal hits the target simulator recognition rule and determines that the target terminal is running in a simulator environment, and specifically performs the following steps: when the target When the device information of the terminal hits any one of the target simulator recognition rules of the target simulator recognition rule, the detection is stopped and it is determined that the target terminal is running in the simulator environment.
  • the device information of the target terminal includes a name of a router of a wireless fidelity Wi-Fi hotspot connected to the target terminal, a media access control MAC address of the router, a model, a brand, and a center of the target terminal. Any one or more of a manufacturer's identifier of the processor CPU, a memory space value, a first number of installed applications, a second number of stored files, a used network standard, and a running state, and the target simulator
  • the device information corresponding to the identification rule is part of the device information of the target terminal; or, the device information of the target terminal is device information corresponding to the target simulator identification rule.
  • the device information of the target terminal hitting the target simulator identification rule includes: the name of the router of the Wi-Fi hotspot connected to the terminal is the same as the router name in the preset first blacklist; or
  • the MAC address of the router of the Wi-Fi hotspot to which the target terminal is connected is a set of MAC addresses in the preset second blacklist; or, the model of the target terminal and any one of the preset third blacklist
  • the terminal model is the same; or the brand of the target terminal is the same as any of the terminal brands in the preset fourth blacklist; or, the manufacturer identification of the central processing unit CPU of the target terminal is in the preset whitelist All manufacturer identifications are different; or, the target terminal is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; or the target terminal
  • the memory space value is less than a preset memory threshold; or the first number of applications installed by the target terminal is less than the preset first number threshold; or the target terminal
  • the processor 501 invokes the program instruction to execute the acquiring the device information of the target terminal, and before executing the detecting whether the device information of the target terminal hits the target simulator recognition rule, For performing the following steps: obtaining a flag value of an objective function corresponding to the device information of the target terminal, and determining whether the objective function is hooked according to the flag value; when it is determined that the objective function is hooked, from the target function An objective function pointer corresponding to the objective function is obtained from a memory of the objective function; an original function corresponding to the objective function pointer is determined according to a corresponding relationship between each function pointer and a function stored in advance, and an original function is determined according to the original function.
  • Device Information is
  • the processor 501 invokes the program instruction to execute the detecting whether the device information of the target terminal hits the target simulator recognition rule, the following steps are specifically performed: detecting whether the original device information hits the target simulator recognition rule .
  • the processor 501 when the processor 501 calls the program instruction to execute the determination of whether the objective function is hooked according to the flag value, the processor 501 specifically executes the following steps: the character at a preset position in the flag value and The preset fixed characters are compared, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character; when the comparison obtains that the character at the preset position is different from the fixed character, the determined The objective function is hooked.
  • the processor 501 when the processor 501 invokes the program instruction to execute the determining whether the objective function is hooked according to the flag value, the processor 501 specifically performs the following steps: performing a logical operation on the flag value according to a preset logic algorithm To obtain an operation result value, wherein the logical algorithm is determined according to a preset character string and a jump address when a native function in the system is executed; when the operation result value is a positive integer, the objective function is determined Was hooked.
  • the processor 501 may be a central processing unit (CPU), and the processor may also be another general-purpose processor, digital signal processor (DSP), or application specific integrated circuit (Application Specific Integrated). Circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • ASIC Application Specific Integrated
  • FPGA ready-made programmable gate array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the user interface 503 may include an input device and an output device, the input device may include a touch panel, a microphone, and the like, and the output device may include a display (LCD, etc.), a speaker, and the like.
  • the input device may include a touch panel, a microphone, and the like
  • the output device may include a display (LCD, etc.), a speaker, and the like.
  • the communication interface 504 may include a receiver and a transmitter for communicating with other devices.
  • the memory 502 may include a read-only memory and a random access memory, and provide instructions and data to the processor 501.
  • a part of the memory 502 may further include a non-volatile random access memory.
  • the memory 502 may further store the corresponding relationship between the function pointer and the function, and so on.
  • the processor 501 and the like described in the embodiment of the present application may execute the implementation manners described in the method embodiments shown in FIG. 1 to FIG. 3 described above, and may also execute each of the methods described in FIG. 4 of the embodiment of the present application. The implementation of the unit is not repeated here.
  • An embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program described in the embodiments corresponding to FIG. 1 to FIG. 3 can be implemented. Some or all of the steps in the simulator recognition method may also implement the process or function of the recognition device in the embodiment shown in FIG. 4 or FIG. 5 of the application, which is not described herein.
  • An embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute part or all of the steps in the above method.
  • the computer-readable storage medium may be an internal storage unit of the identification device according to any one of the foregoing embodiments, such as a hard disk or a memory of the identification device.
  • the computer-readable storage medium may also be an external storage device of the identification device, such as a plug-in hard disk, a Smart Media Card (SMC), and a secure digital (SD) device. ) Cards, flash cards, etc.
  • the size of the sequence numbers of the above processes does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not deal with the implementation process of the embodiments of the present application. Constitute any limitation.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Power Engineering (AREA)
  • Computing Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

一种模拟器识别方法、识别设备及计算机可读介质，其中，该方法包括：识别目标终端所处的目标风控场景（101）；根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与该目标风控场景对应的目标模拟器识别规则（102），所述多个模拟器识别规则是根据历史记录中运行于模拟器环境的终端的设备信息确定出的；获取该目标终端的设备信息，并检测该目标终端的设备信息是否命中该目标模拟器识别规则（103）；当该目标终端的设备信息命中该目标模拟器识别规则时，确定该目标终端运行于模拟器环境（104）。该方法有助于提升模拟器识别的灵活性和准确性。

