Abnormal Channel Identification Method, Device, Storage Medium and Equipment

Abstract

The present invention discloses a method, device, storage medium and equipment for identifying abnormal channels. Among them, the method includes: obtaining a device fingerprint set corresponding to each channel, and each device fingerprint set includes fingerprint data of at least two target devices; determining a channel index of each device fingerprint set according to the device fingerprint when each target device loads a target application; determining the retention rate of each device fingerprint set according to the loading time when each target device loads the target application each time; and then identifying abnormal channels according to the channel index and retention rate of the device fingerprint set corresponding to each channel. The abnormal channel identification method of the present invention integrates the attribute characteristics and behavior characteristics of device fingerprints, and can improve the accuracy of identifying abnormal channels by performing data calculations on the data corresponding to different channels.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular, to a method, device, storage medium, and equipment for identifying abnormal channels. Background Art

[0002] In order to increase the number of users of application software (app, an abbreviation of Application), app manufacturers will isolate users to download and register the app through many promotion channels. Promotion channels mainly include official channels, free external channels, and paid channels, etc. The operation methods and value spaces of different channels are different. Most of these channels are paid channels, that is, a certain fee needs to be paid to the promoter for successfully converting a user. Therefore, some black industries are committed to defrauding the promotion fees of app payment manufacturers through false promotion and conversion. For example, black industries can use virtual Android machines or flashing software to forge new users to download and register the app. In order to crack down on these promotion channels related to black industries, it is necessary to identify low-quality promotion channels and reduce or stop the cost investment in these low-quality promotion channels. Summary of the Invention

[0003] Embodiments of the present invention provide a method, device, storage medium, and equipment for identifying abnormal channels, which can improve the accuracy of identifying abnormal channels.

[0004] According to one aspect of the embodiments of the present invention, a method for identifying abnormal channels is provided, including:

[0005] Obtaining a device fingerprint set corresponding to each channel, where the device fingerprint set includes fingerprint data of at least two target devices, and the fingerprint data includes the device fingerprint and loading time of each target device when loading a target application;

[0006] Determining a channel index for each device fingerprint set according to the device fingerprint of each target device when loading the target application, where the channel index is used to characterize the abnormal degree of the target device in the device fingerprint set when loading the target application;

[0007] Determining the retention rate of each device fingerprint set according to the loading time of each target device when loading the target application each time; the retention rate is used to characterize the active degree of the target device in the device fingerprint set accessing the target application;

[0008] Identifying abnormal channels according to the channel index and the retention rate of the device fingerprint set corresponding to each channel.

[0009] According to another aspect of the embodiments of the present invention, an apparatus for identifying abnormal channels is further provided, including:

[0010] The device fingerprint set acquisition unit is configured to acquire the device fingerprint sets corresponding to each channel, where the device fingerprint set includes fingerprint data of at least two target devices, and the fingerprint data includes the device fingerprint and the loading time of each target device when loading the target application each time;

[0011] The channel metric determination unit is configured to determine the channel metric of each device fingerprint set according to the device fingerprint of each target device when loading the target application, and the channel metric is used to characterize the abnormality degree of the target device in the device fingerprint set when loading the target application;

[0012] The retention rate determination unit is configured to determine the retention rate of each device fingerprint set according to the loading time of each target device when loading the target application each time; the retention rate is used to characterize the activity degree of the target device in the device fingerprint set accessing the target application;

[0013] The abnormal channel identification unit is configured to perform abnormal channel identification according to the channel metric and the retention rate of the device fingerprint set corresponding to each channel.

[0014] According to another aspect of the embodiments of the present invention, there is also provided a computer-readable storage medium, in which at least one instruction or at least one program segment is stored, and the at least one instruction or at least one program segment is loaded and executed by a processor to implement the above abnormal channel identification method.

[0015] According to another aspect of the embodiments of the present invention, there is also provided a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor is caused to execute the above abnormal channel identification method.

[0016] In the embodiments of the present invention, the device fingerprint sets corresponding to each channel are acquired, and each device fingerprint set includes fingerprint data of at least two target devices; according to the device fingerprint of each target device when loading the target application, the channel metric of each device fingerprint set is determined; according to the loading time of each target device when loading the target application each time, the retention rate of each device fingerprint set is determined; and then, according to the channel metric and the retention rate of the device fingerprint set corresponding to each channel, abnormal channel identification is performed. The present invention combines multiple channel quality evaluation methods. Among them, the channel metric analyzes the channel based on the attribute characteristics of the device fingerprint, and the retention rate analyzes the channel through the behavioral attributes of users. The combination of the two can integrate the attribute characteristics and behavioral characteristics of the device fingerprint at the same time, improving the accuracy of identifying abnormal channels. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings described herein are used to provide a further understanding of the present invention and form a part of this application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0018] Figure 1 is a schematic diagram of the hardware environment of the abnormal channel identification method according to an embodiment of the present invention;

[0019] Figure 2 is a data sharing system according to an embodiment of the present invention;

[0020] Figure 3 is a system architecture diagram of an optional abnormal channel identification solution according to an embodiment of the present invention;

[0021] Figure 4 is a flowchart of an optional abnormal channel identification method according to an embodiment of the present invention;

[0022] Figure 5 is a flowchart of an optional method for determining the first channel metric according to an embodiment of the present invention;

[0023] Figure 6 is a flowchart of an optional method for determining the second channel metric according to an embodiment of the present invention;

[0024] Figure 7 is a flowchart of an optional method for determining the retention rate according to an embodiment of the present invention;

[0025] Figure 8 is a schematic diagram of an optional abnormal channel identification device according to an embodiment of the present invention;

[0026] Figure 9 is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed implementation manners

[0027] In order to enable those skilled in the art of this technology to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the description, claims and above-mentioned drawings of the present invention are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention described here can be implemented in an order other than those illustrated or described here. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units does not necessarily limit to those clearly listed steps or units, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0029] According to an embodiment of the present invention, an embodiment of an abnormal channel identification method is provided.

[0030] Optionally, in this embodiment, the above abnormal channel identification method can be applied to a hardware environment composed of a collection client 01 and a server 03 as Figure 1 shown. As Figure 1 shown, this hardware environment includes: a client 01 and a server 03.

[0031] The server 03 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The client 01 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The client 01 and the server 03 can be directly or indirectly connected through wired or wireless communication methods, and this application does not make any restrictions here.

[0032] The client 01 is installed with a target application, and a fingerprint acquisition module is implanted in the target application. The fingerprint acquisition module can acquire the fingerprint data of the client each time the target application is loaded on the client. The fingerprint data includes a channel identifier, the device fingerprint and the loading time each time the client 01 loads the target application. The acquired fingerprint data is sent to the server 03 through the client 01. The server 03 receives the fingerprint data from different clients, aggregates the fingerprint data with the same channel identifier into a device fingerprint set according to the channel identifier in the fingerprint data, determines the channel index of each device fingerprint set according to the device fingerprint when each client loads the target application, determines the retention rate of each device fingerprint set according to the loading time each time each client loads the target application, and performs abnormal channel identification according to the channel index and retention rate of the device fingerprint set corresponding to each channel.

[0033] The abnormal channel identification method according to an embodiment of the present invention can be executed by the server 03. The fingerprint data obtained by the fingerprint acquisition module can be stored in the cloud.

[0034] Cloud storage is a new concept extended and developed from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as a storage system) refers to a storage system that combines a large number of different types of storage devices (storage devices are also called storage nodes) in the network through cluster applications, grid technologies, and distributed file systems, and works together through application software or application interfaces to jointly provide data storage and service access functions to the outside world.

[0035] Currently, the storage method of the storage system is as follows: create a logical volume. When creating a logical volume, physical storage space is allocated for each logical volume. This physical storage space may be composed of disks of a certain storage device or several storage devices. The client stores data on a certain logical volume, that is, stores the data on the file system. The file system divides the data into many parts, each part is an object. The object not only contains data but also contains additional information such as a data identifier (ID, ID entity). The file system writes each object into the physical storage space of the logical volume respectively, and the file system will record the storage location information of each object. Thus, when the client requests to access data, the file system can enable the client to access the data according to the storage location information of each object.

