WO2020019484A1 - Simulator recognition method, recognition device, and computer readable medium - Google Patents

Abstract

Disclosed in the present application are a simulator recognition method, a recognition device, and a computer readable medium. Said method comprises: acquiring device information concerning a target terminal; determining, according to a plurality of preset simulator recognition rules and the device information concerning the target terminal, a target recognition rule to which the device information concerning the target terminal is directed among the plurality of simulator recognition rules, the plurality of simulator recognition rules being determined according to device information concerning terminals running in a simulator environment in history records; and according to a preset weight and weight threshold of the target recognition rule, recognizing whether the target terminal runs in the simulator environment. The present application facilitates the improvement of simulator recognition accuracy.

Description

Simulator recognition method, recognition equipment and computer-readable medium

This application claims the priority of a Chinese patent application filed on July 27, 2018 with the Chinese Patent Office under the application number 201810855587.2. Incorporated by reference in this application.

Technical field

The present application relates to the field of communication technologies, and in particular, to a simulator identification method, an identification device, and a computer-readable medium.

Background technique

The Android emulator is an application that can simulate the operating environment of the Android system on various platforms such as Windows and Linux. Users can run the Android system application on the Android emulator in a terminal such as a personal computer. When using the application of the Android system, for certain services, such as those requiring risk monitoring, it is not desired to be run on the simulator, so it is necessary to identify whether the terminal is running in the Android simulator environment. At present, the risk recognition device has limited recognition ability of the Android simulator, and cannot effectively identify whether the terminal is running in the simulator environment.

Summary of the Invention

The application provides a simulator recognition method, a recognition device and a computer-readable medium, which are helpful to improve the accuracy of the simulator recognition.

In a first aspect, the present application provides a simulator identification method, including:

Obtain device information of a target terminal, where the device information includes information about a model of the target terminal, a manufacturer ID of a central processing unit CPU, a memory space value, a first number of installed applications, and a second number of stored files Any one or more of the network system used, operating status, and router information of the connected Wi-Fi hotspot;

Determining a target recognition rule that the device information of the target terminal hits in the plurality of simulator recognition rules according to a preset plurality of simulator recognition rules and the device information of the target terminal, wherein the plurality of simulators The identification rule is determined based on the device information of the terminal running in the simulator environment in the historical record;

According to a preset weight and a weight threshold of the target recognition rule, identify whether the target terminal is running in a simulator environment.

In a second aspect, the present application provides an identification device including a unit for performing the method of the first aspect.

In a third aspect, the present application provides another identification device, including a processor, a user interface, a communication interface, and a memory, and the processor, the user interface, the communication interface, and the memory are connected to each other, where the memory is used for storing support A computer program that identifies the device to execute the method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.

In a fourth aspect, the present application provides a computer-readable storage medium, where the computer storage medium stores a computer program, the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute The method of the first aspect described above.

In the embodiment of the present application, the device identification information of the terminal can be used to determine the simulator identification rule of the target terminal device information hit among preset multiple simulator identification rules, and then according to the preset weight of the simulator identification rule that is hit And preset weight thresholds to identify whether the target terminal is running in the simulator environment, so that it can implement simulator recognition by combining multiple simulator recognition rules, which helps to improve the accuracy of simulator recognition.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to explain the technical solution of the embodiment of the present application more clearly, the accompanying drawings used in the description of the embodiment will be described below.

FIG. 1 is a schematic flowchart of a simulator recognition method according to an embodiment of the present application; FIG.

FIG. 2 is a schematic flowchart of another simulator recognition method according to an embodiment of the present application; FIG.

3 is a schematic flowchart of another simulator identification method according to an embodiment of the present application;

4 is a schematic structural diagram of an identification device according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of another identification device according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

The technical solution of the present application can be applied to an identification device, which can include various terminals, servers, or risk identification products (devices) connected to the terminal, etc., for identifying the behavior of the simulator in the terminal (referred to as " Simulator recognition ") to identify whether the terminal (or an application in the terminal, such as an application embedded in the SDK) is running in the simulator environment, or is called identifying whether the terminal is logged in using the simulator. In this application, the simulator may refer to an Android simulator or another simulator. The terminals involved in this application may be mobile phones, computers, tablets, personal computers, smart watches, etc., and this application is not limited.

Specifically, in this application, multiple emulator recognition rules can be set and various device information of the terminal can be obtained, such as connected Wi-Fi hotspot information, model information, CPU manufacturer information, module configuration information, and memory space. Information, the number of installed applications, the number of stored files, the network system used, system file abnormal information, running status and other information, and based on the simulator identification rules of various device information hits, combine Multiple simulator recognition rules are used for simulator recognition, which can improve the accuracy of simulator recognition. The details are described below.

Please refer to FIG. 1, which is a schematic flowchart of a simulator recognition method provided by an embodiment of the present application. Specifically, as shown in FIG. 1, the simulator recognition method may include the following steps:

101. Obtain device information of a target terminal.

The target terminal may be any terminal that needs to be identified by the simulator, such as a terminal connected to a risk identification product, or a terminal in a specific risk control scenario, or triggered (such as by a preset button or gesture or preset Other triggering methods) are terminals identified by the simulator, etc., which are not limited in this application. The risk control scenario may include a login scenario, a transaction scenario, an APP discount domain scenario, and so on.

Optionally, the acquired device information may include information about the model of the target terminal, the manufacturer's identification of the CPU, the value of the memory space, the first number of installed applications, the second number of stored files, and the network standard used. Any one or more of the module configuration information, operating status, and router information of the connected wireless fidelity Wi-Fi hotspot. The model information may include the model and / or brand of the target terminal. The module configuration information includes whether a preset module such as a Bluetooth module, temperature sensor, light sensor, etc. is configured. The router information may include the name and / Or MAC address and so on.

102. Determine, according to a preset plurality of simulator recognition rules and device information of the target terminal, a target recognition rule that the device information of the target terminal hits in the plurality of simulator recognition rules.

The plurality of simulator recognition rules may be determined according to device information of a terminal running in the simulator environment in a historical record, so as to improve the efficiency and reliability of simulator recognition. For example, the plurality of simulator recognition rules may include at least two of the following:

Rule 1: The name of the router of the Wi-Fi hotspot to which the terminal to be identified is the same as the name of the router in the preset first blacklist;

Rule 2: The MAC address of the router of the Wi-Fi hotspot to which the terminal to be identified belongs is a set of MAC addresses in a preset second blacklist;

Among them, detecting whether a MAC address is in a preset MAC address set can also be referred to as detecting whether the MAC address is the same as the MAC address in the MAC address set; accordingly, a MAC address in the MAC address set can refer to the MAC address and the MAC Any MAC address in the address set is the same.

Rule 3: The model of the terminal to be identified is the same as any terminal model in the preset third blacklist;

Rule 4: The brand of the terminal to be identified is the same as any terminal brand in the preset fourth blacklist;

Optionally, the device information included in the above blacklists, such as the first blacklist, the second blacklist, the third blacklist, and the fourth blacklist, may be the terminals identified as simulators in the historical data (that is, identified as running on Device information corresponding to the terminal in the simulator environment, such as the first L with the most statistics (L is an integer greater than 0, such as taking 8) device information (router name, MAC address, model or brand, etc.), or statistics The device information and the like that are larger than the preset threshold are not repeated here.