Description

一种模拟器识别方法、识别设备及计算机可读介质
本申请要求于2018年07月27日提交中国专利局、申请号为201810851413.9、申请名称为“一种模拟器识别方法、识别设备及计算机可读介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种模拟器识别方法、识别设备及计算机可读介质。
背景技术
Android模拟器是一个能在Windows、Linux等各种平台模拟出Android系统的运行环境的应用，用户可以在个人计算机等终端中的Android模拟器上运行Android系统的应用。在使用Android系统的应用时，对于某些业务，如需要进行风险监测的业务，并不希望它被运行在模拟器上，因此需要对终端是否运行于Android模拟器环境进行识别。而目前风险识别设备对Android模拟器的识别能力有限，无法有效识别出终端是否运行于模拟器环境。
发明内容
本申请提供一种模拟器识别方法、识别设备及计算机可读介质，有助于提升模拟器识别的灵活性和准确性。
第一方面，本申请提供了一种模拟器识别方法，包括：
识别目标终端所处的目标风控场景；
根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与所述目标风控场景对应的目标模拟器识别规则，所述多个模拟器识别规则是根据历史记录中运行于模拟器环境的终端的设备信息确定出的；
获取所述目标终端的设备信息，并检测所述目标终端的设备信息是否命中所述目标模拟器识别规则；
当所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境。
第二方面，本申请提供了一种识别设备，该识别设备包括用于执行上述第一方面的方法的单元。
第三方面，本申请提供了另一种识别设备，包括处理器、用户接口、通信接口和存储器，所述处理器、用户接口、通信接口和存储器相互连接，其中，所述存储器用于存储支持识别设备执行上述方法的计算机程序，所述计算机程序包括程序指令，所述处理器被配置用于调用所述程序指令，执行上述第一方面的方法。
第四方面，本申请提供了一种计算机可读存储介质，所述计算机存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行上述第一方面的方法。
本申请实施例能够通过获取终端所处的风控场景，进而根据预设的不同风控场景和模拟器识别规则的对应关系，确定出与该终端所处的风控场景对应的模拟器识别规则并获取该终端的设备信息后，通过检测该设备信息是否命中该确定出的模拟器识别规则以进行模拟器识别，使得能够结合不同风控场景进行模拟器识别，有助于防止非法分子了解到某一识别规则后篡改相关设备信息导致无法及时识别模拟器的情况的发生，提升了模拟器识别的灵活性和准确性。
附图说明
为了更清楚地说明本申请实施例技术方案，下面将对实施例描述中所需要使用的附图进行说明。
图1是本申请实施例提供的一种模拟器识别方法的流程示意图；
图2是本申请实施例提供的另一种模拟器识别方法的流程示意图；
图3是本申请实施例提供的又一种模拟器识别方法的流程示意图；
图4是本申请实施例提供的一种识别设备的结构示意图；
图5是本申请实施例提供的另一种识别设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
本申请的技术方案可应用于识别设备中，该识别设备可包括各种终端、服务器或与终端连接的风险识别产品(设备)等等，用于对终端中的模拟器行为进行识别(简称“模拟器识别”)，以识别终端(或终端中的应用，如识别植入SDK的应用)是否运行于模拟器环境，或者称为识别终端是否使用模拟器登录。在本申请中，模拟器可以是指Android模拟器或其他模拟器。本申请涉及的终端可以是手机、电脑、平板、个人计算机、智能手表等，本申请不做限定。
具体的，本申请可通过确定目标终端所处的风控场景，以根据该风控场景来确定用于进行模拟器识别的模拟器识别规则，进而通过获取终端的设备信息，比如连接的Wi-Fi热点信息、机型信息、CPU的生产商信息、模块配置信息、内存空间信息、安装的应用的数目、存储的文件的数目、使用的网络制式、系统文件异常信息、运行状态等信息中的一项或多项，进而根据该模拟器识别规则和该设备信息来进行模拟器识别，从而能够提升模拟器识别的灵活性和准确性。以下分别详细说明。
请参见图1，图1是本申请实施例提供的一种模拟器识别方法的流程示意图。具体的，如图1所示，该模拟器识别方法可以包括以下步骤：
101、识别目标终端所处的目标风控场景。
其中，该目标终端可以是指需要进行模拟器识别的任一终端，比如与风险识别产品连接的终端，或者处于特定风控场景下的终端，或者触发(比如通过预设按键或手势或预设的其他触发方式)了模拟器识别的终端，等等，本申请不做限定。
可选的，该风控场景可以包括登录场景、交易场景、APP优惠领域场景等等；或者，可选的，该风控场景还可根据APP的类型确定，该风控场景可以包括各种类型的APP对应 的风控场景，等等。对于风控场景的划分方式，本申请不做限定。进一步可选的，识别设备可以通过获取该目标终端的风控场景信息，根据该风控场景信息识别出该目标风控场景。其中，该风控场景信息可以包括风控场景标识和/或场景描述信息等等，用于指示终端所在的风控场景。例如，该风控场景标识可以包括登录标识、交易标识等等；又如，该场景描述信息可以包括终端处于登录状态的描述信息、终端处于交易状态的描述信息等等，此处不一一列举。
102、根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与该目标风控场景对应的目标模拟器识别规则。
其中，该多个模拟器识别规则可以是根据历史记录中运行于模拟器环境的终端的设备信息确定出的，以提升模拟器识别的效率和可靠性。
具体的，识别设备可根据各个类型的Android模拟器的共性特征生成多个模拟器识别规则，并分别确定出不同风控场景下使用的模拟器规则，将各模拟器识别规则及其对应的风控场景信息进行关联存储。进而识别设备可结合终端实际所处的风控场景来确定终端目标使用的模拟器识别规则，进而基于该模拟器识别规则进行模拟器识别。可选的，不同的风控场景下的模拟器识别规则可以不同，以便于识别设备根据具体的风控场景进行模拟器识别，以提升模拟器识别的可靠性。
例如，该多个模拟器识别规则可以包括以下至少两项：
规则1：待识别终端连接的Wi-Fi热点的路由器的名称与预置的第一黑名单内的路由器名称相同；
规则2：待识别终端连接的Wi-Fi热点的路由器的MAC地址处于预置的第二黑名单内的MAC地址集合；
其中，检测MAC地址是否处于预置的MAC地址集合还可以称为检测MAC地址是否与该MAC地址集合中的MAC地址相同；相应的，MAC地址处于MAC地址集合可以是指该MAC地址与该MAC地址集合中的任一MAC地址相同。
规则3：待识别终端的型号与预置的第三黑名单内的任一终端型号相同；
规则4：待识别终端的品牌与预置的第四黑名单内的任一终端品牌相同；
可选的，上述的黑名单如第一黑名单、第二黑名单、第三黑名单、第四黑名单等包括的设备信息可以是历史数据中识别为模拟器的终端(即识别为运行在模拟器环境的终端)对应的设备信息，比如统计次数最多的前L(L为大于0的整数，如取8)个设备信息(路由器名称、MAC地址、型号或品牌等等)，或者统计次数大于预设阈值的设备信息等等，此处不赘述。
例如，该第一黑名单包括历史数据中识别为模拟器的终端所连接的路由器的名称中统计次数较多的名称，比如统计次数最多的前M(M为大于0的整数，如取10)个名称，或者统计次数大于预设数目阈值(第一阈值)的名称；又如，该第二黑名单包括历史数据中识别为模拟器的终端所连接的路由器的MAC地址中统计次数较多的MAC地址或者由该MAC地址组成的MAC地址集合，比如统计次数最多的前N(N为大于0的整数，如取50)个MAC地址，或者统计次数大于预设数目阈值(第二阈值)的MAC地址，或者由这些MAC地址确定的MAC地址集合，等等，本申请不做限定。其中，该第一阈值和第二阈值 可以预先设置得到。
规则5：待识别终端的中央处理器CPU的生产商标识与预置的白名单中的所有生产商标识均不相同；
其中，该白名单中可包括一个或多个合法的CPU生产商的标识。
规则6：待识别终端中未配置有预设模块，该预设模块包括蓝牙模块、温度传感器、光线传感器中的一个或多个；
其中，该预设模块可以为根据历史数据统计的识别为模拟器的终端中没有配置的模块，如蓝牙模块、温度传感器、光线传感器。因此如果识别到终端没有配置该预设模块，则可能为模拟器。