[0036] The process of the storage system allocating physical storage space for a logical volume is specifically as follows: according to the capacity estimation of the objects stored in the logical volume (this estimation often has a large margin relative to the capacity of the objects to be actually stored) and the group of a redundant array of independent disks (RAID), the physical storage space is pre-divided into stripes. A logical volume can be understood as a stripe, so as to allocate physical storage space for the logical volume.

[0037] Fingerprint data can also be processed through cloud computing to improve the efficiency of identifying abnormal channels. Cloud computing refers to the delivery and use model of IT infrastructure, which means obtaining the required resources in a on-demand and easily scalable manner through the network; in a broad sense, cloud computing refers to the delivery and use model of services, which means obtaining the required services in a on-demand and easily scalable manner through the network. Such services can be related to IT and software, the Internet, or other services. Cloud computing is the product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balance.

[0038] With the development of the Internet, real-time data streams, and the diversification of connected devices, as well as the promotion of demands such as search services, social networks, mobile commerce, and open collaboration, cloud computing has developed rapidly. Different from the previous parallel distributed computing, the emergence of cloud computing will, in concept, drive a revolutionary change in the entire Internet model and enterprise management model.

[0039] In a feasible implementation manner, the server involved in the hardware environment of the abnormal channel identification method according to the embodiment of the present invention can be a data sharing system formed by connecting multiple nodes (any form of computing device connected to the network, such as a server or a client) through network communication.

[0040] See Figure 2 The data sharing system shown. The data sharing system 400 refers to a system used for data sharing between nodes. The data sharing system may include multiple nodes 101, and the multiple nodes 101 may refer to each client in the data sharing system. Each node 101 can receive input information during normal operation and maintain the shared data in the data sharing system based on the received input information. To ensure information interconnection within the data sharing system, there may be information connections between each node in the data sharing system, and nodes can transmit information through the above information connections. For example, when any node in the data sharing system receives input information, other nodes in the data sharing system obtain the input information according to the consensus algorithm and store the input information as data in the shared data, so that the data stored on all nodes in the data sharing system is consistent.

[0041] For each node in the data sharing system, there is a corresponding node identifier, and each node in the data sharing system can store the node identifiers of other nodes in the data sharing system, so that the generated blocks can be broadcast to other nodes in the data sharing system according to the node identifiers of other nodes later. A node identifier list as shown in the following table can be maintained in each node, and the node name and node identifier are stored in the node identifier list correspondingly. Among them, the node identifier can be an IP (Internet Protocol) address and any other information that can be used to identify the node.

[0042] Of course, the method provided by the embodiments of the present invention is not limited to Figure 1 the application scenarios shown, and can also be used in other possible application scenarios, which are not restricted by the embodiments of this application. For Figure 1 the functions that can be achieved by each device in the hardware environment shown will be described together in the subsequent method embodiments, and will not be elaborated here too much.

[0043] In the related art, to identify low-quality app promotion channels, most of them directly identify cheating promotion channels, that is, directly distinguish whether the channel is a normal channel or a cheating channel. At first, the method of rule matching was adopted. This method is simple and easy to understand, but the anti-cheating effect is not ideal, the coverage is low, and it is easy to be bypassed by the black industry. Later, someone proposed a method of directly determining whether the device is abnormal by using classification based on device fingerprints. However, using the method of supervised learning cannot guarantee that the training data can be labeled correctly. Even if some cases are labeled, the generalization of the samples cannot be guaranteed, because there will be some samples that cannot be covered, and the results of the classification task are only two types: 0 and 1, and its score value cannot fully represent the size of the possibility, and the quality of the channel cannot be ranked. Some people also proposed to use some other attributes, such as counting the number of devices in the same IP segment in a certain channel, and those exceeding the threshold are considered cheating; or adding various historical behavior data and attribute data of users as features to judge cheating users and cheating channels, etc. However, judging only from the IP dimension by counting the number of devices in the IP segment, the available information is too little. Identifying cheating channels by combining various user behavior data and attribute data such as payment amount and user identity requires relying on a large amount of external information, and sometimes it is very difficult to collect this information, so it is not applicable to every app.

[0044] In view of the deficiencies of the related art, the embodiments of the present invention provide an abnormal channel identification solution. First, obtain the device fingerprint sets corresponding to different channels, and then use different channel quality detection methods to score the device fingerprint sets corresponding to different channels, and judge whether the channel is a low-quality channel based on the comprehensive scores of different channels.

[0045] Figure 3It is a system architecture diagram of an optional abnormal channel identification solution according to an embodiment of the present invention. As Figure 3 shown, the system mainly consists of four parts: fingerprint acquisition module implantation and fingerprint acquisition, abnormal detection based on device fingerprint, calculation of retention rate, and channel ranking summary and analysis.

[0046] Fingerprint acquisition module implantation and fingerprint acquisition refer to implanting the fingerprint acquisition module into the monitored app. That is, every time a user logs in to the app, the fingerprint acquisition module can collect and report the fingerprint data of the user's current device. After the server obtains the fingerprint data of each device reported by each fingerprint acquisition module, it classifies the fingerprint data of each device to form a set of device fingerprints corresponding to different channels.

[0047] The abnormal detection based on device fingerprint mainly includes several steps: data filtering, feature engineering, abnormal detection model, and channel score calculation. That is, first determine the fingerprint data corresponding to the device, then perform feature processing on the fingerprint data of each device to generate feature vectors, then use the abnormal detection algorithm to detect the abnormal feature vectors, and finally summarize the scores of all abnormal vectors with abnormal values greater than a certain threshold by channel to obtain the total abnormal value score of the channel. Here, in order to broaden the detection dimension, the abnormal detection based on device fingerprint can include abnormal detection based on a single device fingerprint and abnormal detection based on multiple device fingerprints. By selecting different device fingerprint features, the abnormal conditions of the device can be detected from different dimensions.

[0048] Calculating the retention rate mainly calculates the multi-day retention rate of devices in each channel.

[0049] The channel ranking summary and analysis part performs weighted summarization on the calculation results obtained above to obtain the final total channel ranking. Subsequently, the reasons for the low quality of low-quality channels can be investigated and analyzed, such as analyzing the user access volume data at different times.

[0050] Among them, abnormal feature detection is to detect abnormal devices based on the attribute features of device fingerprints and then summarize them to the channel, while the retention rate is to discover the abnormal conditions and degrees of channels based on the time and frequency rules of device fingerprint reporting. The combination of the two can integrate the attribute features and behavior features of device fingerprints at the same time, making the channel quality ranking more accurate.

[0051] Anomaly feature detection uses an unsupervised anomaly detection algorithm to select features that are more likely to represent abnormal situations from all device fingerprint feature data for anomaly detection. It can identify devices with abnormal fingerprint features and obtain the anomaly scores of each device. The anomaly scores of the devices are aggregated to obtain the anomaly score of the channel. That is to say, if the anomaly score of a certain channel is very high, it means that there are more abnormal devices in that channel, and the quality of that channel is lower. This meets the condition that the more abnormal the device fingerprint features are, the greater the possibility that the device is a cheating device. This unsupervised anomaly detection algorithm does not require labeling the training data, which can reduce the error caused by inaccurate label setting. At the same time, since the basic logic of the algorithm is that there are abnormal parts in the device attributes as a whole compared to the normal attributes, it is difficult for black production to bypass the rule check by simply modifying a certain attribute of the device.

[0052] An embodiment of the present invention provides an abnormal channel identification method based on the above inventive concept. Figure 4 It is a flowchart of an optional abnormal channel identification method according to an embodiment of the present invention, as Figure 4 shown. The abnormal channel identification method includes the following steps:

[0053] S401, obtain the device fingerprint set corresponding to each channel. The device fingerprint set includes fingerprint data of at least two target devices. The fingerprint data includes the device fingerprint and the loading time of each target device when loading the target application each time.

