API risk device identification method, device and electronic device based on single classification

Abstract

The present invention discloses a method, device and electronic device for API risk equipment identification based on single classification, the method comprising: obtaining original equipment sample data from multiple channels; configuring a unified standard for identifying risk equipment in the multiple channels, and labeling the data in the original equipment sample data that meets the unified standard; extracting the labeled risk equipment data in the original equipment sample data as training samples to train a single classification model; and identifying risk equipment accessed through different channels based on the trained single classification model. The present invention unifies the standards for identifying risk equipment in various channels, and trains a single classification model based on the unified risk equipment standards, thereby ensuring the unification of risk equipment identification results by various network service platforms, and after identifying risk equipment, other equipment is considered risk-free equipment, thereby unifying the risk identification results of various platforms and improving risk control capabilities.

Description

Technical Field

[0001] The present invention relates to the field of computer information processing technology, and in particular to a method, device, electronic device and computer-readable medium for identifying API risk devices based on single classification. Background Art

[0002] With the development of the Internet, various Internet service platforms (also called channels) have emerged, such as online shopping platforms, online car-hailing platforms, sharing platforms, maps, music, etc. These platforms have brought great convenience to people's lives, but because they are closely integrated with the Internet, there are some risks such as fraud and breach of trust.

[0003] In order to identify these risky devices, machine learning models are usually used to predict the risk value of the device, and devices with risk values ​​greater than the threshold are identified as risk-free devices, and devices with risk values ​​less than the threshold are identified as risky devices. However, due to the different service content and service quality of these Internet service platforms, the device groups they target are also different. Therefore, there are differentiated features in the device data of different platforms. These differentiated features will make it impossible for the model to identify risky devices and risk-free devices on different platforms with unified standards. In other words, the same device may be identified as a risky device on one platform and as a risk-free device on another platform. Summary of the invention

[0004] In view of this, the main purpose of the present invention is to propose a single-classification-based API risk device identification method, device, electronic device and computer-readable medium, in order to at least partially solve at least one of the above-mentioned technical problems.

[0005] In order to solve the above technical problems, the first aspect of the present invention proposes a method for identifying API risk devices based on single classification, which is used to identify risk devices from different channels in Internet services. The method includes:

[0006] Obtain raw device sample data from multiple channels;

[0007] Configuring a unified standard for identifying risky devices in the multiple channels, and labeling data in the original device sample data that meets the unified standard;

[0008] Extract the labeled risky equipment data from the original equipment sample data as training samples to train a single classification model;

[0009] Based on the trained single classification model, risky devices accessed through different channels are identified.

[0010] According to a preferred embodiment of the present invention, the single classification model includes:

[0011] A sub-training module, used for mapping the training samples into sample data points in a multi-dimensional space and determining the boundaries containing the sample data points;

[0012] The sub-identification module is used to map the test samples into test data points in a multi-dimensional space and identify the test data points within the boundary as risky devices.

[0013] According to a preferred embodiment of the present invention, the boundary is spherical, the sub-training module determines the center and radius of the smallest sphere containing all sample data points, and determines the boundary based on the center and radius.

[0014] According to a preferred embodiment of the present invention, the boundary is spherical, the sub-training module determines the center and radius of the smallest sphere containing a predetermined proportion of sample data points, and determines the boundary based on the center and radius.

[0015] According to a preferred implementation manner of the present invention, the original device sample data includes: a device ID and information related to the device ID.

[0016] According to a preferred embodiment of the present invention, the information related to the device ID includes: device model, device location, device resource return record, and at least one of device communication records. The unified standard for identifying risky devices in the multiple channels is configured as follows: device IDs that have not been returned on time in device resource return records and / or have communicated with blacklisted devices in device communication records are identified as risky devices.

[0017] In order to solve the above technical problems, the second aspect of the present invention provides an API risk device identification device based on a single classification, which is used to identify risk devices from different channels in Internet services. The device includes:

[0018] The acquisition module is used to obtain raw device sample data from multiple channels;

[0019] A labeling module, used to configure a unified standard for identifying risky devices in the multiple channels, and label the data in the original device sample data that meets the unified standard;

[0020] A training module is used to extract the risky device data with labels from the original device sample data as training samples to train a single classification model;

[0021] The identification module is used to identify risky devices accessed through different channels based on the trained single classification model.