规则7：待识别终端的内存空间值小于预设内存阈值；
规则8：待识别终端安装的应用的第一数目小于预设的第一数目阈值；
规则9：待识别终端存储的文件的第二数目小于预设的第二数目阈值；
其中，该第一数目阈值和第二数目阈值可以预先设置得到。
规则10：待识别终端使用的网络制式与预设的网络制式列表中的所有网络制式均不相同；
可选的，识别设备可以结合待识别终端如目标终端所在的目标区域确定哪些是正常的网络制式，比如通过预先配置不同区域及其对应的网络制式列表，来确定与该目标区域对应的网络制式列表，该网络制式列表中的网络制式即为该目标区域的正常网络制式。如果检测到该目标终端使用的网络制式不为其对应的网络制式列表中的网络制式，则该目标终端可能运行于模拟器环境，因为模拟器可能篡改网络制式信息。
规则11：待识别终端的系统中存在预设路径和名称的系统文件；
如果目标终端中存在异常的系统文件，则可能为模拟器。例如，该异常的系统文件可包括以下路径和名称的系统文件：/dev/qemu_pipe、/dev/socket/qemud、/system/lib/libc_malloc_debug_qemu.so、/sys/qemu_trace、/proc/tty/drivers/goldfish等等。
规则12：待识别终端的运行状态为root状态。如果检测到目标终端处于Android root状态，则可能为模拟器。
其中，该待识别终端即为需要通过确定其设备信息命中的模拟器识别规则以进行模拟器识别的终端，如上述的目标终端。例如，对于登录场景，设置的模拟器识别规则可以是单一的模拟器识别规则如上述的规则3或4，以快速识别是否为模拟器。又如，对于APP优惠领取等场景，设置的模拟器识别规则可以是单一的模拟器识别规则如上述的规则1或2，以便于在快速识别是否为模拟器的同时，确保识别可靠性，等等，此处不一一列举。
103、获取该目标终端的设备信息，并检测该目标终端的设备信息是否命中该目标模拟器识别规则。
其中，设备信息命中模拟器识别规则也可以称为设备信息满足模拟器识别规则或符合模拟器识别规则等等，此处不一一列举。
可选的，该获取的目标终端的设备信息可包括该目标终端连接的Wi-Fi热点的路由器的名称、该路由器的MAC地址、该目标终端的型号、品牌、CPU的生产商标识、内存空间值、安装的应用的第一数目、存储的文件的第二数目、使用的网络制式、运行状态中的 任一项或多项，且该目标模拟器识别规则对应的设备信息为该目标终端的设备信息中的部分信息。例如，在进行模拟器识别时，识别设备可通过获取目标终端的设备底层多项设备信息，比如该设备信息可包括以下一项或多项：连接的Wi-Fi热点的路由器信息(包括路由器名称(或Wi-Fi名称)如Wi-Fi ssid，路由器MAC地址(或Wi-Fi MAC地址)如Wi-Fi bssid等)、机型(型号和/或品牌)、CPU生产商信息、蓝牙信息、传感器信息、用户使用痕迹信息如内存空间值、使用的网络制式、Android状态(或称为运行状态，如是否处于root状态)、系统文件异常信息(如是否存在预设路径和名称的系统文件)、安装的应用的数目、存储的文件的数目、接入App的包名、接入App的版本号、SDK的版本号、操作系统类型、操作系统版本、设备唯一标识码(UDID)、是否已经越狱(比如1代表已越狱，0代表未越狱)、经纬度信息、网络类型、指定App是否安装(比如1代表已安装，0代表未安装)、是否安装了阿里小号、是否安装了v8插件、当前时间戳(比如精度为毫秒)、广告标示符、Vendor标识符、设备型号、主机名、CPU核心数、CPU类型、CPU子类型、屏幕分辨率、存储总空间、存储剩余空间、时区、语言、电量、电池状态、运营商名称、国家ISO、启动时间、键盘列表、did被抹掉或篡改、localfile中存储的did、是否打开GPS开关(比如0代表关闭，1代表开启)、GPS授权状态、APP加载的动态链接库列表等等。该识别设备可根据该目标模拟器识别规则使用该获取的设备信息项中与该目标模拟器识别规则对应的部分信息用于模拟器识别，即获取的设备信息项多于需要使用到的设备信息项，使得非法分子无法确定具体使用哪些信息来进行模拟器识别的，这就有助于防止非法分子了解到某一识别规则后篡改相关设备信息导致无法及时识别模拟器的情况的发生，即防止识别规则被破解，使得提升了模拟器识别的可靠性。
或者，可选的，该目标终端的设备信息为该目标模拟器识别规则对应的设备信息。也就是说，识别设备可仅获取用于进行模拟器识别的设备信息，即该目标模拟器识别规则对应的设备信息，以进行模拟器识别，而不必获取其他的设备信息，这就节省了设备开销。
104、当该目标终端的设备信息命中该目标模拟器识别规则时，确定该目标终端运行于模拟器环境。
在确定出目标终端所处的目标风控场景对应的目标模拟器识别规则并获取设备信息之后，即可检测该设备信息是否命中该目标模拟器识别规则，如果命中，则可识别为模拟器，即目标终端运行于模拟器环境中。例如，假设预先设置的风控场景1如APP优惠领取场景对应的模拟器识别规则为上述的规则5，风控场景2如交易场景对应的模拟器识别规则为上述的规则2，风控场景3如登录场景对应的模拟器识别规则为上述的规则3。如果检测到目标终端所处的目标风控场景为登录场景，则可获取该规则3对应的设备信息即包括该目标终端的型号的设备信息，进而可检测该目标终端的型号是否与该第三黑名单中的终端型号相同。如果该目标终端的型号与该第三黑名单的任一终端型号相同，即该设备信息命中该目标模拟器识别规则时，即可确定该目标终端运行于模拟器环境。
在本申请实施例中，识别设备能够通过获取终端所处的风控场景，进而根据预设的不同风控场景和模拟器识别规则的对应关系，确定出与该终端所处的风控场景对应的模拟器识别规则并获取该终端的设备信息后，通过检测该设备信息是否命中该确定出的模拟器识别规则以进行模拟器识别。本申请实施例能够结合不同风控场景进行模拟器识别，有助于 防止非法分子了解到某一识别规则后篡改相关设备信息导致无法及时识别模拟器的情况的发生，提升了模拟器识别的灵活性和准确性。
请参见图2，图2是本申请实施例提供的另一种模拟器识别方法的流程示意图。具体的，如图2所示，该模拟器识别方法可以包括以下步骤：
201、获取目标终端所处的目标风控场景。
202、根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与该目标风控场景对应的目标模拟器识别规则。
具体的，该步骤201-202的描述可参照上述图1所示实施例中步骤101-102的相关描述，此处不赘述。
可选的，在设置不同风控场景对应的模拟器识别规则时，每一风控场景对应的模拟器识别规则可以设置为一个或多个，即可预先设置得到每一风控场景和一个或多个模拟器识别规则的对应关系。从而在某些风控场景下，比如风险等级较高的风控场景，或者比较重要的风控场景如预设的特定APP下的风控场景，通过为其设置的多个模拟器识别规则来进行模拟器识别，则能够进一步提升模拟器识别的可靠性，避免非法分子了解到某一识别规则后篡改相关设备信息导致无法及时识别模拟器的情况的发生。
进一步可选的，如果为一风控场景设置了多个模拟器识别规则，还可进一步设置该多个模拟器识别规则的切换条件，比如按照预设的时间间隔在该多个模拟器识别规则中随机切换。进一步的，还可设置该多个模拟器识别规则的切换顺序，比如预先设置该多个模拟器识别规则的优先级，在切换模拟器识别规则时，按照优先级由高到低切换或者由低到高进行切换等等。从而能够进一步提升模拟器识别的可靠性。
203、获取该目标终端的设备信息。
其中，该获取的设备信息包括该目标模拟器识别规则对应的设备信息(可以仅包括这部分信息，也可以获取包括其他信息，此处不赘述)，即使用该目标模拟器识别需用到的设备信息。可选的，与该目标风控场景对应的目标模拟器识别规则可以为一个或多个。
204、当与该目标风控场景对应的目标模拟器识别规则存在多个时，按照预设的时间间隔和预设的多个该目标模拟器识别规则的优先级，依次检测该目标终端的设备信息是否命中多个该目标模拟器识别规则。
在进行模拟器识别时，在目标终端所处的目标风控场景对应多个目标模拟器识别规则时，识别设备可按照预设的时间间隔切换目标模拟器识别规则以实现模拟器识别。该切换可以是随机切换或者按照特定切换顺序切换。例如，识别设备可按照预设的该多个目标模拟器识别规则的优先级来进行切换，以进行模拟器识别，使得模拟器识别可靠性较高。
可选的，当存在多个目标模拟器识别规则时，每个目标模拟器识别规则对应的设备信息可以确定该目标风控场景对应的多个目标模拟器识别规则之后一起获取，或者，也可以分别获取，比如在达到一目标模拟器识别规则的使用条件之后再获取，本申请不做限定。