For example, the first blacklist includes the names that are counted more frequently among the names of routers connected to the terminals identified as simulators in the historical data, such as the top M with the most counts (M is an integer greater than 0, such as 10) Names, or names whose number of counts is greater than a preset number threshold (first threshold); for another example, the second blacklist includes historical data that has more counts in the MAC address of the router connected to the terminal identified as the simulator MAC address or a set of MAC addresses composed of the MAC address, such as the first N (N is an integer greater than 0, such as 50) MAC addresses with the highest number of statistics, or the number of statistics greater than a preset number threshold (second threshold) MAC addresses, or a set of MAC addresses determined by these MAC addresses, etc., are not limited in this application. The first threshold and the second threshold can be preset.

Rule 5: The manufacturer identification of the central processing unit CPU of the terminal to be identified is different from all the manufacturer identifications in the preset white list;

The white list may include the identifications of one or more legal CPU manufacturers.

Rule 6: There is no preset module configured in the terminal to be identified, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor;

The preset module may be a module that is not configured in the terminal identified as the simulator according to historical data statistics, such as a Bluetooth module, a temperature sensor, and a light sensor. Therefore, if it is recognized that the terminal is not configured with the preset module, it may be an emulator.

Rule 7: The memory space value of the terminal to be identified is less than a preset memory threshold;

Rule 8: The first number of applications installed on the terminal to be identified is less than a preset first number threshold;

Rule 9: The second number of files stored by the terminal to be identified is less than a preset second number threshold;

The first number threshold and the second number threshold can be preset.

Rule 10: The network standard used by the terminal to be identified is different from all the network standards in the preset network standard list;

Optionally, the identification device may determine which network standards are normal in combination with the target area where the terminal to be identified is located, such as a target terminal, for example, by pre-configuring different areas and their corresponding network standard lists to determine the network standard corresponding to the target area List, the network standard in the network standard list is the normal network standard of the target area. If it is detected that the network standard used by the target terminal is not the network standard in its corresponding network standard list, the target terminal may run in the simulator environment because the simulator may tamper with the network standard information.

Rule 11: a system file with a preset path and name exists in the system of the terminal to be identified;

If there is an abnormal system file in the target terminal, it may be an emulator. For example, the abnormal system file can include system files with the following paths and names: / dev / qemu_pipe, / dev / socket / qemud, /system/lib/libc_malloc_debug_qemu.so, / sys / qemu_trace, / proc / tty / drivers / goldfish and more.

Rule 12: The running state of the terminal to be identified is the root state. If it is detected that the target terminal is in the Android root state, it may be an emulator.

Among them, the device information hitting the simulator recognition rule may also be called that the device information meets the simulator recognition rule or conforms to the simulator recognition rule, etc. The terminal to be identified is a terminal that needs to perform simulator identification by determining simulator identification rules that its device information hits, such as the target terminal described above.

103. Identify whether the target terminal is running in a simulator environment according to a preset weight and a weight threshold of the target recognition rule.

The weights of the recognition rules of the multiple simulators can be set in advance, for example, by the wind control personnel based on experience, or according to the frequency or number of times that the terminal identified as the simulator hits the recognition rules of each simulator in the historical record. and many more. For example, the set weights are as follows: rule 1 = rule 2> rule 3 = rule 4> rule 5> rule 6 = rule 7 = rule 8 = rule 9 = rule 10> rule 11> rule 12. The method for setting or determining the weight of the simulator recognition rule is not limited in this application.

That is, the present application can preset multiple simulator recognition rules. When performing simulator recognition, it can obtain device information of the terminal and detect whether the device information matches the multiple simulator recognition rules. The weight of the hit simulator recognition rule and a preset weight threshold are used for simulator recognition. For example, when the weight of the hit simulator recognition rule is greater than the weight threshold, it is determined that the terminal is running in the simulator environment. Further, if the device information of the target terminal does not hit any simulator recognition rule, it can be determined that the target terminal is not running in the simulator environment.

For example, in some embodiments, the preset multiple simulator recognition rules are the above-mentioned rules 1, 2, and 3, the preset rule 1 has a weight of 0.7, the rule 2 has a weight of 0.7, and the rule 3 has a weight of The weighted threshold is 0.5, and the obtained device information includes the name and MAC address of the router of the Wi-Fi hotspot connected to the target terminal, and the model of the target terminal. Then the identification device can detect whether the router name in the device information is the same as the router name in the first blacklist, and whether the MAC address in the device information is in the MAC address set in the second blacklist, and the Whether the model in the device information is the same as any terminal model in the third blacklist. If the identification device detects that the name of the router is the same as the name of any router in the first blacklist, it determines to hit rule 1. If the identification device detects that the MAC address is in any MAC address set in the second blacklist , Determine rule 2; if the identification device detects that the model is the same as any terminal model in the third blacklist, determine rule 3. Assuming that the identification device determines that the device information of the target terminal matches rule 2, rules 1 and 3 are missed, and the weight 0.7 corresponding to rule 2 is greater than the weight threshold 0.6, it can be determined that the target terminal is running in the simulator environment.

In the embodiment of the present application, the recognition device can determine the simulator recognition rule for the device information hit of the target terminal in the preset multiple simulator recognition rules by acquiring the device information of the terminal, and then according to the preset simulation of the hit The weight of the recognition rule and the preset weight threshold are used to identify whether the target terminal is running in the simulator environment, which enables the realization of simulator recognition by combining multiple simulator recognition rules, which helps to improve the accuracy of simulator recognition. Sex.

Please refer to FIG. 2, which is a schematic flowchart of another simulator recognition method provided by an embodiment of the present application. Specifically, as shown in FIG. 2, the simulator recognition method may include the following steps:

201. The device information of the terminal running in the simulator environment in the historical record is respectively matched with the hit information of the plurality of simulator recognition rules, and the hit information includes a hit frequency and / or a hit number.

202. Determine the weight corresponding to each simulator recognition rule according to the hit information corresponding to each simulator recognition rule.

Wherein, the weight corresponding to each simulator recognition rule may be directly proportional to the hit frequency corresponding to the simulator recognition rule, and / or, the weight corresponding to each simulator recognition rule may be equal to the number of hits corresponding to the simulator recognition rule. Directly proportional.

That is, this application can perform big data analysis on historical data of the terminal identified as running in the simulator environment, including hit simulator rules, and flexibly set the simulation according to the frequency and / or number of times that the historical data hits the above rules. Recognize the weight of the rule. For example, the higher the frequency of hitting a rule, the greater the corresponding weight of the rule is set; the higher the number of hits of a rule, the greater the corresponding weight of the rule, and so on. Optionally, a mapping relationship between the hit frequency (and / or the number of hits) and the weight may be established in advance, or a mapping relationship between the hit frequency (and / or the number of hits) and the importance level and the importance level may be established in advance And weights, and so on. Furthermore, the identification device may determine the corresponding weight according to the hit frequency and / or the number of hits of each simulator recognition rule. Further optionally, a new hit frequency and / or hit number of each simulator recognition rule in a recent preset time period may be counted according to a preset time interval, and then updated according to the new hit frequency and / or hit number The weight of each rule to further improve the accuracy of the simulator recognition.