[0054] In a feasible implementation manner, obtaining the device fingerprint set corresponding to each channel includes:

[0055] S4011, obtain the fingerprint data of each target device. Among them, the fingerprint data includes the channel identifier and the device fingerprint and the loading time of each target device when loading the target application each time. The channel identifier is used to indicate the channel through which the target device obtains the target application.

[0056] Take the application to be detected as the target application, and the terminal device installed with the target application as the target device. Embed a fingerprint acquisition module in the installation package of the target application. In this way, every time the target device loads the target application, the fingerprint acquisition module can collect the device fingerprint and loading time of the current target device, and report the collected device fingerprint and loading time to the server. At the same time, the device identifier and channel identifier of the target device are also reported to the server. Among them, the device identifier is used to uniquely identify the target device, and the channel identifier is used to indicate the source of the target application in the target device. After receiving the information reported by the fingerprint acquisition module, the server aggregates the device fingerprint, loading time, channel identifier, and device identifier belonging to the same target device under the corresponding target device name according to the device identifier, and obtains the fingerprint data of each target device. Here, the fingerprint data can be regarded as a data set, and each piece of data in the data set corresponds to a loading action of the target application by the target device. For example, if the target application is loaded n (n is an integer greater than or equal to 1) times on the target device A, the fingerprint data of the target device A includes n pieces of data.

[0057] Among them, the device fingerprint obtained by the fingerprint acquisition module specifically includes more than 200 fields. In addition to reporting the device id to identify the device and the channel id to identify the channel, the main features are divided into the following categories, namely ip category, sensor and bluetooth category, system category, cpu architecture category, application app category, battery category, bluetooth category, browser category, signal category, camera category, process category, storage space category, user personal information category, geographical location category, network category, device hardware model category, etc. These device fingerprints have many types and high dimensions, and the coverage rate is mostly above 90%. After feature processing, the characteristic attributes of abnormal cheating devices are very likely to deviate from normal devices.

[0058] S4013, classify the fingerprint data of each target device according to the channel identifier, and obtain candidate device fingerprint sets corresponding to the channels indicated by each channel identifier respectively. Each candidate device fingerprint set includes the fingerprint data of at least two target devices, and all target devices in the same candidate device fingerprint set have the same channel identifier.

[0059] After obtaining the fingerprint data of each target device, the fingerprint data can be classified according to the channel identifier of the fingerprint data, that is, the fingerprint data with the same channel identifier is grouped into the same candidate device fingerprint set. In this way, the channel identifiers of each candidate device fingerprint set are different. Since the channel identifier indicates the source channel of the target application, different candidate device fingerprint sets correspond to different channels. This step classifies the fingerprint data of the target device according to the channel, which is convenient for subsequent analysis of the quality of each channel based on the fingerprint characteristics of the target device.

[0060] Since having too few devices in a certain channel may cause a large error in the channel metrics, it is necessary to filter out channels with too few devices. Therefore, after step S4013, step S4015 may further be included: counting the amount of fingerprint data in each candidate device fingerprint set, and using the candidate device fingerprint sets with the data amount greater than or equal to a preset threshold as the device fingerprint sets. By filtering out the candidate device fingerprint sets with the data amount less than the preset threshold, the device fingerprint sets for channel quality analysis can be obtained, which can improve the accuracy of subsequent channel metric calculations. Among them, the preset threshold generally ranges from several hundred to several thousand.

[0061] S403. Determine the channel metrics of each device fingerprint set according to the device fingerprints when each target device loads the target application. The channel metrics are used to characterize the abnormal degree of the target devices in the device fingerprint set when loading the target application.

[0062] Among them, the channel metrics of each device fingerprint set include a first channel metric and a second channel metric. Step S403 specifically includes: determining the first channel metric of each device fingerprint set according to the device fingerprints when each target device first loads the target application; the first channel metric is used to characterize the abnormal degree of the target devices in the device fingerprint set when installing the target application; determining the second channel metric of each device fingerprint set according to the device fingerprints when each target device first loads the target application within each preset period; the second channel metric is used to characterize the abnormal degree of the target devices in the device fingerprint set when enabling the target application; taking the first channel metric and the second channel metric of each device fingerprint set as the channel metrics of the device fingerprint set.

[0063] Figure 5 is a flowchart of an optional method for determining the first channel metric according to an embodiment of the present invention. Please refer to Figure 5 , this part corresponds to performing anomaly detection on each channel based on a single device fingerprint, and may include:

[0064] S501. Take the device fingerprint when each target device first loads the target application as the first device fingerprint of the target device.

[0065] The device fingerprint when the target device first loads the target application refers to the device fingerprint when the target device installs the target application. Specifically, for the fingerprint data of any target device, the device fingerprint that appears earliest can be found according to the loading time, and it is taken as the device fingerprint when the target device first loads the target application.

[0066] The device fingerprint is only obtained when the target device first loads the target application because it is necessary to identify devices with abnormal device fingerprints among all target devices. Therefore, the weights of each target device must be the same. If the fingerprint data of each target device when it starts the target application is used, the weights of each target device will be different and not comparable.

[0067] S503. Perform feature processing on the first device fingerprint of each target device to obtain the first fingerprint features corresponding to each target device.

[0068] After obtaining the first device fingerprint corresponding to each target device, the next step is to select which features to use for anomaly detection. Since it is necessary to satisfy the assumption that the more abnormal the device fingerprint features are, the greater the possibility that the device is a cheating device, the selected features need to satisfy that they are relatively consistent in distribution under normal circumstances, will show different eigenvalue and eigenvalue combinations under cheating circumstances, and the proportion of such abnormal eigenvalue and eigenvalue combinations is very small.

[0069] Performing feature processing on the first device fingerprint includes: extracting features for anomaly analysis from the first device fingerprint, and processing the extracted features into feature vectors that can be used for calculation.

[0070] In a feasible implementation, all categories of device fingerprint features included in the first device fingerprint are divided into two major categories: dynamic features and static features. Among them, dynamic features refer to features that change with the user's daily behavior, mainly the characteristics of the target device that can change at any time; static features are features that the user will not easily modify, mainly some features of the target device itself. The dynamic features and static features are used as features for anomaly analysis. Further, the dynamic features and static features are processed into feature vectors that can be directly input into the model, mainly by converting these features into strings and integerizing numerical values. Among them, integerizing numerical values means: according to the range in which the numerical value falls, using the corresponding representative character of the range as the integerization result of the numerical value. Exemplarily, the features selected and feature processing in this part are as follows:

[0071] (1) Dynamic features

[0072] Recorded reporting time period: Only keep the hour as the time field, such as 1 o'clock, 2 o'clock, etc.

[0073] Battery temperature: Processed into an integer, for example, divided into segments every 50°C.

[0074] Battery voltage: Processed into an integer, for example, divided into segments every 1000V.

[0075] Screen brightness: Processed into an integer, for example, divided into segments every 50 brightness values.

[0076] Average temperature of multiple CPUs: Rounded and processed as an integer. For example, if a device has 3 CPUs and the average temperature of the three CPUs is 26.7°C, it is rounded to 27°C after processing.

[0077] Average utilization rate of multiple CPUs: Rounded and processed as an integer from 0 to 10. For example, if a device has 3 CPUs and the average utilization rate of the three CPUs is 43%, it is rounded to 4 after processing.

[0078] Available memory capacity: Segmented and processed as an integer. For example, every 0.5G of capacity is divided into a segment.

[0079] Total memory capacity: Segmented and processed as an integer. For example, every 0.5G of capacity is divided into a segment.

[0080] Total number of bytes sent in network communication (including traffic and wifi): Segmented and processed as an integer. Since the size of network communication bytes varies greatly, perhaps by more than ten orders of magnitude, it can be segmented by order of magnitude. For example, the first segment is for 0, the second segment is for the 6th power of 10, the third segment is for the 8th power of 10, etc.

[0081] Total number of bytes received in network communication (including traffic and wifi): Segmented and processed as an integer, segmented by order of magnitude.