205、当该目标终端的设备信息命中任一目标模拟器识别规则时，停止检测，并确定该目标终端运行于模拟器环境。
具体的，当存在多个目标模拟器识别规则，并在该多个目标模拟器识别规则进行切换以进行模拟器识别，检测到对应的设备信息命中该多个目标该模拟器识别规则中的任一目 标模拟器识别规则时，即可确定该目标终端运行于模拟器环境中，并可停止执行检测该目标终端的设备信息是否命中多个该目标模拟器识别规则的步骤，以减小设备开销。或者，为了进一步提升模拟器识别的可靠性，还可以在检测到该设备信息命中该多个目标该模拟器识别规则中的F(F为大于1的正整数)个目标模拟器识别规则时，再确定该目标终端运行于模拟器环境，并可停止检测，此处不赘述。例如，目标终端的设备信息命中该目标模拟器识别规则，包括：该终端连接的Wi-Fi热点的路由器的名称与预置的第一黑名单内的路由器名称相同；或者，该目标终端连接的Wi-Fi热点的路由器的MAC地址处于预置的第二黑名单内的MAC地址集合；或者，该目标终端的型号与预置的第三黑名单内的任一终端型号相同；或者，该目标终端的品牌与预置的第四黑名单内的任一终端品牌相同；或者，该目标终端的中央处理器CPU的生产商标识与预置的白名单中的所有生产商标识均不相同；或者，该目标终端中未配置有预设模块，该预设模块包括蓝牙模块、温度传感器、光线传感器中的一个或多个；或者，该目标终端的内存空间值小于预设内存阈值；或者，该目标终端安装的应用的第一数目小于预设的第一数目阈值；或者，该目标终端存储的文件的第二数目小于预设的第二数目阈值；或者，该目标终端使用的网络制式与预设的网络制式列表中的所有网络制式均不相同；或者，该目标终端的系统中存在预设路径和名称的系统文件；或者，该目标终端的运行状态为root状态，此处不赘述。
举例来说，假设预先设置了上述的12个模拟器识别规则，预设的与风控场景1如APP优惠领取场景对应的模拟器识别规则为规则1、7、9，预设的与风控场景2如登录场景对应的模拟器识别规则为规则3，预设的与风控场景3如交易场景对应的模拟器识别规则为规则3、4、5、6。如果目标终端所处的目标风控场景为交易场景，则识别设备可按照预设的时间间隔如10min在该规则3、4、5、6中动态地随机切换模拟器识别规则，检测目标终端的设备信息是否命中对应的规则，比如依次采用规则3、规则4、规则5、规则6进行模拟器识别。或者，假设预先设置该规则3的优先级高于规则5的优先级，规则5的优先级高于规则4的优先级，规则4的优先级高于规则6的优先级，则识别设备可依次采用规则3、规则5、规则4、规则6进行模拟器识别，此处不赘述。
在其他可选的实施例中，识别设备还可仅按照预设时间间隔动态变换识别规则，通过动态变换模拟器识别规则的方式，可以进一步提升模拟器识别的可靠性，避免非法分子了解到某一识别规则后篡改相关设备信息导致无法及时识别模拟器的情况的发生。
在本申请实施例中，识别设备能够通过获取终端所处的风控场景，进而确定出与该终端所处的风控场景对应的模拟器识别规则，如果确定出的模拟器识别规则存在多个，识别设备还可动态的变换识别规则，比如按照预设时间间隔和规则的优先级进行动态变换，这就提升了模拟器识别的可靠性，有助于防止非法分子了解到某一识别规则后篡改相关设备信息导致无法及时识别模拟器的情况的发生。
请参见图3，图3是本申请实施例提供的又一种模拟器识别方法的流程示意图。具体的，如图3所示，该模拟器识别方法可以包括以下步骤：
301、获取目标终端所处的目标风控场景。
302、根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与该目标风控场景对应的目标模拟器识别规则。
具体的，该步骤301-302的描述可参照上述图1所示实施例中步骤101-102、图2所示实施例中步骤201-202的相关描述，此处不赘述。
303、获取该目标终端的设备信息。
其中，获取的设备信息的相关描述可参照上述实施例的相关描述，此处不赘述。
304、获取该目标终端的设备信息对应的目标函数的flag值，并根据该flag值确定该目标函数是否被hook。
可选的，在该获取该目标终端的设备信息之后，以及检测该目标终端的设备信息是否命中该目标模拟器识别规则之前，即在根据设备信息进行模拟器识别之前，识别设备还可检测用于进行模拟器识别的设备信息是否被篡改，以确保基于真实的设备信息进行模拟器识别。其中，该检测是否被篡改的设备信息可以仅为该目标模拟器识别规则对应的设备信息，以减小设备开销。
具体的，识别设备能够通过检测设备信息对应的函数是否被hook来识别该篡改行为。其中，该flag值可用于标记所述目标函数的状态，该状态可以是指是否被篡改的状态，或者可以是指读写状态、阻塞与非阻塞状态、退出进程或程序的状态和/或更改文件的内容的状态等等，从而能够根据该flag值确定出该目标函数是否被hook。每一个函数都有对应的flag，该flag为一个变量，当某一函数被hook时，该函数对应的flag会发生改变。由此，识别设备可通过检测函数的flag是否发生改变，来确定该函数是否被hook，也即该函数对应的设备信息是否被篡改。其中，该flag的值可以是存储于该目标函数对应的内存中。
可选的，在根据该flag值确定该目标函数是否被hook时，识别设备可以将该flag值中的预设位置处的字符与预设的固定字符进行比较；当比较得到该预设位置处的字符与该固定字符不同时，确定该目标函数被hook。其中，该预设位置处的字符的字符数与该固定字符的字符数相同，以便于匹配比较。也就是说，该flag发生改变可以是指该flag值的一位或多位发生改变，且该一位或多位可以是指flag的预设位置处的一位或多位。从而识别设备可以通过将获取的flag值预设位置处的一位或多位与未被篡改时的固定字符进行比较，如果flag值的该一位或多位发生改变，即flag值的一位或多位与该固定字符不同，则表明该目标函数被hook，即该目标函数对应的设备信息被篡改。
例如，针对Android版本在4.4以上及5.0以下的系统，有的Xposed插件对某函数进行hook时，会将该函数的flag值的固定位置处的1位(bit)设置为1；而正常未被篡改的函数，flag值的该位是0(即上述的固定字符)。因此，可通过检测函数的flag值的该固定位是否是0，就可以知道该函数是否被Xposed插件进行了hook。也即，如果该测函数的flag值的该固定位不为0，即可表明该函数被hook，该函数被篡改。
可选的，在根据该flag值确定该目标函数是否被hook时，识别设备还可以按照预设的逻辑算法对该flag值进行逻辑运算，以得到运算结果值；当该运算结果值为正整数时，确定该目标函数被hook。其中，该逻辑算法可以是根据预设字符串和系统中的原生函数执行时的跳转地址确定的。也就是说，还可将按照预设逻辑算法对flag处理后的值与未被篡改时的固定字符如0进行比较，如果处理后的该值发生改变，即不为0，比如为某一正整数时，则表明该函数被hook。
例如，针对Android版本在5.0及其以上的系统，如果按照逻辑算法如逻辑算式 EntryPointFromJni&&AccessFlags&0x10000000结果等于正整数，则可表明该函数被篡改；如果该逻辑算式结果等于0(即为固定字符)，则可表明该函数未被篡改。其中，该EntryPointFromJni可以是指原生函数如native函数执行时的跳转地址，AccessFlags即为上述的flag。
进一步可选的，识别设备在根据该flag值确定该目标函数是否被hook之前，还可确定该目标终端目标使用的系统版本，进而根据该目标终端的系统版本去选择根据该flag值确定该目标函数是否被hook的方式，以提升hook检测的效率。其中，该系统版本和hook检测的方式的对应关系可预先设置得到。
305、当确定该目标函数被hook时，从该目标函数的内存中获取该目标函数对应的目标函数指针。
其中，该函数指针和被hook的函数是存储于同一块内存的不同字段中的，且不同函数指针和原始函数存在映射关系，或者说不同函数指针和原始函数的存储地址存在映射关系。
可选的，在确定该目标函数被hook之后，还可对该被hook的目标函数进行还原，以便于确定出该目标函数对应的真实设备信息。具体的，在确定某一函数如该目标函数被hook之后，可从其内存中快速获取该目标函数对应的函数指针，即上述的目标函数指针，以便于根据该目标函数指针确定出该目标函数对应的原始函数如原生API，即未被hook的真实函数。