Optionally, the recognition device may also set or select multiple simulator recognition rules (that is, the above multiple simulator recognition rules) for simulator recognition according to the hit frequency and / or the number of hits, such as the hit frequency or number of hits. The highest first L (L is an integer greater than 0, such as 6) are used as the rules recognized by the multiple simulators, or the rules whose hit frequency within a preset time period is higher than a preset frequency threshold are used as the multiple The simulator recognition rules, or the rules that the number of hits within a preset time period is higher than the preset number of times as the multiple simulator recognition rules, etc., are not listed here one by one. Therefore, the flexibility and reliability of the simulator setting rules are improved, and the recognition efficiency can be improved.

203: Obtain device information of the target terminal.

Optionally, when performing simulator recognition, the identifying device may obtain multiple device information of the target terminal ’s device, for example, the device information may include one or more of the following: router information of the connected Wi-Fi hotspot (including Router name (or Wi-Fi name) such as Wi-Fi Service Set Identifier (SSID), router MAC address (or Wi-Fi MAC address) such as Wi-Fi Basic Service Set Identifier (BSSID) ), Etc.), model (model and / or brand), CPU manufacturer information, Bluetooth information, sensor information, user trace information such as memory space value, network system used, Android status (or called operating status, such as whether In the root state), system file exception information (such as whether there are system files with a preset path and name), the number of installed applications, the number of stored files, the package name of the connected app, the version number of the connected app, and the SDK Version number, operating system type, operating system version, device unique identification code (UDID), whether it has been jailbroken (such as 1 for jailbroken, 0 for jailbroken), latitude and longitude information, network Type, specify whether the app is installed (such as 1 for installed, 0 for not installed), whether Ali trumpet is installed, whether v8 plugin is installed, current timestamp (such as millisecond precision), advertising identifier, Vendor identifier, Device model, host name, number of CPU cores, CPU type, CPU subtype, screen resolution, total storage space, remaining storage space, time zone, language, power, battery status, operator name, country ISO, boot time, keyboard list , Did is erased or tampered with, did is stored in the localfile, whether the GPS switch is turned on (for example, 0 means off, 1 means on), GPS authorization status, dynamic link library list loaded by the APP, etc., for simulator recognition. Optionally, the application can use Android underlying source API to collect device information, so that the device information cannot be easily tampered with.

Specifically, the recognition device may perform simulator recognition by acquiring multiple pieces of device information to improve the reliability of recognition. Moreover, the recognition device may use part of the obtained device information item corresponding to the plurality of simulator recognition rules for simulator recognition according to a preset plurality of simulator recognition rules, that is, the acquired device information items are more than The item of equipment information that needs to be used makes it impossible for illegal elements to determine what information to use for simulator identification. This helps prevent illegal elements from tampering with related equipment information after learning a certain identification rule, which makes it impossible to identify the simulator in time. The occurrence of the situation, that is, preventing the identification rules from being cracked, improves the reliability of the simulator identification.

204. Determine, according to a preset plurality of simulator recognition rules and device information of the target terminal, a target recognition rule that the device information of the target terminal hits in the plurality of simulator recognition rules.

The plurality of simulator identification rules may be determined according to device information of a terminal running in the simulator environment in a historical record, and details are not described herein.

205. When there are multiple target recognition rules, calculate the sum of the weights of the target recognition rules according to the preset weights of the simulator recognition rules.

206: Determine whether the sum of the weights is greater than a preset weight threshold.

207. When the sum of the weights is greater than the weight threshold, determine that the target terminal is running in a simulator environment.

Specifically, the recognition device may determine whether the obtained device information hits a plurality of simulator recognition rules set in advance, determine the weight of each rule according to the result of the hit, and identify whether it is a simulator according to the weight of each rule. Wherein, if a rule is hit, the weight of the hit rule is set as a preset weight; if a rule is missed, the weight of the miss rule is taken as 0. That is, the weight of the simulator recognition rule that is the statistical hit, that is, the target recognition rule. Further, a threshold may be set in advance, and if the sum of the weights of the target recognition rules that are cumulatively hit exceeds the threshold, it may be identified as a simulator, that is, the target terminal is determined to be running in a simulator environment.

For example, in some embodiments, the preset multiple simulator recognition rules are the aforementioned rules 1-12, the preset rules 1 and 2 have a weight of 0.4, the rules 3 and 4 have a weight of 0.35, and the rule The weight of 5 is 0.3, the weights of rules 6, 7, 8, 9, 10 are 0.25, the weight of rule 11 is 0.2, the weight of rule 12 is 0.1, and the preset weight threshold is 1. The obtained device information includes the name and MAC address of the Wi-Fi hotspot router connected to the target terminal, the model, brand, CPU manufacturer's identification of the target terminal, module configuration information, memory space value, and the first number of installed applications. , The second number of stored files, the network system used, operating status, and other information. Then the identification device can detect whether the router name in the device information is the same as the router name in the first blacklist, and whether the MAC address in the device information is in the MAC address set in the second blacklist, and the Whether the model in the device information is the same as any terminal model in the third blacklist, and whether the brand in the device information is the same as any terminal brand in the fourth blacklist, and the production of the CPU in the device information Whether the vendor identification is different from all the manufacturer identifications in the whitelist, and whether the module configuration information in the device information indicates that the target terminal is configured with a preset module, and whether the memory space value in the device information is less than the preset A memory threshold, and whether the first number of installed applications in the device information is less than the first number threshold, and whether the second number of files stored in the device information is less than a preset second number threshold, and the device Whether the network standard used in the information is different from all the network standards in the preset network standard list. And the system file information in the device information indicates whether a system file with a preset path and name exists, and whether the running status in the device information is root. If the identification device detects that the name of the router is the same as the name of any router in the first blacklist, it determines to hit rule 1. If the identification device detects that the MAC address is in any MAC address set in the second blacklist , Then determine the hit rule 2, if the identification device detects that the model is the same as any terminal model in the third blacklist, then determine the hit rule 3, and so on, which will not be repeated here. Assuming that the identification device determines that the device information of the target terminal hits rules 1, 2, 5, 12, and misses rules 3, 4, 6, 7, 8, 9, 10, and 11, the sum of the weights of the hit rules is 0.4+ 0.4 + 0.3 + 0.1 = 1.2, if 1.2 is greater than the weight threshold value 1, it can be determined that the target terminal is running in the simulator environment. If the sum of the weights of the hit rules is less than 1, it can be determined that the target terminal is not running in the simulator environment, or can be further identified in combination with other information, or the simulator can be identified again after a preset time interval, or according to the weight The size of the sum controls the operation of the terminal part, and so on, which is not limited in this application.