[0022] According to a preferred embodiment of the present invention, the single classification model includes:

[0023] A sub-training module, used for mapping the training samples into sample data points in a multi-dimensional space and determining the boundaries containing the sample data points;

[0024] The sub-identification module is used to map the test samples into test data points in a multi-dimensional space and identify the test data points within the boundary as risky devices.

[0025] According to a preferred embodiment of the present invention, the boundary is spherical, the sub-training module determines the center and radius of the smallest sphere containing all sample data points, and determines the boundary based on the center and radius.

[0026] According to a preferred embodiment of the present invention, the boundary is spherical, the sub-training module determines the center and radius of the smallest sphere containing a predetermined proportion of sample data points, and determines the boundary based on the center and radius.

[0027] According to a preferred implementation manner of the present invention, the original device sample data includes: a device ID and information related to the device ID.

[0028] According to a preferred embodiment of the present invention, the information related to the device ID includes: device model, device location, device resource return record, and at least one of device communication records; the labeling module configures the unified standard for identifying risky devices in the multiple channels as follows: device IDs that have not been returned on time in device resource return records and / or have communicated with blacklisted devices in device communication records are identified as risky devices.

[0029] In order to solve the above technical problems, the third aspect of the present invention provides an electronic device, including:

[0030] Processor; and

[0031] A memory storing computer executable instructions, which when executed cause the processor to perform the above method.

[0032] To solve the above technical problem, the fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, the above method is implemented.

[0033] The present invention configures a unified standard for identifying risky devices in multiple channels, and labels the data in the original device sample data that meets the unified standard; extracts the labeled risky device data in the original device sample data as training samples to train a single classification model; and identifies risky devices accessed through different channels based on the trained single classification model. The present invention unifies the standards for identifying risky devices in various channels, and trains a single classification model based on the unified risky device standards, thereby ensuring the uniformity of risky device identification results on various network service platforms. After identifying risky devices, other devices are considered risk-free devices, thereby unifying the risk identification results of various platforms and improving risk control capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to make the technical problems solved by the present invention, the technical means adopted and the technical effects achieved more clearly, the specific embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, it should be noted that the drawings described below are only drawings of exemplary embodiments of the present invention, and those skilled in the art can obtain drawings of other embodiments based on these drawings without creative work.

[0035] Figure 1 It is a flowchart of a method for identifying API risk devices based on single classification according to an embodiment of the present invention;

[0036] Figure 2 It is a schematic diagram of the structural framework of a device for identifying API risk equipment based on single classification according to an embodiment of the present invention;

[0037] Figure 3 is a structural block diagram of an exemplary embodiment of an electronic device according to the present invention;

[0038] Figure 4 is a schematic diagram of an embodiment of a computer readable medium of the present invention. DETAILED DESCRIPTION

[0039] The exemplary embodiments of the present invention will now be described more fully with reference to the accompanying drawings. Although each exemplary embodiment can be implemented in a variety of specific ways, it should not be understood that the present invention is limited to the embodiments set forth herein. On the contrary, these exemplary embodiments are provided to make the content of the present invention more complete and to facilitate the comprehensive communication of the inventive concept to those skilled in the art.

[0040] Under the premise of conforming to the technical concept of the present invention, the structure, performance, effect or other characteristics described in a specific embodiment may be combined with one or more other embodiments in any appropriate manner.

[0041] In the process of introducing specific embodiments, the detailed description of the structure, performance, effect or other characteristics is to enable those skilled in the art to fully understand the embodiments. However, it does not exclude that those skilled in the art can implement the present invention with a technical solution that does not contain the above-mentioned structure, performance, effect or other characteristics under certain circumstances.

[0042] The flowchart in the accompanying drawings is only an exemplary process demonstration, and does not mean that the solution of the present invention must include all the contents, operations and steps in the flowchart, nor does it mean that it must be executed in the order shown in the figure. For example, some operations / steps in the flowchart can be decomposed, some operations / steps can be combined or partially combined, etc. The execution order shown in the flowchart can be changed according to the actual situation without departing from the main purpose of the present invention.