[0082] Total number of currently running processes: Processed as an integer.

[0083] Total number of apps: Processed as an integer.

[0084] Number of system apps: Processed as an integer.

[0085] Number of apps installed by users: Processed as an integer.

[0086] Proportion of the number of system apps: Rounded and processed as an integer from 0 to 10. For example, 38% is processed as 4.

[0087] Total size of the sd card: Segmented and processed as an integer. For example, every 0.5G of capacity is divided into a segment.

[0088] Proportion of available space on the sd card: Rounded and processed as an integer from 0 to 10.

[0089] Total size of the memory: Segmented and processed as an integer. For example, every 0.5G of capacity is divided into a segment.

[0090] Proportion of available space in the memory: Rounded and processed as an integer from 0 to 10.

[0091] Total size of the mobile phone hard disk: Segmented and processed as an integer. For example, every 0.5G of capacity is divided into a segment.

[0092] Proportion of available space on the mobile phone hard drive: Rounded and processed as an integer from 0 to 10.

[0093] LTE signal strength value: Segmented and processed as an integer.

[0094] Received signal strength value of neighboring base stations: Segmented and processed as an integer.

[0095] (2) Static features

[0096] Number of sensors: Processed as an integer. Sensors may include acceleration sensors, gravity sensors, gyro sensors, heart rate sensors, light sensors, magnetic field sensors, pressure sensors, proximity sensors, etc.

[0097] Bluetooth version: Processed as a string.

[0098] Browser vendor version: Processed as a string.

[0099] Base station signal strength: Segmented and processed as an integer.

[0100] Motherboard model: Processed as a string.

[0101] Host name: Processed as a string.

[0102] Number of cameras: Processed as an integer.

[0103] CPU architecture: Processed as a string.

[0104] Number of CPU cores: Processed as an integer.

[0105] CPU frequency: Segmented and processed as an integer.

[0106] CPU model: Processed as a string.

[0107] System kernel version: Processed as a string.

[0108] Number of all current network cards: Processed as an integer.

[0109] Operating system version: Processed as a string.

[0110] Screen aspect ratio: Processed as an integer.

[0111] Screen resolution: Processed as an integer.

[0112] For S505, input the first fingerprint feature of each target device into the anomaly detection model, and based on the anomaly detection model, conduct anomaly analysis on the first fingerprint feature of each target device to obtain the first anomaly score of each target device.

[0113] After obtaining the first fingerprint feature of the target device above, an anomaly detection model can be used to detect the anomalous target device. The anomaly detection algorithm can be any one of the Isolation Forest algorithm, One-Class SVM, Elliptic Envelope (anomaly detection based on Gaussian probability density), Isolation Forest (anomaly detection based on ensemble learning method), Local Outlier Factor, etc., or multiple anomaly detection algorithms can be used, and voting or integration can be performed on multiple detection results.

[0114] In a feasible implementation manner, the Isolation Forest algorithm can be used as the anomaly detection model. There are two theoretical bases for the Isolation Forest algorithm, namely, the proportion of abnormal data in the total sample size is very small and the eigenvalue of the abnormal point is very different from that of the normal point. The above first fingerprint feature satisfies the theoretical basis of the Isolation Forest algorithm.

[0115] The principle of the training process of the Isolation Forest algorithm is as follows. First, randomly select n training samples from the training data and input them into an isolation tree. Randomly specify a data dimension for the n samples and randomly generate a split point according to this dimension. The split point divides the n samples into two parts: the left subtree and the right subtree. Continue to randomly specify a dimension for the remaining data dimensions and divide the subtrees. Repeat this process until there is only one data on the leaf node and it can no longer be split, obtaining a single isolation tree. Use the same method to obtain m isolation trees, that is, randomly select n samples as the root node and repeatedly build a tree starting from the root node of the tree. These trees together form an isolation forest, and the final result needs to be generated by integrating the results of all trees. The anomaly degree of the sample is determined by the path length from the root node to the leaf node. Because abnormal points with sparse distributions usually only need to be split a few times to be divided, their path lengths are usually small. If the final anomaly score of the sample is close to 1, it must be an abnormal point. If it is much less than 0.5, it must not be an abnormal point.

[0116] The isolation forest model mainly has three hyperparameters that need to be set in advance, namely, the maximum depth of the tree, the number of all trees in the forest, and the number of samples sampled each time when building a tree. In the embodiments of the present invention, the maximum depth of the tree can be set between 10 and 100, or not limited directly; the number of all trees in the forest is taken as 100 - 200; the number of samples sampled is taken as 256, because too many sampled numbers may reduce the ability of the model to identify abnormal data.

[0117] During model prediction, for the input data to be inspected, first traverse all the trees to obtain the path height to the leaf nodes respectively, then calculate the average value h(x) of all the heights, and then obtain the sample anomaly score value p(x,m) from the following formula. The closer the anomaly score value is to 1, the greater the anomaly probability.

[0118]

[0119]

[0120] In the above formula, when the number of samples m is determined, c(m) is a constant value, where the Euler constant ζ≈0.5772. Then the anomaly score value p(x,m) only depends on h(x). That is, the smaller h(x) is, the larger p(x,m) is, and the higher the anomaly possibility is.

[0121] Input the first fingerprint features of each target device into the isolation forest model, and perform anomaly analysis on the first fingerprint features of each target device based on the isolation forest model, and the model anomaly score of each target device, that is, the first anomaly score value, can be obtained.

[0122] S507, based on the total number of target devices in each device fingerprint set and the first anomaly score values of the target devices whose first anomaly score values are greater than the first threshold, determine the first channel index corresponding to each device fingerprint set.

[0123] After obtaining the first anomaly score value of each target device, target devices with the first anomaly score value greater than the first threshold (which can be taken as 0.6) can be selected. These target devices can be regarded as suspected abnormal devices. According to the first anomaly score values of the suspected abnormal devices, calculate the total score of all suspected abnormal devices in each device fingerprint set, and then divide it by the total number of target devices in the device fingerprint set to obtain the average anomaly score of each device fingerprint set, and use this average anomaly score as the first channel index. The higher the first channel index, the relatively worse the quality of the channel.

[0124] Figure 6 It is a flowchart of an optional method for determining the second channel index according to an embodiment of the present invention. Please refer to Figure 6 , this part corresponds to anomaly detection of channels based on multiple device fingerprints, and may include:

[0125] S601, regard the device fingerprint corresponding to each target device when the target application is first loaded in each preset period as the second device fingerprint.

[0126] S603, determine the target devices with the number of second device fingerprints greater than or equal to the preset number threshold as the devices to be processed.

[0127] This part is expected to detect abnormal devices by mining the changes in multiple device fingerprints corresponding to the target application before and after logging in to the target device. Therefore, the data filtering here is not just to filter out the device fingerprints at the first installation, but to first filter out the first device fingerprint data within each period for the same target device according to a period, as the second device fingerprint, and then aggregate the second device fingerprint data of the same target device. That is, one or more second device fingerprints can be obtained for the same target device. For all the second device fingerprints of the same target device after aggregation, filter out the target devices whose data volume of the second device fingerprint is less than the preset quantity threshold n, and regard the target devices whose quantity of the second device fingerprint is greater than or equal to n as the devices to be processed. n is the defined threshold, which can be defined as 5 - 10, aiming to reduce the influence of the characteristics of devices with too few second device fingerprints on the overall result.

[0128] S605, perform feature processing on all the second device fingerprints of each device to be processed to obtain the second fingerprint features corresponding to each device to be processed.

[0129] After obtaining all the second device fingerprints of each device to be processed, next, it is necessary to perform feature processing on the multiple second device fingerprints of each device to be processed to generate the second fingerprint features corresponding to each device to be processed. Among them, performing feature processing on the multiple second device fingerprints of the device to be processed includes: extracting features for anomaly analysis from the second device fingerprints, and processing the extracted features into feature vectors that can be used for calculation. Since this part detects the changes in multiple device fingerprints, the features used are basically dynamic features, that is, features that change with user behavior. Further, processing the extracted features into feature vectors that can be used for calculation is mainly to convert the changes of each feature within a preset time into characters or numerical values. Exemplarily, the designed features are as follows (each feature is calculated from multiple second device fingerprints of the same device to be processed):

[0130] Whether the recorded reporting time period (hour) remains unchanged: Record whether the reporting is always at a fixed hour every day, such as whether the reporting time is always 9 o'clock every day, which can reflect whether the user's login hour is fixed.