In the embodiment of the present application, the recognition device can generate various simulator recognition rules according to the common characteristics of various types of simulators, and can hit the multiple simulator recognitions based on the device information of the terminal running in the simulator environment in the historical record. The rule's hit frequency and / or number of hits set weights for each simulator recognition rule. When the simulator is identified, it can determine the simulator recognition rule for the device information hit by collecting multiple device information of the target terminal. The sum of the weights of the recognition rules of each simulator and the preset weight threshold to determine whether the target terminal is running in the simulator environment, which improves the flexibility and reliability of the weight setting of the simulator rules, and achieves a combination of multiple Simulator recognition rules to perform simulator recognition, which improves the accuracy of simulator recognition.

Please refer to FIG. 3, which is a schematic flowchart of another simulator identification method according to an embodiment of the present application. Specifically, as shown in FIG. 3, the simulator recognition method may include the following steps:

301. Obtain device information of a target terminal.

For the related description of the obtained device information, reference may be made to the related description of the foregoing embodiment, and details are not described herein.

302. Obtain a flag value of an objective function corresponding to the device information of the target terminal, and determine whether the objective function is hooked according to the flag value.

Optionally, after acquiring the device information, and in accordance with preset simulator identification rules and device information of the target terminal, determine the target identification of the device information of the target terminal that is hit in the multiple simulator identification rules. Before the rule, that is, before the simulator recognition based on the device information, the recognition device can also detect whether the device information used for simulator recognition has been tampered with to ensure that the simulator recognition is based on the real device information. The device information for detecting whether the tampering has been performed may be only the device information corresponding to the plurality of simulator recognition rules, so as to reduce the device overhead.

Specifically, the identification device can identify the tampering behavior by detecting whether a function corresponding to the device information is hooked. The flag value can be used to mark the state of the objective function. The state can refer to a state that has been tampered with, or can refer to a read-write state, a blocking and non-blocking state, an exit process or program state, and / or a change. The status of the content of the file, etc., so that whether the objective function is hooked can be determined according to the flag value. Each function has a corresponding flag. The flag is a variable. When a function is hooked, the flag corresponding to the function will change. Therefore, the identification device can determine whether the function is hooked by detecting whether the flag of the function has changed, that is, whether the device information corresponding to the function has been tampered with. The value of the flag may be stored in a memory corresponding to the objective function.

Optionally, when determining whether the objective function is hooked according to the flag value, the recognition device may compare a character at a preset position in the flag value with a preset fixed character; when the comparison obtains the preset position When the character of is different from the fixed character, it is determined that the objective function is hooked. The number of characters of the character at the preset position is the same as the number of characters of the fixed character, so as to facilitate matching and comparison. That is, the change in the flag may refer to a change in one or more bits of the flag value, and the one or more bits may refer to one or more bits in a preset position of the flag. Therefore, the recognition device can compare one or more bits at the preset position of the obtained flag value with the fixed character when it has not been tampered with. If the one or more bits of the flag value change, that is, one bit of the flag value If one or more bits are different from the fixed character, it indicates that the objective function is hooked, that is, the device information corresponding to the objective function has been tampered with.

For example, for systems with Android versions above 4.4 and below 5.0, some Xposed plugins set a bit at a fixed position of the function's flag value to 1 when a function is hooked; For tampered functions, this bit of the flag value is 0 (the fixed character described above). Therefore, by detecting whether the fixed bit of the flag value of the function is 0, it can be known whether the function is hooked by the Xposed plugin. That is, if the fixed bit of the flag value of the measurement function is not 0, it can indicate that the function is hooked and the function is tampered with.

Optionally, when determining whether the objective function is hooked according to the flag value, the recognition device may also perform a logical operation on the flag value according to a preset logic algorithm to obtain an operation result value; when the operation result value is a positive integer When it is determined, the objective function is hooked. The logic algorithm may be determined according to a preset character string and a jump address when a native function in the system is executed. That is to say, the value processed by the flag can also be compared with a fixed character such as 0 when it has not been tampered with according to a preset logic algorithm. If the value after processing changes, it is not 0, such as a positive value. An integer indicates that the function is hooked.

For example, for systems with Android version 5.0 and above, if the result of a logical algorithm such as the logical expression EntryPointFromJni && AccessFlags & 0x10000000 is equal to a positive integer, the function can be tampered with; if the result of the logical calculation is equal to 0 (that is, a fixed character), Indicates that the function has not been tampered with. The EntryPointFromJni may refer to a jump address when a native function such as a native function is executed, and AccessFlags is the above-mentioned flag.

Further optionally, before determining whether the objective function is hooked according to the flag value, the identification device may determine a system version used by the target terminal target, and then select the target terminal to determine the target based on the flag value according to the system version of the target terminal. Whether the function is hooked to improve the efficiency of hook detection. The correspondence between the system version and the way of hook detection can be set in advance.

303. When it is determined that the objective function is hooked, obtain an objective function pointer corresponding to the objective function from the memory of the objective function.

Among them, the function pointer and the hooked function are stored in different fields in the same block of memory, and there is a mapping relationship between different function pointers and the original function, or a mapping relationship between different function pointers and the storage address of the original function.

Optionally, after the target function is determined to be hooked, the hooked target function may also be restored, so as to determine the real device information corresponding to the target function. Specifically, after determining that a function such as the objective function is hooked, a function pointer corresponding to the objective function can be quickly obtained from its memory, that is, the objective function pointer described above, so as to determine the objective function according to the objective function pointer. Corresponding primitive functions, such as native APIs, are real functions that have not been hooked.

304: Determine the original function corresponding to the target function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and determine the original device information according to the original function.

After the target function pointer in the memory corresponding to the target function is determined, the original function corresponding to the target function pointer can be further determined, that is, the actual Method. Furthermore, the original function can be used to replace the objective function to achieve the reduction of the hooked function. Therefore, the identification device can determine the real device information corresponding to the target terminal through the original function, and perform simulator identification based on the real device information. That is, the embodiment of the present application can obtain the real time information when the device information is detected to be tampered with. Device identification based on real device information, thereby improving the accuracy and reliability of simulator identification.

For example, assuming that the device information includes the name and MAC address of the router, if the function corresponding to the name of the router is detected to be hooked, the real original router name can be restored; if the function corresponding to the MAC address is detected to be hooked , The real original MAC address can be restored, and the simulator can be identified based on the name and MAC address of the real original router.

It should be understood that the original function pointer stored in the memory will not be tampered with. According to the working principle of the Xposed plugin, before tampering with the target function, the original information of the function will be backed up and stored at a specific address in memory, that is, The address to which the objective function pointer points. Once these backup information has also been tampered with, the Xposed plugin will not work properly. Therefore, the original function obtained at the specific address pointed by the target function pointer must be the correct function, and it cannot be tampered with.

305: Determine a target recognition rule that the original device information hits in the plurality of simulator recognition rules according to a preset plurality of simulator recognition rules and the original device information.

306. Identify whether the target terminal is running in a simulator environment according to a preset weight and a weight threshold of the target recognition rule.

After the real original device information is determined, it can be determined whether the original device information hits the corresponding simulator recognition rule, and then the simulator recognition is performed according to the hit result. The recognition method is the same as the above based on the device information and preset multiple simulations. The simulator rules are similar to the simulator identification method. For details, please refer to the descriptions of steps 102-103 in the embodiment shown in FIG. 1 and steps 205-207 in the embodiment shown in FIG. 2, and details are not described herein.