[0043] Frames in the attached figure Figure 1 Generally, it refers to functional entities, which do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0044] The same reference numerals in the drawings represent the same or similar elements, components or parts, and thus the repeated description of the same or similar elements, components or parts may be omitted below. It should also be understood that although the first, second, third and other attributives representing the numbers may be used herein to describe various devices, elements, components or parts, these devices, elements, components or parts should not be limited by these attributives. In other words, these attributives are only used to distinguish one from another. For example, the first device may also be called the second device, but it does not deviate from the essential technical solution of the present invention. In addition, the terms "and / or" and "and / or" refer to all combinations including any one or more of the listed items.

[0045] See also Figure 1 , Figure 1 The present invention provides a method for identifying API risk devices based on a single classification. The method is used to identify risk devices from different channels in Internet services, wherein the Internet services may be services provided by various Internet service platforms, and the Internet service platforms may be online shopping platforms, online car-hailing platforms, sharing platforms, search platforms, social platforms, etc. As long as they are multi-tasking, they can be applicable, and the present invention does not make specific limitations. The different channels may correspond to different Internet service platforms, that is, one channel corresponds to one Internet service platform. Figure 1 As shown, the method includes:

[0046] S1. Obtain original device sample data from multiple channels;

[0047] In the embodiment of the present invention, different channels are configured with corresponding application programming interfaces (APIs), and the original sample data of each channel needs to be obtained through the corresponding APIs. For example, if the channel is a search platform, the original device sample data of the channel needs to be obtained through the API corresponding to the search platform; if the channel is a taxi platform, the original device sample data of the channel needs to be obtained through the API of the taxi platform.

[0048] The original device sample data may be any data related to the device; illustratively, the original device sample data may include: device ID and information related to the device ID. Optionally, the information related to the device ID may include: at least one of: device model, device location, device resource return record, device communication record, and device user information.

[0049] Among them, the device resource return record refers to the record of whether the resource is returned on time after the device applies for the resource. The resource refers to any material, information, money, time, etc. that can be used. Information resources include computing resources and various types of data resources. Data resources include various special data in various fields. The device communication record may include the address book contacts stored in the device, the communication records stored in the device, and other communication-related information. The device user information may include: the gender, age, education level, fraud record, violation record, etc. of the user using the device.

[0050] S2. configuring a unified standard for identifying risky devices in the multiple channels, and labeling data in the original device sample data that meets the unified standard;

[0051] In the embodiment of the present invention, the unified standard can be configured according to the risk category. In principle, it is only necessary to unify the standards for identifying risky devices through various channels.

[0052] In one example, the risk category is fraud risk, and the unified standard for identifying risky devices in the multiple channels can be configured as: identifying device IDs that have communicated with blacklisted devices in device communication records as risky devices; where blacklisted devices refer to devices with fraud records. Alternatively, device IDs that have fraud records in device user information can be identified as risky devices.

[0053] In another example, the risk category is overdue risk, and the device ID in which the device resource return record shows that the resources have not been returned on time can be identified as a risky device; or, the device ID in which the device resource return record shows that the resources have not been returned on time and the overdue return time is greater than the preset time can be identified as a risky device.

[0054] In another example, the risk category is illegal and irregular risk, and the device ID with illegal and irregular records in the device user information can be configured to be identified as a risky device.

[0055] The labeling process can be done manually or through labeling models or other methods. For example, for fraud risk, the device IDs that have communicated with blacklisted devices in the device communication records can be labeled.

[0056] During the labeling process, there may be a risk device that has been in use for a relatively short time, and the corresponding original device sample data has not yet appeared in time to meet the unified standards for risk devices; for example: the collected device communication records have not yet shown any records of communication with blacklisted devices, which means that the performance period of the sample data is too short to accurately label the data, resulting in inaccurate labeling of risk devices. To this end, before labeling, data with a device usage time less than the preset time can be removed from the original device sample data. The preset time can be set to 6 months, 1 year, etc. In addition, the original device sample data can be updated regularly to ensure that the updated data has a sufficient performance period, thereby improving the accuracy of labeling.