306、根据预先存储的各函数指针和函数的对应关系，确定出该目标函数指针对应的原始函数，并根据该原始函数确定出原始设备信息。
在确定出该目标函数对应的内存中的目标函数指针之后，即可进一步确定出该目标函数指针对应的原始函数，即真实的Method。进而可通过该原始函数替换该目标函数，实现对被hook的函数的还原。从而识别设备可通过该原始函数确定出该目标终端对应的真实设备信息，以基于真实设备信息进行模拟器识别，也就是说，本申请实施例可在检测到设备信息被篡改时及时地获取真实的设备信息，以基于真实的设备信息进行模拟器识别，由此提升了模拟器识别的准确性和可靠性。
应理解，该内存中存储的原始函数指针是不会被篡改的，根据Xposed插件的工作原理，在篡改目标函数之前，会将函数的原始信息备份下来，并保存在内存中的特定地址，即该目标函数指针指向的地址。而一旦这些备份信息也被篡改，那Xposed插件将无法正常工作。因此，在该目标函数指针指向的特定地址获取到的原始函数，一定是正确的函数，其不会被篡改。
307、检测该原始设备信息是否命中该目标模拟器识别规则。
308、当该目标终端的设备信息命中该目标模拟器识别规则时，确定该目标终端运行于模拟器环境。
在确定出真实的原始设备信息之后，即可确定该原始设备信息是否命中对应的目标模拟器识别规则，进而根据命中结果来进行模拟器识别，识别方式与上述根据设备信息和目标模拟器识别规则进行模拟器识别的方式类似，具体请参照上述图1所示实施例中步骤103-104以及图2所示实施例中步骤204-205的相关描述，此处不赘述。
例如，假设确定出目标终端所处的目标风控场景对应的模拟器识别规则为上述的规则 1，该设备信息包括该路由器的名称。如果检测到该路由器的名称对应的函数被hook，即可还原得到真实的原始路由器的名称，进而可以基于该真实的原始路由器的名称以进行模拟器识别。即检测该原始路由器的名称是否与该第一黑名单内的路由器名称相同，如果相同，则可确定命中该规则1，确定该目标终端运行于模拟器环境。
可选的，如果确定目标终端运行在模拟器环境中，识别设备可生成告警信息，以进行风控。例如，该告警信息可以包括：风险等级、用户信息、设备恶意行为中的一项或多项。其中，该风险等级可以根据终端的目标风控场景确定出，具体可预先设置得到不同风控场景和风险等级的对应关系；或者，该风险等级可以根据终端目标运行的应用确定出，具体可预先设置得到不同应用和风险等级的对应关系；或者，该风险等级还可根据终端被hook的函数的数目确定出，具体可预先设置得到不同hook数目和风险等级的对应关系；或者，该风险等级还可根据终端被篡改的设备信息的优先级确定出，具体可预先设置得到不同设备信息的优先级，以及各优先级和风险等级的对应关系，等等，本申请不做限定。例如，该风险等级可以分为高危、中危、低危，或者一级、二级、三级等等。该用户信息可包括用户标识(User Identification，UID)、手机号码、身份证号码(如果注册应用时采集到的话)等。该恶意行为可包括篡改MAC地址、篡改CPU生产商、篡改手机型号及品牌、篡改手机号码等等，具体可通过上述的hook检测确定出。
此外，可选的，识别设备还可根据该告警信息，向目标终端下发指令，以对目标终端(如终端上运行的APP客户端)上的操作进行控制。例如，如果识别设备确定该风险等级为低危，识别设备可以下发指令指示客户端输出提示，要求用户输入验证信息，验证方式包括但不限于短信验证码、图片验证码等方式。如果验证未通过则无法进行后续操作。又如，如果识别设备确定该风险等级为中危，识别设备可以下发指令指示客户端禁止用户在目标风控场景(例如登录、领取红包、兑换优惠券、消费、转账等等)的请求访问操作。又如，如果识别设备确定该风险等级为高危，识别设备可以下发指令指示客户端禁止用户一切请求访问操作，等等，此处不一一列举。
例如，对于某些手机游戏，使用模拟器可以获得比手机更强的性能(实际上属于游戏作弊)，本申请能够通过上述的识别方式识别出游戏应用是否运行在模拟器环境中，能够及时的发现运行于模拟器中的游戏行为，进而可制止该行为，防止作弊给用户带来的损失。
又如，某一金融机构推出的小额贷款的风控策略是仅允许特定区域的用户如北上广的用户贷款，非法用户可能使用模拟器修改GPS定位，达到绕过风控策略的目的，骗取贷款。由此，本申请可通过上述的识别方式识别出设备是否运行于模拟器环境，并在确定设备运行于模拟器环境之后，拒绝该用户的贷款请求。进一步的，本申请还可采用上述的hook检测方式对该GPS定位进行还原，以获取得到用户的真实定位信息。
又如，非法分子通过在模拟器中设置手机型号、品牌、厂商等信息，实现一个模拟器软件模拟多台不同安卓手机的目的，从而创建假身份骗取优惠活动、注册奖励等等。通过本申请，能够根据上述的hook检测方式确定手机型号、品牌、厂商等信息被篡改后，还原真实的手机型号、品牌、厂商等信息并进行模拟器识别，进而能够及时地识别出设备操作是否运行在模拟器环境中，并在识别出运行在模拟器环境中时能够及时地制止该行为，避免给合法用户造成损失。
在本申请实施例中，识别设备能够通过获取终端所处的风控场景，进而确定出与该终端所处的风控场景对应的模拟器识别规则并获取该终端的设备信息后，通过识别设备信息是否被篡改，并在检测到被篡改时及时地还原真实的设备信息，以基于真实的设备信息和该确定出的模拟器识别规则进行模拟器识别，这就提升了模拟器识别的准确性。
上述方法实施例都是对本申请的模拟器识别方法的举例说明，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
请参见图4，图4是本申请实施例提供的一种识别设备的结构示意图。本申请实施例的识别设备包括用于执行上述模拟器识别方法的单元。具体的，本实施例的识别设备400可包括：获取单元401和处理单元402。其中，
获取单元401，用于获取识别目标终端所处的目标风控场景；
处理单元402，用于根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与所述目标风控场景对应的目标模拟器识别规则，所述多个模拟器识别规则是根据历史记录中运行于模拟器环境的终端的设备信息确定出的；
获取单元401，还用于获取所述目标终端的设备信息；
所述处理单元402，用于检测所述目标终端的设备信息是否命中所述目标模拟器识别规则，并在所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境。
可选的，所述处理单元402，具体用于当与所述目标风控场景对应的目标模拟器识别规则存在多个时，按照预设的时间间隔和预设的多个所述目标模拟器识别规则的优先级，依次检测所述目标终端的设备信息是否命中多个所述目标模拟器识别规则；当所述目标终端的设备信息命中多个所述目标模拟器识别规则中任一目标模拟器识别规则时，停止检测，并确定所述目标终端运行于模拟器环境。
可选的，所述目标终端的设备信息包括所述目标终端连接的无线保真Wi-Fi热点的路由器的名称、所述路由器的媒体访问控制MAC地址、所述目标终端的型号、品牌、中央处理器CPU的生产商标识、内存空间值、安装的应用的第一数目、存储的文件的第二数目、使用的网络制式、运行状态中的任一项或多项，且所述目标模拟器识别规则对应的设备信息为所述目标终端的设备信息中的部分信息；或者，所述目标终端的设备信息为所述目标模拟器识别规则对应的设备信息。
可选的，所述目标终端的设备信息命中所述目标模拟器识别规则，包括：
所述终端连接的Wi-Fi热点的路由器的名称与预置的第一黑名单内的路由器名称相同；或者，
所述目标终端连接的Wi-Fi热点的路由器的MAC地址处于预置的第二黑名单内的MAC地址集合；或者，
所述目标终端的型号与预置的第三黑名单内的任一终端型号相同；或者，
所述目标终端的品牌与预置的第四黑名单内的任一终端品牌相同；或者，
所述目标终端的中央处理器CPU的生产商标识与预置的白名单中的所有生产商标识均不相同；或者，
所述目标终端中未配置有预设模块，所述预设模块包括蓝牙模块、温度传感器、光线 传感器中的一个或多个；或者，
所述目标终端的内存空间值小于预设内存阈值；或者，
所述目标终端安装的应用的第一数目小于预设的第一数目阈值；或者，
所述目标终端存储的文件的第二数目小于预设的第二数目阈值；或者，
所述目标终端使用的网络制式与预设的网络制式列表中的所有网络制式均不相同；或者，
所述目标终端的系统中存在预设路径和名称的系统文件；或者，
所述目标终端的运行状态为root状态。
可选的，所述识别设备还包括：hook检测单元403和还原单元404；