[0131] Whether the recorded reporting time period (hour + minute) remains unchanged: Record whether the reporting is always at a fixed hour and fixed minute every day, such as whether it is reported at 12:12 every day. If the hour and minute are fixed every day, there may be a problem.

[0132] The proportion of the most repeated reporting time period (hour): Assume that a device has 10 records, and the proportion of the number of times of the hour with the largest quantity in the hour distribution of these 10 records.

[0133] Percentage of records with the battery in the charging state: If it is in the charging state every time it is reported, there is likely a problem.

[0134] Mean battery temperature: The average value of the battery temperature in all the reported records of this device, reflecting the overall temperature situation.

[0135] Standard deviation of battery temperature: The standard deviation of the battery temperature in all the reported records of this device, reflecting the temperature fluctuation.

[0136] Standard deviation of battery voltage: The standard deviation of the voltage in all the reported records of this device, reflecting the voltage fluctuation.

[0137] Standard deviation of the phone battery level: Reflects the fluctuation of the phone battery level. If the standard deviation is 0 or very different from the normal standard deviation, there is likely a problem.

[0138] Standard deviation of screen brightness: Reflects the fluctuation of the phone screen brightness. If the phone brightness remains unchanged all the time, there may be a problem.

[0139] Standard deviation of the average temperature of multiple CPUs: First calculate the average temperature of multiple CPUs in a certain device fingerprint, and then calculate the standard deviation of the average temperature in multiple device fingerprints, reflecting the fluctuation of the average temperature.

[0140] Standard deviation of the average utilization rate of multiple CPUs: First calculate the average utilization rate of multiple CPUs in a certain device fingerprint, and then calculate the standard deviation of the average utilization rate in multiple device fingerprints, reflecting the fluctuation of the average utilization rate.

[0141] Standard deviation of the available memory capacity: If the available memory capacity remains unchanged or changes very little, there may be a problem.

[0142] Standard deviation of the total number of currently running processes: If the total number of currently running processes remains unchanged or changes very little, there may be a problem.

[0143] Standard deviation of the number of apps installed by the user: If the number of apps installed by the user remains unchanged or changes very little, there may be a problem.

[0144] Standard deviation of the available space size of the SD card: If it remains unchanged or changes very little, there may be a problem.

[0145] Standard deviation of the available space size of the memory: If it remains unchanged or changes very little, there may be a problem.

[0146] Standard deviation of the available space size of the phone hard drive: If it remains unchanged or changes very little, there may be a problem.

[0147] Standard deviation of the LTE signal strength value: If it remains unchanged or changes very little, there may be a problem.

[0148] Standard deviation of the received signal strength value of the neighboring base station: If it remains unchanged or changes very little, there may be a problem.

[0149] Whether the number of pictures in the mobile phone is all 0: If the number of pictures in the mobile phone is always 0, there may be a problem because pictures will also be generated during online chatting, etc.

[0150] Standard deviation of the number of pictures in the mobile phone: If the number of pictures in the mobile phone remains unchanged or changes very little, there may be a problem.

[0151] Whether the number of audio in the mobile phone is all 0: If the number of audio in the mobile phone is always 0, there may be a problem because audio will also be generated during online chatting.

[0152] Standard deviation of the number of audio in the mobile phone: If the number of audio in the mobile phone remains unchanged or changes very little, there may be a problem.

[0153] Whether the number of videos in the mobile phone is all 0: If the number of videos in the mobile phone is always 0, there may be a problem because videos will also be generated during online chatting.

[0154] Standard deviation of the number of videos in the mobile phone: If the number of videos in the mobile phone remains unchanged or changes very little, there may be a problem.

[0155] S607. Input the second fingerprint features of each device to be processed into the anomaly detection model, and perform anomaly analysis on the second fingerprint features of each device to be processed based on the anomaly detection model to obtain the second anomaly score of each device to be processed.

[0156] After obtaining the second fingerprint features of the devices to be processed in each device fingerprint set as above, the target devices with anomalies can be detected using the anomaly detection model. In the embodiments of the present invention, the Isolation Forest algorithm is used as the anomaly detection model. For the Isolation Forest algorithm, please refer to the foregoing description and will not be elaborated here.

[0157] Input the second fingerprint features of each device to be processed into the Isolation Forest model, and perform anomaly analysis on the second fingerprint features of each device to be processed based on the Isolation Forest model, and the model anomaly score of each device to be processed, that is, the second anomaly score, can be obtained.

[0158] S609. Based on the total number of devices to be processed in each device fingerprint set and the second anomaly scores of the devices to be processed whose second anomaly scores are greater than the second threshold, determine the second channel index corresponding to each device fingerprint set.

[0159] After obtaining the second anomaly scores of each device to be processed, devices to be processed with second anomaly scores greater than a first threshold (which can be set to 0.6) can be selected. These devices to be processed can be regarded as suspected anomalous devices. Based on the second anomaly scores of the suspected anomalous devices, calculate the total score of all suspected anomalous devices in each device fingerprint set, and then divide it by the total number of devices to be processed in that device fingerprint set to obtain the average anomaly score of each device fingerprint set. Take this average anomaly score as the second channel metric. The higher the second channel metric, the relatively worse the quality of the channel.

[0160] S405. Determine the retention rate of each device fingerprint set according to the loading time when each target device loads the target application each time; the retention rate is used to characterize the activity of the target devices in the device fingerprint set accessing the target application.

[0161] Figure 7 is a flowchart of an optional method for determining the retention rate according to an embodiment of the present invention. Please refer to Figure 7 , and the calculation method of the retention rate includes:

[0162] S701. According to the loading time when each target device loads the target application each time, count the number of target devices that install the target application at a first time and enable the target application at a second time, the number of target devices that install the target application at the first time, the number of target devices that enable the target application at both the first time and the second time, and the number of target devices that enable the target application at the first time in each device fingerprint set; the second time is a time after the first time.

[0163] S703. Calculate the first retention rate corresponding to each device fingerprint set according to the number of target devices that install the target application at the first time and enable the target application at the second time and the number of target devices that install the target application at the first time in each device fingerprint set.

[0164] S705. Calculate the second retention rate corresponding to each device fingerprint set according to the number of target devices that enable the target application at both the first time and the second time and the number of target devices that enable the target application at the first time in each device fingerprint set.

[0165] S707. Determine the retention rate corresponding to each device fingerprint set according to the first retention rate and the second retention rate corresponding to the device fingerprint set.

[0166] The embodiments of the present invention mainly calculate two retention rates, namely the retention rate of newly registered users and the retention rate of all users. The target devices that installed the target application at the first time are regarded as newly registered users, and the target devices that had been installed before the first time and enabled the target application at the first time are regarded as all users. The retention rate of newly registered users, i.e., the first retention rate, refers to the ratio of the number of target devices in the device fingerprint set that installed the target application at the first time and enabled the target application at the second time to the number of target devices that installed the target application at the first time. The retention rate of all users, i.e., the second retention rate, refers to the ratio of the number of target devices in the device fingerprint set that enabled the target application at both the first time and the second time to the number of target devices that enabled the target application at the first time.

[0167] Exemplarily: The retention rate of newly registered users can refer to the ratio of the number of devices that installed the app on the same day and still launched the app on the nth day to the number of devices that installed the app on the same day. By changing the value of n here, the 1-day retention rate, 3-day retention rate, 1-week retention rate, 2-week retention rate, 3-week retention rate, and 1-month retention rate of users can be calculated by channel.