[0057] In addition, the present invention can also be applied to the field of image recognition to identify unqualified products. The original sample data is: finished product appearance images from different channels. Among them, the channels can correspond to different image shooting positions. In one example, the unified standard for identifying unqualified products in the multiple channels can be configured as: images whose image contours in the finished product appearance images are inconsistent with the standard contours are identified as unqualified products. Exemplarily, the data that meets the unified standard in the original sample data can be obtained by a contour extraction method and labeled.

[0058] Furthermore, the present invention can also be applied to the field of audio recognition to identify unqualified audio in a dialogue system. The original sample data is: audio data from different channels, where the channels can correspond to different dialogue scenarios. In one example, a unified standard for identifying unqualified audio in the multiple channels can be configured as: audio data with blank audio duration greater than a preset value is identified as unqualified audio, or audio data with specified audio content is identified as unqualified audio. The specified audio content can be impolite, uncivilized language, etc.

[0059] S3, extracting the risky equipment data with labels from the original equipment sample data as training samples to train a single classification model;

[0060] In the present invention, the single classification model maps the risky device data to a multi-dimensional space by learning the risky device data, and obtains the minimum boundary of the risky device data under constraint conditions, and identifies the risky devices through the boundary.

[0061] In one example, the single-class model includes:

[0062] A sub-training module, used for mapping the training samples into sample data points in a multi-dimensional space and determining the boundaries containing the sample data points;

[0063] The sub-identification module is used to map the test samples into test data points in a multi-dimensional space and identify the test data points within the boundary as risky devices.

[0064] Preferably, the boundary is spherical, and the sub-training module determines the center and radius of the smallest sphere containing all sample data points, and determines the boundary based on the center and radius.

[0065] In addition, in order to cover as many sample data points as possible with the smallest radius, the sub-training module determines the center and radius of the smallest sphere containing a predetermined proportion of sample data points, and determines the boundary according to the center and radius.

[0066] Among them, the sub-training module can be under the constraint condition: (x i -a) T (x i -a)≤R 2 +ε i ; ε i ≥0, minimize the objective function to determine the center and radius of the minimum sphere containing a predetermined proportion of sample data points. The objective function is:

[0067]

[0068] In the above constraints and objective functions, a is the center of the sphere, R is the radius, and x is i is the sample data point, N is the total number of data points, ε i is the maximum distance of the ith data point outside the boundary, and T is the transpose.

[0069] In another example, the training module can determine the center and radius of the sphere with the most sample data points and the smallest radius in an iterative manner. During the iteration process, the center O1 and radius R1 of the smallest sphere containing all sample data points, the center O2 and radius R2 of the smallest sphere containing the first predetermined proportion of sample data points, ..., the center On and radius Rn of the smallest sphere containing the Nth predetermined proportion of sample data points are determined in sequence, and the center and radius with the smallest ratio between the i-th radius Ri and the corresponding i-th predetermined proportion are taken as the center and radius of the sphere with the most sample data points and the smallest radius; wherein the predetermined proportion refers to the proportion of the sample data points, and the intervals between the proportions of two adjacent predetermined proportions are equal. For example, N=3, during the iteration process, the center O1 and radius R1=0.3 of the smallest sphere containing all sample data points are determined, the center O2 and radius R2=0.2 of the smallest sphere containing 90% of the sample data points, and the center O3 and radius R3=0.18 of the smallest sphere containing 80% of the sample data points are determined. Then: 0.3 / 1 is greater than 0.18 / 80% and greater than 0.2 / 90%, and the center O2 and radius R2 are taken as the center and radius of the sphere with the most sample data points and the smallest radius.

[0070] S4. Identify risky devices accessed through different channels based on the trained single classification model.

[0071] For example, device data from different channels can be obtained through different APIs, the device data can be input into a trained single-classification model, and risky devices can be identified based on the output results of the single-classification model.

[0072] Figure 2 The present invention is a single-classification-based API risk device identification device, which is used to identify risk devices from different channels in Internet services, such as Figure 2 As shown, the device comprises:

[0073] An acquisition module 21 is used to acquire original device sample data from multiple channels;

[0074] A labeling module 22, configured to configure a unified standard for identifying risky devices in the multiple channels, and label the data in the original device sample data that meets the unified standard;

[0075] A training module 23 is used to extract the risky device data with labels from the original device sample data as training samples to train a single classification model;

[0076] The identification module 24 is used to identify risky devices accessed through different channels based on the trained single classification model.