Optionally, if it is determined that the target terminal is running in the simulator environment, the identification device may generate alarm information for risk control. For example, the alarm information may include one or more of a risk level, user information, and malicious behavior of the device. The risk level can be determined according to the target risk control scenario of the terminal, and the corresponding relationship between different risk control scenarios and risk levels can be specifically set in advance; or the risk level can be determined according to the application that the terminal target runs, and can be specifically determined in advance. Correspondence between different applications and risk levels can be obtained by setting; or, the risk level can also be determined according to the number of hooked functions of the terminal, and specific correspondences between different numbers of hooks and risk levels can be set in advance; or, It can be determined according to the priority of the tampered device information of the terminal. Specifically, the priority of different device information can be set in advance, and the corresponding relationship between each priority and risk level, etc., is not limited in this application. For example, the risk level can be classified as high-risk, medium-risk, low-risk, or first-, second-, third-, and so on. The user information may include a user identification (UID), a mobile phone number, an ID number (if collected during registration of an application), and the like. The malicious behavior may include tampering with the MAC address, tampering with the CPU manufacturer, tampering with the model and brand of the mobile phone, tampering with the mobile phone number, etc., which can be specifically determined through the aforementioned hook detection.

In addition, optionally, the identification device may also issue an instruction to the target terminal according to the alarm information to control operations on the target terminal (such as an APP client running on the terminal). For example, if the identification device determines that the risk level is low-risk, the identification device may issue an instruction to instruct the client to output a prompt to require the user to enter verification information. The verification method includes, but is not limited to, a short message verification code, a picture verification code, and the like. If the verification fails, no further operation is possible. As another example, if the identification device determines that the risk level is medium risk, the identification device may issue an instruction instructing the client to prohibit the user from requesting access in the target risk control scenario (such as logging in, receiving red envelopes, redeeming coupons, spending, transferring money, etc.) operating. For another example, if the identification device determines that the risk level is high, the identification device may issue an instruction to instruct the client to prohibit the user from requesting all access operations, etc., which are not listed here one by one.

For example, for some mobile games, using the simulator can obtain stronger performance than a mobile phone (actually a game cheating). This application can identify whether the game application is running in the simulator environment through the above identification method, and can timely Discover the behavior of the game running in the simulator, which can stop the behavior and prevent the loss of cheating to the user.

As another example, the risk control strategy of a small loan launched by a financial institution is to allow only users in specific areas, such as the user of Beishangguang. Illegal users may use simulators to modify GPS positioning to bypass the risk control strategy and deceive them. loan. Therefore, the present application can identify whether the device is running in the simulator environment through the above identification method, and reject the user's loan request after determining that the device is running in the simulator environment. Further, this application can also restore the GPS positioning by using the above-mentioned hook detection method to obtain the user's true positioning information.

For another example, illegal persons set up information such as the phone model, brand, and manufacturer in the simulator to achieve the purpose of one simulator software to simulate multiple different Android phones, thereby creating fake identity to cheat preferential activities, registration rewards, and so on. Through this application, after the information of the mobile phone model, brand, and manufacturer has been tampered with according to the above-mentioned hook detection method, the real mobile phone model, brand, and manufacturer and other information can be restored and the simulator can be identified, so as to identify whether the device operation is timely. When running in the simulator environment, and when it is recognized that it is running in the simulator environment, it can stop the behavior in time and avoid causing losses to legitimate users.

In the embodiment of the present application, the identification device can identify whether the terminal is running in the simulator environment according to a plurality of simulator identification rules that are set and collected terminal device information, and according to the simulator identification rules that the terminal device information hits, so as to implement It combines simulator recognition rules to perform simulator recognition, which improves the accuracy of simulator recognition. In addition, before identifying whether the device is an emulator according to the device information, it is possible to identify the device information by tampering and restore the real device information in time to detect the tampering, so as to identify the simulator based on the real device information. The accuracy of the simulator recognition is further improved.

The foregoing method embodiments are examples of the simulator identification method of the present application, and the description of each embodiment has its own emphasis. For a part that is not described in detail in an embodiment, reference may be made to related descriptions in other embodiments.

Please refer to FIG. 4, which is a schematic structural diagram of an identification device according to an embodiment of the present application. The recognition device in the embodiment of the present application includes a unit for executing the above-mentioned simulator recognition method. Specifically, the identification device 400 in this embodiment may include: an obtaining unit 401 and a processing unit 402. among them,

The obtaining unit 401 is configured to obtain device information of a target terminal, where the device information includes information about a model of the target terminal, a manufacturer identifier of a central processing unit CPU, a memory space value, a first number of installed applications, storage Any one or more of the second number of files, the network system used, the operating status, and the router information of the connected Wi-Fi hotspot;

The processing unit 402 is configured to determine a target recognition rule that the device information of the target terminal hits in the multiple simulator recognition rules according to a preset plurality of simulator recognition rules and the device information of the target terminal. The plurality of simulator identification rules are determined according to device information of a terminal running in the simulator environment in a historical record;

The processing unit 402 is further configured to identify whether the target terminal is running in a simulator environment according to a preset weight and a weight threshold of the target recognition rule.

Optionally, the processing unit 402 is specifically configured to calculate the sum of the weights of the target recognition rules according to the preset weights of the simulator recognition rules when there are multiple target recognition rules that are hit; Determining whether the sum of the weights is greater than a preset weight threshold; when the sum of the weights is greater than the weight threshold, determining that the target terminal is running in a simulator environment.

Optionally, the identification device further includes: a weight setting unit 403;

The weight setting unit 403 is configured to separately count the device information of the terminal running in the simulator environment in the historical record and hit the hit information of the plurality of simulator recognition rules; determine each simulation according to the hit information corresponding to each simulator recognition rule. The device identifies the weights corresponding to the rules.

Wherein, the hit information includes a hit frequency and / or the number of hits, a weight corresponding to each simulator recognition rule is proportional to a hit frequency corresponding to the simulator recognition rule, and / or a weight corresponding to each simulator recognition rule It is proportional to the number of hits corresponding to the simulator recognition rule.

Optionally, the model information includes a model and / or brand of the target terminal, the router information includes a router name and / or a media access control MAC address, and the plurality of simulator identification rules includes at least two of the following item:

The name of the router of the Wi-Fi hotspot to which the terminal to be identified is the same as the name of the router in the preset first blacklist;

The MAC address of the router of the Wi-Fi hotspot connected to the terminal to be identified is a set of MAC addresses in a preset second blacklist;

The type of the terminal to be identified is the same as any terminal type in the preset third blacklist;

The brand of the terminal to be identified is the same as any terminal brand in the preset fourth blacklist;

The manufacturer identification of the central processing unit CPU of the terminal to be identified is different from all the manufacturer identifications in the preset white list;

The terminal to be identified is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor;

A memory space value of the terminal to be identified is less than a preset memory threshold;

The first number of applications installed by the terminal to be identified is less than a preset first number threshold;

The second number of files stored by the terminal to be identified is less than a preset second number threshold;

The network standard used by the terminal to be identified is different from all the network standards in the preset network standard list;

A system file of a preset path and name exists in the system of the terminal to be identified;

The running state of the terminal to be identified is the root state.