[0168] The retention rate of all users can refer to the ratio of the number of devices that launched the app on the same day and still launched the app on the nth day to the number of devices that currently launched the app. By changing the value of n here, the 1-day retention rate, 3-day retention rate, 1-week retention rate, 2-week retention rate, 3-week retention rate, and 1-month retention rate of users can be calculated by channel.

[0169] For each device fingerprint set, calculate the average value of the first retention rate and the second retention rate of each device fingerprint set, and use the average value as the retention rate corresponding to the device fingerprint set.

[0170] S407. Perform abnormal channel identification according to the channel metrics and the retention rate of the device fingerprint sets corresponding to each channel.

[0171] The channel metrics of the device fingerprint set include: a first channel metric obtained by abnormal detection based on a single device fingerprint and a second channel metric obtained by abnormal detection based on multiple device fingerprints. In a possible implementation manner, performing abnormal channel identification according to the channel metrics and the retention rate of the device fingerprint sets corresponding to each channel may include:

[0172] S4071. Perform standardization processing on the first channel metric, the second channel metric, and the retention rate of each device fingerprint set to obtain a first standard value corresponding to the first channel metric, a second standard value corresponding to the second channel metric, and a third standard value corresponding to the retention rate.

[0173] S4073, obtain the first weight corresponding to the first channel metric, the second weight corresponding to the second channel metric, and the third weight corresponding to the retention rate.

[0174] S4075, perform weighted calculations on the first standard value, the second standard value, and the third standard value of each device fingerprint set according to the first weight, the second weight, and the third weight to obtain the anomaly score of each device fingerprint set.

[0175] S4077, determine the anomalous channels based on the anomaly scores of the device fingerprint sets corresponding to each channel.

[0176] The numerical differences of the first channel metric, the second channel metric, and the retention rate may be very large. To integrate the scores of each channel obtained by the three methods for channel ranking, it is necessary to standardize the scores obtained by the three methods. Here, standardization means scaling the first channel metric, the second channel metric, and the retention rate proportionally so that they fall into a specific range. Common standardization methods include: min-max normalization, log function transformation, atan function transformation, z-score normalization (zero-mean normalization), and fuzzy quantization method.

[0177] In a possible implementation, the standardization formula x' = (x - μ) / σ can be used to standardize the first channel metric, the second channel metric, and the retention rate respectively to obtain the first standard value corresponding to the first channel metric, the second standard value corresponding to the second channel metric, and the third standard value corresponding to the retention rate. Here, x is the score to be processed, which is the first channel metric, the second channel metric, or the retention rate, x' is the standard value corresponding to x, μ is the mean of the scores corresponding to each device fingerprint set, σ is the standard deviation of the scores corresponding to each device fingerprint set. When x is the first channel metric, μ is the mean of the first channel metrics corresponding to each device fingerprint set, and σ is the standard deviation of the first channel metrics corresponding to each device fingerprint set.

[0178] Suppose that after standardizing the first channel indicator m1, the second channel indicator m2, and the retention rate m3, the first standard value m1' of the first channel indicator m1, the second standard value m2' of the second channel indicator m2, and the third standard value m3' corresponding to the retention rate m3 are obtained. Let a, b, and c represent the weights of the scores of the first channel indicator, the second channel indicator, and the retention rate respectively (a, b, and c are all greater than 0 and less than 1). Then, the anomaly score m of the device fingerprint set is m = a * m1' + b * m2' - c * m3'. From this, the channels corresponding to the device fingerprint set can be ranked according to the anomaly score m to obtain the total ranking of each channel corresponding to the device fingerprint set. Among them, the higher the score of m, the lower the ranking, and the greater the possibility that the corresponding channel is an abnormal channel. Therefore, the abnormal channels can be determined according to the anomaly scores of the device fingerprint sets corresponding to each channel. Among them, the method for determining abnormal channels can be: regarding the channels corresponding to a preset number of device fingerprint sets with higher anomaly scores as abnormal channels. The preset number can be a fixed value or calculated according to the preset anomaly ratio and the total number of all device fingerprint sets; or, calculating the difference between the anomaly score of each device fingerprint set and the highest anomaly score. When the difference is greater than the preset difference threshold, regarding the channel corresponding to this device fingerprint set as an abnormal channel.

[0179] In addition, after obtaining the total channel ranking, the channel with the highest-ranked device fingerprint set can be regarded as a high-quality channel, and the channels with lower-ranked device fingerprint sets can be regarded as low-quality channels. Analysis can be carried out on the lower-ranked channels. For example, comparing the differences in the number of app launches at each time period of the day and the differences in the trend changes of the line charts between the high-quality channels and the low-quality channels. If the number of app launches at each time period of the day in the low-quality channels is basically balanced, there may be a big problem. Similarly, the differences in the number of app launches on each day of the week can also be analyzed.

[0180] In an embodiment of the present invention, a device fingerprint set corresponding to each channel is obtained. Each device fingerprint set includes fingerprint data of at least two target devices. According to the device fingerprint when each target device first loads the target application, a first channel index of each device fingerprint set is determined. According to the device fingerprint when each target device first loads the target application within each preset period, a second channel index of each device fingerprint set is determined. According to the loading time when each target device loads the target application each time, the retention rate of each device fingerprint set is determined. Then, based on the first channel index, the second channel index, and the retention rate of the device fingerprint set corresponding to each channel, abnormal channels are identified. The present invention combines three channel quality evaluation methods, namely, the first channel index based on single-device fingerprint anomaly detection, the second channel index based on multi-device fingerprint anomaly detection, and the retention rate based on the time and frequency rules of device fingerprint reporting. Among them, the first channel index and the second channel index analyze the channels based on the attribute characteristics of the device fingerprint, while the retention rate analyzes the channels through the behavioral attributes of users. The combination of the two can integrate the attribute characteristics and behavioral characteristics of the device fingerprint at the same time, improving the accuracy of identifying abnormal channels.

[0181] In an embodiment of the present invention, the quality of the promotion channels of the app is ranked based on device fingerprints. The final channel ranking result combines the ranking results of three channels: the anomaly detection result based on a single device fingerprint, the anomaly detection result based on multiple device fingerprints, and the retention rate. It can not only output the ranking of the channels, but also output the weighted summary scores of each channel, assisting in making a further judgment on the channel quality. For the identified low-quality promotion channels, it can be decided whether to reduce or stop the cost investment in these low-quality promotion channels after secondary analysis. At the same time, for high-quality promotion channels, the cost investment can be appropriately increased, so as to achieve the optimal allocation of cost investment.

[0182] It should be noted that for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0183] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present invention.

[0184] According to an embodiment of the present invention, there is also provided an abnormal channel identification device for implementing the above abnormal channel identification method. Figure 8 is a schematic diagram of an optional abnormal channel identification device according to an embodiment of the present invention, as Figure 8 shown, the abnormal channel identification device 80 may include: a device fingerprint set acquisition unit 810, a channel index determination unit 820, a retention rate determination unit 830, and an abnormal channel identification unit 840.

[0185] The device fingerprint set acquisition unit 810 is configured to acquire a device fingerprint set corresponding to each channel. The device fingerprint set includes fingerprint data of at least two target devices. The fingerprint data includes the device fingerprint and the loading time of each target device when loading the target application each time.

[0186] The channel index determination unit 820 is configured to determine a channel index of each device fingerprint set according to the device fingerprint of each target device when loading the target application. The channel index is used to characterize the abnormal degree of the target device in the device fingerprint set when loading the target application.

[0187] The retention rate determination unit 830 is configured to determine the retention rate of each device fingerprint set according to the loading time of each target device when loading the target application each time. The retention rate is used to characterize the active degree of the target device in the device fingerprint set accessing the target application.

[0188] The abnormal channel identification unit 840 is configured to perform abnormal channel identification according to the channel index and the retention rate of the device fingerprint set corresponding to each channel.