所述获取单元401，还用于在所述获取所述目标终端的设备信息之后，获取所述目标终端的设备信息对应的目标函数的flag值；
hook检测单元403，用于根据所述flag值确定所述目标函数是否被hook；
所述获取单元401，还用于当确定所述目标函数被hook时，从所述目标函数的内存中获取所述目标函数对应的目标函数指针；
还原单元404，用于根据预先存储的各函数指针和函数的对应关系，确定出所述目标函数指针对应的原始函数，并根据所述原始函数确定出原始设备信息；
处理单元402，具体用于检测所述原始设备信息是否命中所述目标模拟器识别规则。
可选的，所述hook检测单元403，具体用于将所述flag值中的预设位置处的字符与预设的固定字符进行比较，所述预设位置处的字符的字符数与所述固定字符的字符数相同；当比较得到所述预设位置处的字符与所述固定字符不同时，确定所述目标函数被hook。
可选的，所述hook检测单元403，具体用于按照预设的逻辑算法对所述flag值进行逻辑运算，以得到运算结果值，其中，所述逻辑算法是根据预设字符串和系统中的原生函数执行时的跳转地址确定的；当所述运算结果值为正整数时，确定所述目标函数被hook。
具体的，该识别设备可通过上述单元实现上述图1至图3所示实施例中的模拟器识别方法中的部分或全部步骤。应理解，本申请实施例是对应方法实施例的装置实施例，对方法实施例的描述，也适用于本申请实施例。
请参见图5，图5是本申请实施例提供的另一种识别设备的结构示意图。该识别设备用于执行上述的方法。如图5所示，本实施例中的识别设备500可以包括：一个或多个处理器501和存储器502。可选的，该识别设备还可包括一个或多个用户接口503，和/或，一个或多个通信接口504。上述处理器501、用户接口503、通信接口504和存储器502可通过总线505连接，或者可以通过其他方式连接，图5中以总线方式进行示例说明。其中，存储器502用于存储计算机程序，所述计算机程序包括程序指令，处理器501用于执行存储器502存储的程序指令。
处理器501可用于调用所述程序指令执行以下步骤：识别目标终端所处的目标风控场景；根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与所述目标风控场景对应的目标模拟器识别规则，所述多个模拟器识别规则是根据历史记录中运行于模拟器环境的终端的设备信息确定出的；获取所述目标终端的设备信息，并检测所述目标终端的设备信息是否命中所述目标模拟器识别规则；当所述目标终 端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境。
可选的，处理器501调用所述程序指令执行所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则时，具体执行以下步骤：当与所述目标风控场景对应的目标模拟器识别规则存在多个时，按照预设的时间间隔和预设的多个所述目标模拟器识别规则的优先级，依次检测所述目标终端的设备信息是否命中多个所述目标模拟器识别规则；
处理器501调用所述程序指令执行所述当所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境时，具体执行以下步骤：当所述目标终端的设备信息命中多个所述目标模拟器识别规则中任一目标模拟器识别规则时，停止检测，并确定所述目标终端运行于模拟器环境。
可选的，所述目标终端的设备信息包括所述目标终端连接的无线保真Wi-Fi热点的路由器的名称、所述路由器的媒体访问控制MAC地址、所述目标终端的型号、品牌、中央处理器CPU的生产商标识、内存空间值、安装的应用的第一数目、存储的文件的第二数目、使用的网络制式、运行状态中的任一项或多项，且所述目标模拟器识别规则对应的设备信息为所述目标终端的设备信息中的部分信息；或者，所述目标终端的设备信息为所述目标模拟器识别规则对应的设备信息。
可选的，所述目标终端的设备信息命中所述目标模拟器识别规则，包括：所述终端连接的Wi-Fi热点的路由器的名称与预置的第一黑名单内的路由器名称相同；或者，所述目标终端连接的Wi-Fi热点的路由器的MAC地址处于预置的第二黑名单内的MAC地址集合；或者，所述目标终端的型号与预置的第三黑名单内的任一终端型号相同；或者，所述目标终端的品牌与预置的第四黑名单内的任一终端品牌相同；或者，所述目标终端的中央处理器CPU的生产商标识与预置的白名单中的所有生产商标识均不相同；或者，所述目标终端中未配置有预设模块，所述预设模块包括蓝牙模块、温度传感器、光线传感器中的一个或多个；或者，所述目标终端的内存空间值小于预设内存阈值；或者，所述目标终端安装的应用的第一数目小于预设的第一数目阈值；或者，所述目标终端存储的文件的第二数目小于预设的第二数目阈值；或者，所述目标终端使用的网络制式与预设的网络制式列表中的所有网络制式均不相同；或者，所述目标终端的系统中存在预设路径和名称的系统文件；或者，所述目标终端的运行状态为root状态。
可选的，处理器501在调用所述程序指令执行所述获取所述目标终端的设备信息之后，以及执行所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则之前，还用于执行以下步骤：获取所述目标终端的设备信息对应的目标函数的flag值，并根据所述flag值确定所述目标函数是否被hook；当确定所述目标函数被hook时，从所述目标函数的内存中获取所述目标函数对应的目标函数指针；根据预先存储的各函数指针和函数的对应关系，确定出所述目标函数指针对应的原始函数，并根据所述原始函数确定出原始设备信息；
处理器501调用所述程序指令执行所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则时，具体执行以下步骤：检测所述原始设备信息是否命中所述目标模拟器识别规则。
可选的，处理器501在调用所述程序指令执行所述根据所述flag值确定所述目标函数是否被hook时，具体执行以下步骤：将所述flag值中的预设位置处的字符与预设的固定字 符进行比较，所述预设位置处的字符的字符数与所述固定字符的字符数相同；当比较得到所述预设位置处的字符与所述固定字符不同时，确定所述目标函数被hook。
可选的，处理器501在调用所述程序指令执行所述根据所述flag值确定所述目标函数是否被hook时，具体执行以下步骤：按照预设的逻辑算法对所述flag值进行逻辑运算，以得到运算结果值，其中，所述逻辑算法是根据预设字符串和系统中的原生函数执行时的跳转地址确定的；当所述运算结果值为正整数时，确定所述目标函数被hook。
其中，所述处理器501可以是中央处理单元(Central Processing Unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
用户接口503可包括输入设备和输出设备，输入设备可以包括触控板、麦克风等，输出设备可以包括显示器(LCD等)、扬声器等。
通信接口504可包括接收器和发射器，用于与其他设备进行通信。
存储器502可以包括只读存储器和随机存取存储器，并向处理器501提供指令和数据。存储器502的一部分还可以包括非易失性随机存取存储器。例如，存储器502还可以存储上述的函数指针和函数的对应关系等等。
具体实现中，本申请实施例中所描述的处理器501等可执行上述图1至图3所示的方法实施例中所描述的实现方式，也可执行本申请实施例图4所描述的各单元的实现方式，此处不赘述。
本申请实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时可实现图1至图3所对应实施例中描述的模拟器识别方法中的部分或全部步骤，也可实现本申请图4或图5所示实施例的识别设备的流程或功能，此处不赘述。
本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述方法中的部分或全部步骤。
所述计算机可读存储介质可以是前述任一实施例所述的识别设备的内部存储单元，例如识别设备的硬盘或内存。所述计算机可读存储介质也可以是所述识别设备的外部存储设备，例如所述识别设备上配备的插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card)等。
在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
以上所述，仅为本申请的部分实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。