Optionally, the identification device further includes: a hook detection unit 404 and a reduction unit 405;

The obtaining unit 401 is further configured to obtain a flag value of an objective function corresponding to the device information of the target terminal;

a hook detection unit 404, configured to determine whether the objective function is hooked according to the flag value;

The obtaining unit 401 is further configured to obtain an objective function pointer corresponding to the objective function from the memory of the objective function when it is determined that the objective function is hooked;

A restoration unit 405, configured to determine an original function corresponding to the target function pointer according to a corresponding relationship between function pointers and functions stored in advance, and determine original device information according to the original function;

The processing unit 402 is specifically configured to determine a target recognition rule that the original device information hits in the plurality of simulator recognition rules according to a preset plurality of simulator recognition rules and the original device information.

Optionally, the hook detection unit 404 is specifically configured to compare a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as that of the character at the preset position. The number of characters of the fixed character is the same; when the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.

Optionally, the hook detection unit 404 is specifically configured to perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is based on a preset character string and the system. The jump address when the native function is executed is determined; when the value of the operation result is a positive integer, it is determined that the target function is hooked.

Specifically, the recognition device may implement some or all steps in the simulator recognition method in the embodiments shown in FIG. 1 to FIG. 3 by using the foregoing units. It should be understood that the embodiments of the present application are device embodiments corresponding to the method embodiments, and the description of the method embodiments is also applicable to the embodiments of the present application.

Please refer to FIG. 5, which is a schematic structural diagram of another identification device according to an embodiment of the present application. The identification device is used to perform the method described above. As shown in FIG. 5, the identification device 500 in this embodiment may include: one or more processors 501 and a memory 502. Optionally, the identification device may further include one or more user interfaces 503, and / or, one or more communication interfaces 504. The processor 501, the user interface 503, the communication interface 504, and the memory 502 may be connected through a bus 505, or may be connected through other methods. FIG. 5 illustrates the examples by using a bus method. The memory 502 is configured to store a computer program, where the computer program includes program instructions, and the processor 501 is configured to execute the program instructions stored in the memory 502.

The processor 501 may be used to call the program instructions to perform the following steps: obtaining device information of the target terminal, where the device information includes information about a model of the target terminal, a manufacturer identifier of the central processing unit CPU, and a memory space value Any one or more of the first number of installed applications, the second number of stored files, the network system used, the operating status, and the router information of the connected Wi-Fi hotspot; according to the preset A plurality of simulator recognition rules and device information of the target terminal, and determine a target recognition rule that the device information of the target terminal hits in the plurality of simulator recognition rules, wherein the plurality of simulator recognition rules are based on It is determined from the device information of the terminal running in the simulator environment in the historical record; according to the preset weight and weight threshold of the target recognition rule, identifying whether the target terminal is running in the simulator environment.

Optionally, the processor 501 invokes the program instruction to execute the weight and weight threshold of the target recognition rule according to a preset setting to identify whether the target terminal is running in a simulator environment, and specifically performs the following steps: When there are multiple target recognition rules, the sum of the weights of each of the target recognition rules is calculated according to the preset weights of each simulator recognition rule; determining whether the sum of the weights is greater than a preset weight threshold; when When the sum of the weights is greater than the weight threshold, it is determined that the target terminal is running in a simulator environment.

Optionally, the processor 501 is further configured to call the program instructions to perform the following steps: respectively counting device information of a terminal running in the simulator environment in the history record to hit the hit information of the plurality of simulator recognition rules, and the hit The information includes the hit frequency and / or the number of hits; the weight corresponding to each simulator recognition rule is determined according to the hit information corresponding to each simulator recognition rule; wherein the weight corresponding to each simulator recognition rule and the hit corresponding to the simulator recognition rule The frequency is directly proportional, and / or, the weight corresponding to each simulator recognition rule is directly proportional to the number of hits corresponding to the simulator recognition rule.

Optionally, the model information includes a model and / or brand of the target terminal, the router information includes a router name and / or a media access control MAC address, and the plurality of simulator identification rules includes at least two of the following Item: The name of the router of the Wi-Fi hotspot connected to the terminal to be identified is the same as the router name in the preset first blacklist; the MAC address of the router of the Wi-Fi hotspot connected to the terminal to be identified is in the preset first The set of MAC addresses in the second blacklist; the model of the terminal to be identified is the same as any terminal model in the preset third blacklist; the brand of the terminal to be identified is the same as any of the terminals in the preset blacklist A terminal brand is the same; the manufacturer identification of the central processing unit CPU of the terminal to be identified is different from all the manufacturer identifications in the preset whitelist; the preset module is not configured in the terminal to be identified, and The preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; a memory space value of the terminal to be identified is less than a preset memory threshold; The first number used is less than a preset first number threshold; the second number of files stored by the terminal to be identified is less than a preset second number threshold; the network standard used by the terminal to be identified and the preset network standard All network standards in the list are different; a system file with a preset path and name exists in the system of the terminal to be identified; and the running state of the terminal to be identified is the root state.

Optionally, the processor 501 invokes the program instruction to execute the device identification information of the target terminal in the multiple simulators according to a preset preset simulator identification rule and device information of the target terminal. Before the target identification rule hit by the identification rule, the following steps are further performed: obtaining a flag value of the target function corresponding to the device information of the target terminal, and determining whether the target function is hooked according to the flag value; when determining the target When the function is hooked, obtain an objective function pointer corresponding to the objective function from the memory of the objective function; determine the original function corresponding to the objective function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and Determining original device information according to the original function;

The processor 501 invokes the program instruction to execute the target of the device information of the target terminal that is hit by the plurality of simulator recognition rules according to a preset plurality of simulator recognition rules and the device information of the target terminal. When recognizing the rules, the following steps are specifically performed: according to a plurality of simulator recognition rules set in advance and the original device information, a target recognition rule that the original device information hits in the plurality of simulator recognition rules is determined.

Optionally, when the processor 501 calls the program instruction to execute the determination of whether the objective function is hooked according to the flag value, the processor 501 specifically executes the following steps: the character at a preset position in the flag value and The preset fixed characters are compared, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character; when the comparison obtains that the character at the preset position is different from the fixed character, the determined The objective function is hooked.

Optionally, when the processor 501 invokes the program instruction to execute the determining whether the objective function is hooked according to the flag value, the processor 501 specifically performs the following steps: performing a logical operation on the flag value according to a preset logic algorithm To obtain an operation result value, wherein the logical algorithm is determined according to a preset character string and a jump address when a native function in the system is executed; when the operation result value is a positive integer, the objective function is determined Was hooked.

The processor 501 may be a central processing unit (CPU), and the processor may also be another general-purpose processor, digital signal processor (DSP), or application specific integrated circuit (Application Specific Integrated). Circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The user interface 503 may include an input device and an output device, the input device may include a touch panel, a microphone, and the like, and the output device may include a display (LCD, etc.), a speaker, and the like.