[0077] In one embodiment, the single-class model includes:

[0078] A sub-training module, used for mapping the training samples into sample data points in a multi-dimensional space and determining the boundaries containing the sample data points;

[0079] The sub-identification module is used to map the test samples into test data points in a multi-dimensional space and identify the test data points within the boundary as risky devices.

[0080] Optionally, the boundary is spherical, and the sub-training module determines the center and radius of the smallest sphere containing all sample data points, and determines the boundary based on the center and radius.

[0081] Optionally, the boundary is spherical, and the sub-training module determines the center and radius of a minimum sphere that contains a predetermined proportion of sample data points, and determines the boundary based on the center and radius.

[0082] In one example, the original device sample data includes: device ID and information related to the device ID. The information related to the device ID includes: device model, device location, device resource return record, and at least one of device communication records; the annotation module 22 configures the unified standard for identifying risky devices in the multiple channels as follows: identifying device IDs that have not been returned on time in the device resource return record and / or have communicated with blacklisted devices in the device communication record as risky devices.

[0083] Those skilled in the art will appreciate that the modules in the above device embodiments may be distributed in the device as described, or may be changed accordingly and distributed in one or more devices different from the above embodiments. The modules in the above embodiments may be combined into one module, or may be further split into multiple submodules.

[0084] The electronic device embodiment of the present invention is described below, and the electronic device can be regarded as a physical implementation of the method and device embodiments of the present invention described above. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0085] Figure 3 is a structural block diagram of an exemplary embodiment of an electronic device according to the present invention. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0086] like Figure 3As shown, the electronic device 300 of this exemplary embodiment is in the form of a general data processing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different electronic device components (including the storage unit 320 and the processing unit 310), a display unit 340, etc.

[0087] The storage unit 320 stores a computer-readable program, which may be a source program or a code of a read-only program. The program may be executed by the processing unit 310, so that the processing unit 310 performs the steps of various embodiments of the present invention. For example, the processing unit 310 may perform the following steps: Figure 1 Steps shown.

[0088] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 3201 and / or a cache storage unit 3202, and may further include a read-only storage unit (ROM) 3203. The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: operating the electronic device, one or more application programs, other program modules, and program data, each of which or some combination may include the implementation of a network environment.

[0089] Bus 330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0090] The electronic device 300 may also communicate with one or more external devices 100 (e.g., keyboard, display, network device, Bluetooth device, etc.) so that a user can interact with the electronic device 300 via these external devices 300, and / or the electronic device 300 can communicate with one or more other data processing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 350, and may also be performed through a network adapter 360 with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet). The network adapter 360 may communicate with other modules of the electronic device 300 via the bus 330. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in the electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID electronic devices, tape drives, and data backup storage electronic devices, etc.

[0091] Figure 4 Schematic diagram of a computer readable medium embodiment of the present invention. Figure 4 As shown, the computer program can be stored on one or more computer-readable media. The computer-readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electronic device, device or device of electrical, magnetic, optical, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. When the computer program is executed by one or more data processing devices, the computer-readable medium is enabled to implement the above method of the present invention, namely: obtaining raw device sample data of multiple channels; configuring a unified standard for identifying risky devices in the multiple channels, and labeling the data in the raw device sample data that meets the unified standard; extracting the risky device data labeled in the raw device sample data as training samples to train a single classification model; identifying risky devices accessed by different channels based on the trained single classification model.

[0092] Through the description of the above implementation modes, it is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation mode of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a data processing device (which can be a personal computer, a server, or a network device, etc.) to perform the above method according to the present invention.

[0093] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction-executing electronic device, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0094] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., as well as conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0095] In summary, the present invention can be implemented by a method, apparatus, electronic device or computer-readable medium that executes a computer program. In practice, a general data processing device such as a microprocessor or a digital signal processor (DSP) can be used to implement some or all functions of the present invention.