Claims (20)

  1. 一种模拟器识别方法，其特征在于，包括：
    识别目标终端所处的目标风控场景；
    根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与所述目标风控场景对应的目标模拟器识别规则，所述多个模拟器识别规则是根据历史记录中运行于模拟器环境的终端的设备信息确定出的；
    获取所述目标终端的设备信息，并检测所述目标终端的设备信息是否命中所述目标模拟器识别规则；
    当所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境。
  2. 根据权利要求1所述的方法，其特征在于，所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则，包括：
    当与所述目标风控场景对应的目标模拟器识别规则存在多个时，按照预设的时间间隔和预设的多个所述目标模拟器识别规则的优先级，依次检测所述目标终端的设备信息是否命中多个所述目标模拟器识别规则；
    所述当所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境，包括：
    当所述目标终端的设备信息命中多个所述目标模拟器识别规则中任一目标模拟器识别规则时，停止检测，并确定所述目标终端运行于模拟器环境。
  3. 根据权利要求1所述的方法，其特征在于，
    所述目标终端的设备信息包括所述目标终端连接的无线保真Wi-Fi热点的路由器的名称、所述路由器的媒体访问控制MAC地址、所述目标终端的型号、品牌、中央处理器CPU的生产商标识、内存空间值、安装的应用的第一数目、存储的文件的第二数目、使用的网络制式、运行状态中的任一项或多项，且所述目标模拟器识别规则对应的设备信息为所述目标终端的设备信息中的部分信息；或者，
    所述目标终端的设备信息为所述目标模拟器识别规则对应的设备信息。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述目标终端的设备信息命中所述目标模拟器识别规则，包括：
    所述终端连接的Wi-Fi热点的路由器的名称与预置的第一黑名单内的路由器名称相同；或者，
    所述目标终端连接的Wi-Fi热点的路由器的MAC地址处于预置的第二黑名单内的MAC地址集合；或者，
    所述目标终端的型号与预置的第三黑名单内的任一终端型号相同；或者，
    所述目标终端的品牌与预置的第四黑名单内的任一终端品牌相同；或者，
    所述目标终端的中央处理器CPU的生产商标识与预置的白名单中的所有生产商标识均不相同；或者，
    所述目标终端中未配置有预设模块，所述预设模块包括蓝牙模块、温度传感器、光线 传感器中的一个或多个；或者，
    所述目标终端的内存空间值小于预设内存阈值；或者，
    所述目标终端安装的应用的第一数目小于预设的第一数目阈值；或者，
    所述目标终端存储的文件的第二数目小于预设的第二数目阈值；或者，
    所述目标终端使用的网络制式与预设的网络制式列表中的所有网络制式均不相同；或者，
    所述目标终端的系统中存在预设路径和名称的系统文件；或者，
    所述目标终端的运行状态为root状态。
  5. 根据权利要求1所述的方法，其特征在于，在所述获取所述目标终端的设备信息之后，以及所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则之前，所述方法还包括：
    获取所述目标终端的设备信息对应的目标函数的flag值，并根据所述flag值确定所述目标函数是否被hook；
    当确定所述目标函数被hook时，从所述目标函数的内存中获取所述目标函数对应的目标函数指针；
    根据预先存储的各函数指针和函数的对应关系，确定出所述目标函数指针对应的原始函数，并根据所述原始函数确定出原始设备信息；
    所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则，包括：
    检测所述原始设备信息是否命中所述目标模拟器识别规则。
  6. 根据权利要求5所述的方法，其特征在于，所述根据所述flag值确定所述目标函数是否被hook，包括：
    将所述flag值中的预设位置处的字符与预设的固定字符进行比较，所述预设位置处的字符的字符数与所述固定字符的字符数相同；
    当比较得到所述预设位置处的字符与所述固定字符不同时，确定所述目标函数被hook。
  7. 根据权利要求5所述的方法，其特征在于，所述根据所述flag值确定所述目标函数是否被hook，包括：
    按照预设的逻辑算法对所述flag值进行逻辑运算，以得到运算结果值，其中，所述逻辑算法是根据预设字符串和系统中的原生函数执行时的跳转地址确定的；
    当所述运算结果值为正整数时，确定所述目标函数被hook。
  8. 一种识别设备，其特征在于，包括：获取单元和处理单元；
    所述获取单元，用于获取识别目标终端所处的目标风控场景；
    所述处理单元，用于根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与所述目标风控场景对应的目标模拟器识别规则，所述多个模拟器识别规则是根据历史记录中运行于模拟器环境的终端的设备信息确定出的；
    所述获取单元，还用于获取所述目标终端的设备信息；
    所述处理单元，还用于检测所述目标终端的设备信息是否命中所述目标模拟器识别规则，并在所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境。
  9. 根据权利要求8所述的识别设备，其特征在于，
    所述处理单元402，具体用于当与所述目标风控场景对应的目标模拟器识别规则存在多个时，按照预设的时间间隔和预设的多个所述目标模拟器识别规则的优先级，依次检测所述目标终端的设备信息是否命中多个所述目标模拟器识别规则；当所述目标终端的设备信息命中多个所述目标模拟器识别规则中任一目标模拟器识别规则时，停止检测，并确定所述目标终端运行于模拟器环境。
  10. 根据权利要求8所述的识别设备，其特征在于，所述目标终端的设备信息包括所述目标终端连接的无线保真Wi-Fi热点的路由器的名称、所述路由器的媒体访问控制MAC地址、所述目标终端的型号、品牌、中央处理器CPU的生产商标识、内存空间值、安装的应用的第一数目、存储的文件的第二数目、使用的网络制式、运行状态中的任一项或多项，且所述目标模拟器识别规则对应的设备信息为所述目标终端的设备信息中的部分信息；或者，所述目标终端的设备信息为所述目标模拟器识别规则对应的设备信息。
  11. 根据权利要求8-10任一项所述的识别设备，其特征在于，所述目标终端的设备信息命中所述目标模拟器识别规则，包括：
    所述终端连接的Wi-Fi热点的路由器的名称与预置的第一黑名单内的路由器名称相同；或者，所述目标终端连接的Wi-Fi热点的路由器的MAC地址处于预置的第二黑名单内的MAC地址集合；或者，所述目标终端的型号与预置的第三黑名单内的任一终端型号相同；或者，所述目标终端的品牌与预置的第四黑名单内的任一终端品牌相同；或者，所述目标终端的中央处理器CPU的生产商标识与预置的白名单中的所有生产商标识均不相同；或者，所述目标终端中未配置有预设模块，所述预设模块包括蓝牙模块、温度传感器、光线传感器中的一个或多个；或者，所述目标终端的内存空间值小于预设内存阈值；或者，所述目标终端安装的应用的第一数目小于预设的第一数目阈值；或者，所述目标终端存储的文件的第二数目小于预设的第二数目阈值；或者，所述目标终端使用的网络制式与预设的网络制式列表中的所有网络制式均不相同；或者，所述目标终端的系统中存在预设路径和名称的系统文件；或者，所述目标终端的运行状态为root状态。
  12. 根据权利要求8所述的识别设备，其特征在于，所述识别设备还包括：hook检测单元和还原单元；
    所述获取单元，还用于在所述获取所述目标终端的设备信息之后，获取所述目标终端的设备信息对应的目标函数的flag值；
    所述hook检测单元，用于根据所述flag值确定所述目标函数是否被hook；
    所述获取单元，还用于当确定所述目标函数被hook时，从所述目标函数的内存中获取所述目标函数对应的目标函数指针；
    所述还原单元，用于根据预先存储的各函数指针和函数的对应关系，确定出所述目标函数指针对应的原始函数，并根据所述原始函数确定出原始设备信息；
    所述处理单元，具体用于检测所述原始设备信息是否命中所述目标模拟器识别规则。
  13. 根据权利要求12所述的识别设备，其特征在于，
    所述hook检测单元，具体用于将所述flag值中的预设位置处的字符与预设的固定字符进行比较，所述预设位置处的字符的字符数与所述固定字符的字符数相同；当比较得到所 述预设位置处的字符与所述固定字符不同时，确定所述目标函数被hook。
  14. 根据权利要求12所述的识别设备，其特征在于，
    所述hook检测单元，具体用于按照预设的逻辑算法对所述flag值进行逻辑运算，以得到运算结果值，其中，所述逻辑算法是根据预设字符串和系统中的原生函数执行时的跳转地址确定的；当所述运算结果值为正整数时，确定所述目标函数被hook。
  15. 一种识别设备，其特征在于，包括处理器和存储器，所述处理器和存储器相互连接，其中，所述存储器用于存储计算机程序，所述计算机程序包括程序指令，所述处理器被配置用于调用所述程序指令，执行以下步骤：
    识别目标终端所处的目标风控场景；根据预设的不同风控场景和模拟器识别规则的对应关系，从预设的多个模拟器识别规则中确定出与所述目标风控场景对应的目标模拟器识别规则，所述多个模拟器识别规则是根据历史记录中运行于模拟器环境的终端的设备信息确定出的；获取所述目标终端的设备信息，并检测所述目标终端的设备信息是否命中所述目标模拟器识别规则；当所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境。
  16. 根据权利要求15所述的识别设备，其特征在于，所述处理器调用所述程序指令执行所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则时，具体执行以下步骤：
    当与所述目标风控场景对应的目标模拟器识别规则存在多个时，按照预设的时间间隔和预设的多个所述目标模拟器识别规则的优先级，依次检测所述目标终端的设备信息是否命中多个所述目标模拟器识别规则；
    所述处理器调用所述程序指令执行所述当所述目标终端的设备信息命中所述目标模拟器识别规则时，确定所述目标终端运行于模拟器环境时，具体执行以下步骤：当所述目标终端的设备信息命中多个所述目标模拟器识别规则中任一目标模拟器识别规则时，停止检测，并确定所述目标终端运行于模拟器环境。
  17. 根据权利要求15所述的识别设备，其特征在于，
    所述目标终端的设备信息包括所述目标终端连接的无线保真Wi-Fi热点的路由器的名称、所述路由器的媒体访问控制MAC地址、所述目标终端的型号、品牌、中央处理器CPU的生产商标识、内存空间值、安装的应用的第一数目、存储的文件的第二数目、使用的网络制式、运行状态中的任一项或多项，且所述目标模拟器识别规则对应的设备信息为所述目标终端的设备信息中的部分信息；或者，所述目标终端的设备信息为所述目标模拟器识别规则对应的设备信息。
  18. 根据权利要求15-17任一项所述的识别设备，其特征在于，
    所述目标终端的设备信息命中所述目标模拟器识别规则，包括：所述终端连接的Wi-Fi热点的路由器的名称与预置的第一黑名单内的路由器名称相同；或者，所述目标终端连接的Wi-Fi热点的路由器的MAC地址处于预置的第二黑名单内的MAC地址集合；或者，所述目标终端的型号与预置的第三黑名单内的任一终端型号相同；或者，所述目标终端的品牌与预置的第四黑名单内的任一终端品牌相同；或者，所述目标终端的中央处理器CPU的生产商标识与预置的白名单中的所有生产商标识均不相同；或者，所述目标终端中未配置 有预设模块，所述预设模块包括蓝牙模块、温度传感器、光线传感器中的一个或多个；或者，所述目标终端的内存空间值小于预设内存阈值；或者，所述目标终端安装的应用的第一数目小于预设的第一数目阈值；或者，所述目标终端存储的文件的第二数目小于预设的第二数目阈值；或者，所述目标终端使用的网络制式与预设的网络制式列表中的所有网络制式均不相同；或者，所述目标终端的系统中存在预设路径和名称的系统文件；或者，所述目标终端的运行状态为root状态。
  19. 根据权利要求15所述的识别设备，其特征在于，所述处理器在调用所述程序指令执行所述获取所述目标终端的设备信息之后，以及执行所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则之前，还用于执行以下步骤：
    获取所述目标终端的设备信息对应的目标函数的flag值，并根据所述flag值确定所述目标函数是否被hook；当确定所述目标函数被hook时，从所述目标函数的内存中获取所述目标函数对应的目标函数指针；根据预先存储的各函数指针和函数的对应关系，确定出所述目标函数指针对应的原始函数，并根据所述原始函数确定出原始设备信息；
    所述处理器调用所述程序指令执行所述检测所述目标终端的设备信息是否命中所述目标模拟器识别规则时，具体执行以下步骤：
    检测所述原始设备信息是否命中所述目标模拟器识别规则。
  20. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如权利要求1-7任一项所述的方法。
PCT/CN2018/107746 2018-07-27 2018-09-26 一种模拟器识别方法、识别设备及计算机可读介质 WO2020019483A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810851413.9A CN109144665B (zh) 2018-07-27 2018-07-27 一种模拟器识别方法、识别设备及计算机可读介质
CN201810851413.9 2018-07-27