[0189] Among them, the channel index determination unit 820 includes: a first channel index determination module, configured to determine a first channel index for each device fingerprint set according to the device fingerprint when each target device first loads the target application; the first channel index is used to characterize the abnormality degree of the target device in the device fingerprint set when installing the target application; a second channel index determination module, configured to determine a second channel index for each device fingerprint set according to the device fingerprint when each target device first loads the target application within each preset period; the second channel index is used to characterize the abnormality degree of the target device in the device fingerprint set when enabling the target application; a channel index determination module, configured to use the first channel index and the second channel index of each device fingerprint set as the channel index of the device fingerprint set.

[0190] It should be noted that the device fingerprint set acquisition unit 810 in this embodiment can be used to execute step S401 in the embodiment of the present application, the channel index determination unit 820 in this embodiment can be used to execute step S403 in the embodiment of the present application, the retention rate determination unit 830 in this embodiment can be used to execute step S405 in the embodiment of the present application, and the abnormal channel identification unit 840 in this embodiment can be used to execute step S407 in the embodiment of the present application.

[0191] It should be noted here that the examples and application scenarios implemented by the above units and the corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. The above modules, as part of the device, can run in a hardware environment as shown in Figure 1 shown, and can be implemented by software or by hardware.

[0192] The abnormal channel identification device in the embodiment of the present invention and the abnormal channel identification method in the embodiment are based on the same inventive concept.

[0193] According to an embodiment of the present invention, there is also provided an electronic device for implementing the above abnormal channel identification method.

[0194] Figure 9 is a structural block diagram of an electronic device according to an embodiment of the present invention. As shown in Figure 9 shown, the electronic device may include: one or more (only one is shown in the figure) processors 111 and a memory 113. Optionally, as shown in Figure 9 shown, the electronic device may further include a transmission device 115 and an input / output device 117.

[0195] Among them, the memory 113 can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal channel identification method and device in the embodiments of the present invention. The processor 111 executes various functional applications and data processing by running the software programs and modules stored in the memory 113, that is, to implement the above-mentioned abnormal channel identification method. The memory 113 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some instances, the memory 113 may further include a memory remotely disposed relative to the processor 111, and these remote memories may be connected to the electronic device through a network. Examples of the above network include but are not limited to the Internet, enterprise intranet, local area network, mobile communication network, and combinations thereof.

[0196] The above-mentioned transmission device 115 is used to receive or send data via a network, and can also be used for data transmission between the processor and the memory. Specific examples of the above network may include a wired network and a wireless network. In one instance, the transmission device 115 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers through a network cable, so as to communicate with the Internet or a local area network. In one instance, the transmission device 115 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0197] Those of ordinary skill in the art can understand that Figure 9 The structure shown is only schematic, and the electronic device can be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a palm computer, and a mobile Internet device (Mobile Internet Devices, MID), a PAD and other electronic devices. Figure 9 It does not limit the structure of the above-mentioned electronic device. For example, the electronic device may further include more or fewer components (such as a network interface, a display device, etc.) than those shown Figure 9 in the figure, or have a different configuration from that shown Figure 9 in the figure.

[0198] Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the relevant hardware of the electronic device through a program, and the program can be stored in a computer-readable storage medium. The storage medium may include: a flash drive, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disc, etc.

[0199] An embodiment of the present invention also provides a storage medium. Optionally, in this embodiment, the above storage medium can be used to execute the program code of the abnormal channel recognition method.

[0200] Optionally, in this embodiment, the above storage medium can be located on at least one of the multiple network devices in the network shown in the above embodiment.

[0201] Optionally, in this embodiment, the storage medium is set to store for execution attached Figure 4 The program code corresponding to the steps of the abnormal channel recognition method.

[0202] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiment, and will not be repeated here.

[0203] Optionally, in this embodiment, the above storage medium may include but is not limited to: USB flash drive, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disc, etc., various media that can store program code.

[0204] An embodiment of the present invention also provides a computer program product or computer program. The computer program product or computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the abnormal channel recognition method provided in the above various optional implementation manners.

[0205] An embodiment of the present invention provides an electronic device. The electronic device includes a processor and a memory. At least one instruction and at least one program segment are stored in the memory. The at least one instruction or at least one program segment is loaded and executed by the processor to implement as Figure 4 The corresponding abnormal channel recognition method.

[0206] The memory can be used to store software programs and modules. The processor runs the software programs and modules stored in the memory to execute various functional applications and data processing. The memory mainly includes a program storage area and a data storage area. Among them, the program storage area can store an operating system, application programs required for functions, etc.; the data storage area can store data created according to the use of the device, etc. In addition, the memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage devices. Correspondingly, the memory can also include a memory controller to provide the processor with access to the memory.

[0207] The serial numbers of the embodiments of the present invention above are only for description and do not represent the superiority or inferiority of the embodiments.

[0208] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage media. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing one or more computer devices (which can be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0209] In the above embodiments of the present invention, the descriptions of the various embodiments have their own emphases. For the parts not detailed in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0210] In the several embodiments provided by the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of the units or modules can be in electrical or other forms.

[0211] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0212] In addition, the functional units in the various embodiments of the present invention can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0213] The above is only the preferred embodiment of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. An abnormal channel identification method, characterized in that, it includes: Obtain the device fingerprint set corresponding to each channel, where the device fingerprint set includes fingerprint data of at least two target devices, and the fingerprint data includes the device fingerprint and loading time of the target device each time it loads the target application; the device fingerprint is used to characterize the dynamic and static characteristics of the target device; Determine the first channel index of each device fingerprint set according to the device fingerprint when each target device first loads the target application; the first channel index is used to characterize the abnormal degree of the target device in the device fingerprint set when installing the target application; Determine the second channel index of each device fingerprint set according to the device fingerprint when each target device first loads the target application within each preset period; the second channel index is used to characterize the abnormal degree of the target device in the device fingerprint set when enabling the target application; Determine the channel index of the device fingerprint set according to the first channel index and the second channel index of each device fingerprint set, where the channel index is used to characterize the abnormal degree of the target device in the device fingerprint set when loading the target application; Determine the retention rate of each device fingerprint set according to the loading time of each target device each time it loads the target application; The retention rate is used to characterize the activity degree of the target device in the device fingerprint set accessing the target application; Perform abnormal channel identification according to the channel index and the retention rate of the device fingerprint set corresponding to each channel.

2. The method according to claim 1, characterized in that, The obtaining the device fingerprint set corresponding to each channel includes: Obtain the fingerprint data of each target device, where the fingerprint data includes a channel identifier and the device fingerprint and loading time of the target device each time it loads the target application, and the channel identifier is used to indicate the channel through which the target device obtains the target application; Classify the fingerprint data of each target device according to the channel identifier to obtain candidate device fingerprint sets corresponding to the channels indicated by each channel identifier respectively. Each candidate device fingerprint set includes fingerprint data of at least two target devices, and all target devices in the same candidate device fingerprint set have the same channel identifier; Count the data volume of the fingerprint data in each candidate device fingerprint set, and use the candidate device fingerprint set with the data volume greater than or equal to the preset threshold as the device fingerprint set.

3. The method according to claim 1, characterized in that, The determining the first channel index of each device fingerprint set according to the device fingerprint when each target device first loads the target application includes: Use the device fingerprint when each target device first loads the target application as the first device fingerprint of the target device; Perform feature processing on the first device fingerprint of each target device to obtain the first fingerprint feature corresponding to each target device; Input the first fingerprint features of each target device into the anomaly detection model, and perform anomaly analysis on the first fingerprint features of each target device based on the anomaly detection model to obtain the first anomaly score of each target device; Based on the total number of target devices in each device fingerprint set and the first anomaly scores of the target devices whose first anomaly scores are greater than the first threshold, determine the first channel metrics corresponding to each device fingerprint set.