The communication interface 504 may include a receiver and a transmitter for communicating with other devices.

The memory 502 may include a read-only memory and a random access memory, and provide instructions and data to the processor 501. A part of the memory 502 may further include a non-volatile random access memory. For example, the memory 502 may further store the corresponding relationship between the function pointer and the function, and so on.

In specific implementation, the processor 501 and the like described in the embodiment of the present application may execute the implementation manners described in the method embodiments shown in FIG. 1 to FIG. 3 described above, and may also execute each of the methods described in FIG. 4 of the embodiment of the present application. The implementation of the unit is not repeated here.

An embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program described in the embodiments corresponding to FIG. 1 to FIG. 3 can be implemented. Some or all of the steps in the simulator recognition method may also implement the function of the recognition device in the embodiment shown in FIG. 4 or FIG. 5 of the application, which is not described herein.

An embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute part or all of the steps in the above method.

The computer-readable storage medium may be an internal storage unit of the identification device according to any one of the foregoing embodiments, such as a hard disk or a memory of the identification device. The computer-readable storage medium may also be an external storage device of the identification device, such as a plug-in hard disk, a Smart Media Card (SMC), and a secure digital (SD) device. ) Cards, flash cards, etc.

In the present application, the term "and / or" is merely an association relationship describing an associated object, which means that there can be three kinds of relationships, for example, A and / or B can mean: A exists alone, and A and B exist simultaneously. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship.

In various embodiments of the present application, the size of the sequence numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not deal with the implementation process of the embodiments of the present application. Constitute any limitation.

The above description is only part of the implementation of this application, but the scope of protection of this application is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed in this application. Modifications or replacements, and these modifications or replacements should be covered by the protection scope of this application.

Claims (20)

1. A simulator identification method, which comprises:

   Obtain device information of a target terminal, where the device information includes information about a model of the target terminal, a manufacturer ID of a central processing unit CPU, a memory space value, a first number of installed applications, and a second number of stored files Any one or more of the network system used, operating status, and router information of the connected Wi-Fi hotspot;

   Determining a target recognition rule that the device information of the target terminal hits in the plurality of simulator recognition rules according to a preset plurality of simulator recognition rules and the device information of the target terminal, wherein the plurality of simulators The identification rule is determined based on the device information of the terminal running in the simulator environment in the historical record;

   According to a preset weight and a weight threshold of the target recognition rule, identify whether the target terminal is running in a simulator environment.
2. The method according to claim 1, wherein the identifying whether the target terminal is running in a simulator environment according to a preset weight and a weight threshold of the target recognition rule comprises:

   When there are multiple target recognition rules that are hit, the sum of the weights of the target recognition rules is calculated according to the preset weights of the simulator recognition rules;

   Determining whether the sum of the weights is greater than a preset weight threshold;

   When the sum of the weights is greater than the weight threshold, it is determined that the target terminal is running in a simulator environment.
3. The method according to claim 1, further comprising:

   The device information of the terminal running in the simulator environment in the historical records is respectively matched with the hit information of the plurality of simulator recognition rules, and the hit information includes the hit frequency and / or the number of hits;

   Determine the weight corresponding to each simulator recognition rule according to the hit information corresponding to each simulator recognition rule;

   The weight corresponding to each simulator recognition rule is directly proportional to the hit frequency corresponding to the simulator recognition rule, and / or the weight corresponding to each simulator recognition rule is proportional to the number of hits corresponding to the simulator recognition rule.
4. The method according to any one of claims 1-3, wherein the model information includes a model and / or a brand of the target terminal, and the router information includes a router name and / or a media access control MAC Address; the plurality of simulator recognition rules includes at least two of the following:

   The name of the router of the Wi-Fi hotspot to which the terminal to be identified is the same as the name of the router in the preset first blacklist;

   The MAC address of the router of the Wi-Fi hotspot connected to the terminal to be identified is a set of MAC addresses in a preset second blacklist;

   The type of the terminal to be identified is the same as any terminal type in the preset third blacklist;

   The brand of the terminal to be identified is the same as any terminal brand in the preset fourth blacklist;

   The manufacturer identification of the central processing unit CPU of the terminal to be identified is different from all the manufacturer identifications in the preset white list;

   The terminal to be identified is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor;

   A memory space value of the terminal to be identified is less than a preset memory threshold;

   The first number of applications installed by the terminal to be identified is less than a preset first number threshold;

   The second number of files stored by the terminal to be identified is less than a preset second number threshold;

   The network standard used by the terminal to be identified is different from all the network standards in the preset network standard list;

   A system file of a preset path and name exists in the system of the terminal to be identified;

   The running state of the terminal to be identified is the root state.
5. The method according to claim 1, characterized in that, in the step of determining the device information of the target terminal in the plurality of simulators according to a plurality of preset simulator identification rules and device information of the target terminal, Before the target recognition rule hit by the identification rule, the method further includes:

   Acquiring a flag value of an objective function corresponding to the device information of the target terminal, and determining whether the objective function is hooked according to the flag value;

   When it is determined that the objective function is hooked, obtaining an objective function pointer corresponding to the objective function from the memory of the objective function;

   Determine the original function corresponding to the target function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and determine the original device information according to the original function;

   Determining a target recognition rule that the device information of the target terminal hits in the plurality of simulator recognition rules according to a preset plurality of simulator recognition rules and the device information of the target terminal includes:

   According to a preset plurality of simulator recognition rules and the original device information, a target recognition rule that the original device information hits in the plurality of simulator recognition rules is determined.
6. The method according to claim 5, wherein the determining whether the objective function is hooked according to the flag value comprises:

   Comparing a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character;

   When the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.
7. The method according to claim 5, wherein the determining whether the objective function is hooked according to the flag value comprises:

   Perform logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is determined according to a preset string and a jump address when a native function in the system is executed;

   When the operation result value is a positive integer, it is determined that the objective function is hooked.
8. An identification device, comprising: an obtaining unit and a processing unit;

   The obtaining unit is configured to obtain device information of a target terminal, where the device information includes model information of the target terminal, a manufacturer identifier of a central processing unit CPU, a memory space value, a first number of installed applications, Any one or more of the second number of stored files, the network system used, the operating status, and the router information of the connected wireless fidelity Wi-Fi hotspot;

   The processing unit is configured to determine a target recognition rule that the device information of the target terminal hits in the multiple simulator recognition rules according to a preset plurality of simulator recognition rules and the device information of the target terminal, where The plurality of simulator recognition rules are determined according to device information of a terminal running in the simulator environment in a historical record;

   The processing unit is further configured to identify whether the target terminal is running in a simulator environment according to a preset weight and a weight threshold of the target recognition rule.
9. The identification device according to claim 8, characterized in that:

   The processing unit is specifically configured to calculate a sum of the weights of each of the target recognition rules according to a preset weight of each simulator recognition rule when there are multiple target recognition rules that are hit; and determine the weight of Whether the sum is greater than a preset weight threshold; when the sum of the weights is greater than the weight threshold, determining that the target terminal is running in a simulator environment.
10. The identification device according to claim 8, further comprising: a weight setting unit;