Publications (1)

Publication Number Publication Date
WO2020019483A1 true WO2020019483A1 (zh) 2020-01-30

Family

ID=64799251

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/107746 WO2020019483A1 (zh) 2018-07-27 2018-09-26 一种模拟器识别方法、识别设备及计算机可读介质

Country Status (2)

Country Link
CN (1) CN109144665B (zh)
WO (1) WO2020019483A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111338946A (zh) * 2020-02-24 2020-06-26 北京新氧科技有限公司 安卓模拟器检测方法及装置
CN113238946A (zh) * 2021-05-18 2021-08-10 北京达佳互联信息技术有限公司 检测hook框架的方法、装置及电子设备
CN113392685A (zh) * 2020-09-22 2021-09-14 腾讯科技（深圳）有限公司 图像识别方法、装置、图像识别设备及存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110248372B (zh) * 2019-04-25 2023-04-11 深圳壹账通智能科技有限公司 一种模拟器检测的方法、装置、存储介质及计算机设备
CN110213341B (zh) * 2019-05-13 2023-06-23 百度在线网络技术（北京）有限公司 应用程序的下载检测方法及装置
CN110334028A (zh) * 2019-07-08 2019-10-15 北京智游网安科技有限公司 一种安卓模拟器检测方法、计算机设备及存储介质
CN112379967B (zh) * 2020-11-12 2023-11-03 抖音视界有限公司 模拟器检测方法、装置、设备及介质
CN112698581A (zh) * 2020-12-25 2021-04-23 东风汽车有限公司 一种车载信号模拟器
CN113282304B (zh) * 2021-05-14 2022-04-29 杭州云深科技有限公司 基于app安装列表识别虚拟机的系统
CN113722197B (zh) * 2021-08-31 2023-10-17 上海观安信息技术股份有限公司 移动终端异常识别方法、系统
CN113902458A (zh) * 2021-12-07 2022-01-07 深圳市活力天汇科技股份有限公司 一种恶意用户的识别方法、装置及计算机设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106648835A (zh) * 2016-12-26 2017-05-10 武汉斗鱼网络科技有限公司 检测Android应用程序在安卓模拟器中运行的方法及系统
CN107102886A (zh) * 2017-04-14 2017-08-29 北京洋浦伟业科技发展有限公司 安卓模拟器的检测方法及装置
CN107678834A (zh) * 2017-09-30 2018-02-09 北京梆梆安全科技有限公司 一种基于硬件配置的安卓模拟器检测方法及装置
CN108021805A (zh) * 2017-12-18 2018-05-11 上海众人网络安全技术有限公司 检测Android应用程序运行环境的方法、装置、设备及存储介质

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104134041A (zh) * 2014-07-31 2014-11-05 北京奇虎科技有限公司 终端模拟器系统的反检测方法和反检测装置
US9473522B1 (en) * 2015-04-20 2016-10-18 SafeBreach Ltd. System and method for securing a computer system against malicious actions by utilizing virtualized elements
CN107729749A (zh) * 2017-09-30 2018-02-23 北京梆梆安全科技有限公司 结合系统信息和硬件特性的安卓模拟器检测方法及装置
CN107729121A (zh) * 2017-09-30 2018-02-23 北京梆梆安全科技有限公司 模拟器检测方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106648835A (zh) * 2016-12-26 2017-05-10 武汉斗鱼网络科技有限公司 检测Android应用程序在安卓模拟器中运行的方法及系统
CN107102886A (zh) * 2017-04-14 2017-08-29 北京洋浦伟业科技发展有限公司 安卓模拟器的检测方法及装置
CN107678834A (zh) * 2017-09-30 2018-02-09 北京梆梆安全科技有限公司 一种基于硬件配置的安卓模拟器检测方法及装置
CN108021805A (zh) * 2017-12-18 2018-05-11 上海众人网络安全技术有限公司 检测Android应用程序运行环境的方法、装置、设备及存储介质

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111338946A (zh) * 2020-02-24 2020-06-26 北京新氧科技有限公司 安卓模拟器检测方法及装置
CN111338946B (zh) * 2020-02-24 2023-07-14 北京新氧科技有限公司 安卓模拟器检测方法及装置
CN113392685A (zh) * 2020-09-22 2021-09-14 腾讯科技（深圳）有限公司 图像识别方法、装置、图像识别设备及存储介质
CN113238946A (zh) * 2021-05-18 2021-08-10 北京达佳互联信息技术有限公司 检测hook框架的方法、装置及电子设备

Also Published As

Publication number Publication date
CN109144665A (zh) 2019-01-04
CN109144665B (zh) 2023-04-18

Similar Documents

Publication Publication Date Title
WO2020019483A1 (zh) 一种模拟器识别方法、识别设备及计算机可读介质
WO2020019484A1 (zh) 一种模拟器识别方法、识别设备及计算机可读介质
WO2020019485A1 (zh) 一种模拟器识别方法、识别设备及计算机可读介质
CN109787943B (zh) 一种抵御拒绝服务攻击的方法及设备
CN109492378A (zh) 一种基于设备识别码的身份验证方法、服务器及介质
US11687645B2 (en) Security control method and computer system
US10073916B2 (en) Method and system for facilitating terminal identifiers
CN109561085B (zh) 一种基于设备识别码的身份验证方法、服务器及介质
US7669242B2 (en) Agent presence monitor configured to execute in a secure environment
US8626125B2 (en) Apparatus and method for securing mobile terminal
CN110417778B (zh) 访问请求的处理方法和装置
WO2020019482A1 (zh) 一种函数hook检测方法、检测设备及计算机可读介质
CN104767713B (zh) 账号绑定的方法、服务器及系统
CN109600362B (zh) 基于识别模型的僵尸主机识别方法、识别设备及介质
US10671730B2 (en) Controlling configuration data storage
EP3270319A1 (en) Method and apparatus for generating dynamic security module
CN110334515B (zh) 一种基于可信计算平台生成度量报告的方法及装置
US10019577B2 (en) Hardware hardened advanced threat protection
CN111241546B (zh) 一种恶意软件行为检测方法和装置
CN109815702B (zh) 软件行为的安全检测方法、装置及设备
CN114282212A (zh) 流氓软件识别方法、装置、电子设备及存储介质
CN113448681B (zh) 一种虚拟机监控器公钥的注册方法、设备和存储介质
US20190012463A1 (en) Secure configuration data storage
US11947709B2 (en) Electronic device for controlling access to device resource and operation method thereof
CN117009003B (zh) 一种安全启动方法及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18928138

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18928138

Country of ref document: EP

Kind code of ref document: A1