4. The method according to claim 1, wherein, the determining the second channel metrics corresponding to each device fingerprint set according to the device fingerprint when each target device first loads the target application in each preset period includes: Taking the device fingerprint corresponding to each target device when it first loads the target application in each preset period as the second device fingerprint; Determining the target devices whose number of second device fingerprints is greater than or equal to the preset number threshold as the devices to be processed; Performing feature processing on all the second device fingerprints of each device to be processed to obtain the second fingerprint features corresponding to each device to be processed; Input the second fingerprint features of each device to be processed into the anomaly detection model, and perform anomaly analysis on the second fingerprint features of each device to be processed based on the anomaly detection model to obtain the second anomaly score of each device to be processed; Based on the total number of devices to be processed in each device fingerprint set and the second anomaly scores of the devices to be processed whose second anomaly scores are greater than the second threshold, determine the second channel metrics corresponding to each device fingerprint set.

5. The method according to claim 1, wherein, the determining the retention rate of each device fingerprint set according to the loading time when each target device loads the target application each time includes: According to the loading time when each target device loads the target application each time, count the number of target devices that install the target application at the first time and enable the target application at the second time, the number of target devices that install the target application at the first time, the number of target devices that enable the target application at both the first time and the second time, and the number of target devices that enable the target application at the first time in each device fingerprint set; the second time is a time after the first time; Calculating the first retention rate corresponding to each device fingerprint set according to the number of target devices that install the target application at the first time and enable the target application at the second time and the number of target devices that install the target application at the first time in each device fingerprint set; Calculating the second retention rate corresponding to each device fingerprint set according to the number of target devices that enable the target application at both the first time and the second time and the number of target devices that enable the target application at the first time in each device fingerprint set; Determining the retention rate corresponding to each device fingerprint set according to the first retention rate and the second retention rate corresponding to the device fingerprint set.

6. The method according to claim 1, wherein, the identifying the abnormal channels according to the channel metrics and the retention rate of the device fingerprint sets corresponding to each channel includes: Standardize the first channel metric, the second channel metric, and the retention rate for each device fingerprint set to obtain a first standard value corresponding to the first channel metric, a second standard value corresponding to the second channel metric, and a third standard value corresponding to the retention rate; Obtain a preset first weight corresponding to the first channel metric, a second weight corresponding to the second channel metric, and a third weight corresponding to the retention rate; Perform weighted calculation on the first standard value, the second standard value, and the third standard value of each device fingerprint set according to the first weight, the second weight, and the third weight to obtain the anomaly score of each device fingerprint set; Determine the anomalous channel according to the anomaly scores of the device fingerprint sets corresponding to each channel.

7. An anomalous channel identification device, characterized in that, it includes: A device fingerprint set acquisition unit, configured to acquire a device fingerprint set corresponding to each channel, where the device fingerprint set includes fingerprint data of at least two target devices, and the fingerprint data includes the device fingerprint and the loading time of the target device each time the target application is loaded; the device fingerprint is used to characterize the dynamic and static characteristics of the target device; A channel metric determination unit, configured to determine the channel metric of each device fingerprint set according to the device fingerprint of each target device when loading the target application, where the channel metric is used to characterize the anomaly degree of the target device in the device fingerprint set when loading the target application; A retention rate determination unit, configured to determine the retention rate of each device fingerprint set according to the loading time of each target device each time the target application is loaded; The retention rate is used to characterize the activity degree of the target device in the device fingerprint set accessing the target application; An anomalous channel identification unit, configured to perform anomalous channel identification according to the channel metric and the retention rate of the device fingerprint set corresponding to each channel; Wherein, the channel metric determination unit includes: a first channel metric determination module, configured to determine the first channel metric of each device fingerprint set according to the device fingerprint of each target device when first loading the target application; the first channel metric is used to characterize the anomaly degree of the target device in the device fingerprint set when installing the target application; a second channel metric determination module, configured to determine the second channel metric of each device fingerprint set according to the device fingerprint of each target device when first loading the target application within each preset period; the second channel metric is used to characterize the anomaly degree of the target device in the device fingerprint set when enabling the target application; a channel metric determination module, configured to use the first channel metric and the second channel metric of each device fingerprint set as the channel metric of the device fingerprint set.

8. The device according to claim 7, characterized in that, The device fingerprint set acquisition unit is further configured to acquire the fingerprint data of each target device, where the fingerprint data includes a channel identifier, the device fingerprint of the target device each time the target application is loaded, and the loading time. The channel identifier is used to indicate the channel through which the target device obtains the target application; classify the fingerprint data of each target device according to the channel identifier to obtain candidate device fingerprint sets corresponding to the channels indicated by each channel identifier respectively. Each candidate device fingerprint set includes the fingerprint data of at least two target devices, and all target devices in the same candidate device fingerprint set have the same channel identifier; count the data volume of the fingerprint data in each candidate device fingerprint set, and use the candidate device fingerprint set with a data volume greater than or equal to a preset threshold as the device fingerprint set.

9. The device according to claim 7, wherein, the first channel index determination module is further configured to use the device fingerprint of each target device when the target application is first loaded as the first device fingerprint of the target device; perform feature processing on the first device fingerprint of each target device to obtain first fingerprint features corresponding to each target device; input the first fingerprint features of each target device into an anomaly detection model, perform anomaly analysis on the first fingerprint features of each target device based on the anomaly detection model to obtain the first anomaly score of each target device; determine the first channel index corresponding to each device fingerprint set based on the total number of target devices in each device fingerprint set and the first anomaly scores of the target devices with the first anomaly score greater than a first threshold.

10. The device according to claim 7, wherein, the second channel index determination module is further configured to use the device fingerprint corresponding to each target device when the target application is first loaded in each preset period as the second device fingerprint; determine the target devices with the number of second device fingerprints greater than or equal to a preset number threshold as the devices to be processed; perform feature processing on all the second device fingerprints of each device to be processed to obtain second fingerprint features corresponding to each device to be processed; input the second fingerprint features of each device to be processed into an anomaly detection model, perform anomaly analysis on the second fingerprint features of each device to be processed based on the anomaly detection model to obtain the second anomaly score of each device to be processed; determine the second channel index corresponding to each device fingerprint set based on the total number of devices to be processed in each device fingerprint set and the second anomaly scores of the devices to be processed with the second anomaly score greater than a second threshold.

11. The device according to claim 7, wherein, The retention rate determination unit is further configured to count, according to the loading time of each target device when loading the target application each time, the number of target devices in each device fingerprint set that install the target application at the first time and enable the target application at the second time, the number of target devices that install the target application at the first time, the number of target devices that enable the target application at both the first time and the second time, and the number of target devices that enable the target application at the first time; the second time is a time after the first time. Calculate the first retention rate corresponding to each device fingerprint set according to the number of target devices that install the target application at the first time and enable the target application at the second time and the number of target devices that install the target application at the first time in each device fingerprint set; calculate the second retention rate corresponding to each device fingerprint set according to the number of target devices that enable the target application at both the first time and the second time and the number of target devices that enable the target application at the first time in each device fingerprint set; determine the retention rate corresponding to each device fingerprint set according to the first retention rate and the second retention rate corresponding to the device fingerprint set.

12. The apparatus according to claim 7, wherein, The abnormal channel identification unit is further configured to perform standardization processing on the first channel index, the second channel index, and the retention rate of each device fingerprint set to obtain a first standard value corresponding to the first channel index, a second standard value corresponding to the second channel index, and a third standard value corresponding to the retention rate; obtain a preset first weight corresponding to the first channel index, a second weight corresponding to the second channel index, and a third weight corresponding to the retention rate; perform weighted calculation on the first standard value, the second standard value, and the third standard value of each device fingerprint set according to the first weight, the second weight, and the third weight to obtain the abnormal score of each device fingerprint set. Determine the abnormal channel according to the abnormal scores of the device fingerprint sets corresponding to each channel.

13. A computer-readable storage medium, wherein, At least one instruction or at least one program segment is stored in the storage medium, and the at least one instruction or at least one program segment is loaded and executed by a processor to implement the abnormal channel identification method according to any one of claims 1-6.

14. A computer device, wherein, The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor is caused to execute the abnormal channel identification method according to any one of claims 1 to 6.

15. A computer program product, wherein, It includes computer instructions, and when the computer instructions are executed by a processor, the computer is caused to execute the abnormal channel identification method according to any one of claims 1 to 6.

Images