    The weight setting unit is configured to separately count device information of a terminal running in the simulator environment in the historical record and hit the hit information of the plurality of simulator recognition rules; and determine each simulator according to the hit information corresponding to each simulator recognition rule. The weight corresponding to the identification rule;

    Wherein, the hit information includes a hit frequency and / or the number of hits, a weight corresponding to each simulator recognition rule is proportional to a hit frequency corresponding to the simulator recognition rule, and / or a weight corresponding to each simulator recognition rule It is proportional to the number of hits corresponding to the simulator recognition rule.
11. The identification device according to any one of claims 8 to 10, wherein

    The model information includes a model and / or a brand of the target terminal, the router information includes a router name and / or a media access control MAC address, and the plurality of simulator identification rules includes at least two of the following:

    The name of the router of the Wi-Fi hotspot to which the terminal to be identified is the same as the name of the router in the preset first blacklist;

    The MAC address of the router of the Wi-Fi hotspot connected to the terminal to be identified is a set of MAC addresses in a preset second blacklist;

    The type of the terminal to be identified is the same as any terminal type in the preset third blacklist;

    The brand of the terminal to be identified is the same as any terminal brand in the preset fourth blacklist;

    The manufacturer identification of the central processing unit CPU of the terminal to be identified is different from all the manufacturer identifications in the preset white list;

    The terminal to be identified is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor;

    A memory space value of the terminal to be identified is less than a preset memory threshold;

    The first number of applications installed by the terminal to be identified is less than a preset first number threshold;

    The second number of files stored by the terminal to be identified is less than a preset second number threshold;

    The network standard used by the terminal to be identified is different from all the network standards in the preset network standard list;

    A system file of a preset path and name exists in the system of the terminal to be identified;

    The running state of the terminal to be identified is the root state.
12. The identification device according to claim 8, further comprising: a hook detection unit and a reduction unit;

    The acquiring unit is further configured to acquire a flag value of an objective function corresponding to the device information of the target terminal;

    The hook detection unit is configured to determine whether the objective function is hooked according to the flag value;

    The obtaining unit is further configured to obtain an objective function pointer corresponding to the objective function from the memory of the objective function when it is determined that the objective function is hooked;

    The restoration unit is configured to determine an original function corresponding to the target function pointer according to a corresponding relationship between function pointers and functions stored in advance, and determine original device information according to the original function;

    The processing unit is specifically configured to determine a target recognition rule that the original device information hits in the plurality of simulator recognition rules according to a preset plurality of simulator recognition rules and the original device information.
13. The identification device according to claim 12, characterized in that:

    The hook detection unit is specifically configured to compare a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position and the number of characters of the fixed character The same; when the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.
14. The identification device according to claim 12, characterized in that:

    The hook detection unit is specifically configured to perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is executed according to a preset string and a native function in the system. The jump address is determined; when the value of the operation result is a positive integer, it is determined that the objective function is hooked.
15. An identification device, comprising a processor and a memory, wherein the processor and the memory are connected to each other, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to use When calling the program instruction, the following steps are performed:

    Obtain device information of a target terminal, where the device information includes information about a model of the target terminal, a manufacturer ID of a central processing unit CPU, a memory space value, a first number of installed applications, and a second number of stored files Any one or more of the network standard, operating status, and router information of the connected wireless fidelity Wi-Fi hotspot; determined according to a plurality of preset emulator identification rules and device information of the target terminal The target recognition rule of device information of the target terminal hit in the plurality of simulator recognition rules, wherein the plurality of simulator recognition rules are determined according to the device information of the terminal running in the simulator environment in the historical record Identifying whether the target terminal is running in a simulator environment according to a preset weight and a weight threshold of the target recognition rule.
16. The identification device according to claim 15, wherein the processor invokes the program instruction to execute the weight and weight threshold of the target recognition rule set in advance to identify whether the target terminal is running in a simulation Environment, perform the following steps:

    When there are a plurality of target recognition rules that are hit, a sum of the weights of each of the target recognition rules is calculated according to a preset weight of each simulator recognition rule; it is determined whether the sum of the weights is greater than a preset weight threshold ; When the sum of the weights is greater than the weight threshold, determining that the target terminal is running in a simulator environment.
17. The identification device according to claim 15, wherein the processor is further configured to call the program instruction to perform the following steps:

    The device information of the terminal running in the simulator environment in the historical record is separately counted for the hit information of the plurality of simulator recognition rules, and the hit information includes the hit frequency and / or the number of hits; according to the hits corresponding to each simulator recognition rule The information determines the weight corresponding to each simulator recognition rule; wherein the weight corresponding to each simulator recognition rule is directly proportional to the hit frequency corresponding to the simulator recognition rule, and / or, the weight corresponding to each simulator recognition rule and the The number of hits corresponding to the simulator recognition rule is directly proportional.
18. The identification device according to any one of claims 15-17, wherein the model information includes a model and / or a brand of the target terminal, and the router information includes a router name and / or media access control MAC address; the plurality of simulator recognition rules include at least two of the following: the name of the router of the Wi-Fi hotspot connected to the terminal to be identified is the same as the router name in the preset first blacklist; the terminal to be identified is connected The MAC address of the router of the Wi-Fi hotspot is in the preset MAC address set in the second blacklist; the model of the terminal to be identified is the same as any terminal model in the preset third blacklist; The brand of the identification terminal is the same as any terminal brand in the preset fourth blacklist; the manufacturer identification of the central processing unit CPU of the terminal to be identified is different from all the manufacturer identifications in the preset whitelist; There is no preset module configured in the terminal to be identified, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; the memory of the terminal to be identified is empty The value is less than a preset memory threshold; the first number of applications installed by the terminal to be identified is less than the preset first number threshold; the second number of files stored by the terminal to be identified is less than the preset second number threshold; The network standard used by the terminal to be identified is different from all the network standards in the preset network standard list; there is a system file with a preset path and name in the system of the terminal to be identified; and the operating status of the terminal to be identified It is root.
19. The identification device according to claim 15, wherein the processor determines the target by invoking the program instruction to execute the program according to multiple preset simulator identification rules and device information of the target terminal. Before the device information of the terminal hits the target recognition rule hit by the plurality of simulator recognition rules, the following steps are further performed:

    Obtain a flag value of an objective function corresponding to the device information of the target terminal, and determine whether the objective function is hooked according to the flag value; when it is determined that the objective function is hooked, obtain it from the memory of the objective function An objective function pointer corresponding to the objective function; determining an original function corresponding to the objective function pointer according to a corresponding relationship between each function pointer and a function stored in advance, and determining original equipment information according to the original function;

    Calling, by the processor, the program instructions to execute, according to a preset preset simulator identification rules and device information of the target terminal, determining that the device information of the target terminal hits in the multiple simulator identification rules When identifying a rule, perform the following steps:

    According to a preset plurality of simulator recognition rules and the original device information, a target recognition rule that the original device information hits in the plurality of simulator recognition rules is determined.
20. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of 1-7 is required.

Images