[0096] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the present invention is not inherently related to any specific computer, virtual device or electronic device, and various general devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying API risk devices based on single classification, used to identify risk devices from different channels in Internet services, characterized in that: The method comprises: Obtain original device sample data from multiple channels; one channel corresponds to one Internet service platform; Internet service platforms target different device groups, and device data from different Internet service platforms have differentiated characteristics; Configure a unified standard for identifying risky devices in the multiple channels according to the risk category, eliminate data with device usage time less than the preset time in the original device sample data, and label the data that meets the unified standard in the eliminated original device sample data; wherein: if the risk category is fraud risk, configure the unified standard for identifying risky devices in the multiple channels as follows: identify the device ID that has communicated with the blacklist device in the device communication record as a risky device; or, identify the device ID that has a fraud record in the device user information as a risky device; if the risk category is overdue risk, configure the unified standard for identifying risky devices in the multiple channels as follows: identify the device ID that has not returned resources on time in the device resource return record as a risky device; or, identify the device ID that has not returned resources on time in the device resource return record and the time of not returning on time is greater than the preset time as a risky device; if the risk category is illegal and irregular risk, configure the unified standard for identifying risky devices in the multiple channels as follows: identify the device ID that has a illegal and irregular record in the device user information as a risky device; Extract the labeled risky equipment data from the original equipment sample data as training samples to train a single classification model; Based on the trained single classification model, risky devices accessed through different channels are identified.

2. The method according to claim 1, characterized in that The single classification model includes: A sub-training module, used for mapping the training samples into sample data points in a multi-dimensional space and determining the boundaries containing the sample data points; The sub-identification module is used to map the test samples into test data points in a multi-dimensional space and identify the test data points within the boundary as risky devices.

3. The method according to claim 2, characterized in that The boundary is spherical, and the sub-training module determines the center and radius of the smallest sphere containing all sample data points, and determines the boundary according to the center and radius.

4. The method according to claim 2, characterized in that: The boundary is spherical, and the sub-training module determines the center and radius of the smallest sphere that contains a predetermined proportion of sample data points, and determines the boundary based on the center and radius.

5. The method according to any one of claims 1 to 4, characterized in that: The original device sample data includes: a device ID and information related to the device ID.

6. The method according to claim 5, characterized in that The information related to the device ID includes: device model, device location, device resource return record, and at least one of device communication records. The unified standard for identifying risky devices in the multiple channels is configured as follows: device IDs that have resources not returned on time in device resource return records and / or device communication records that communicate with blacklisted devices are identified as risky devices.

7. An API risk device identification device based on single classification, used to identify risk devices from different channels in Internet services, characterized in that: The device comprises: The acquisition module is used to obtain the original device sample data from multiple channels; one channel corresponds to one Internet service platform; the Internet service platforms are oriented to different device groups, and the device data of different Internet service platforms have differentiated characteristics; A labeling module is used to configure a unified standard for identifying risky devices in the multiple channels according to risk categories, eliminate data with device usage time less than a preset time in the original device sample data, and label the data that meets the unified standard in the eliminated original device sample data; wherein: if the risk category is fraud risk, the unified standard for identifying risky devices in the multiple channels is configured as follows: identifying the device ID that has communicated with the blacklist device in the device communication record as a risky device; or, identifying the device ID that has a fraud record in the device user information as a risky device; if the risk category is overdue risk, the unified standard for identifying risky devices in the multiple channels is configured as follows: identifying the device ID that has not returned resources on time in the device resource return record as a risky device; or, identifying the device ID that has not returned resources on time in the device resource return record and has not returned them on time for a period greater than a preset time as a risky device; if the risk category is illegal and irregular risk, the unified standard for identifying risky devices in the multiple channels is configured as follows: identifying the device ID that has a illegal and irregular record in the device user information as a risky device; A training module is used to extract the risky device data with labels from the original device sample data as training samples to train a single classification model; The identification module is used to identify risky devices accessed through different channels based on the trained single classification model.

8. The device according to claim 7, characterized in that The single classification model includes: A sub-training module, used for mapping the training samples into sample data points in a multi-dimensional space and determining the boundaries containing the sample data points; The sub-identification module is used to map the test samples into test data points in a multi-dimensional space and identify the test data points within the boundary as risky devices.

9. An electronic device, comprising: processor; as well as A memory storing computer executable instructions which, when executed, cause the processor to perform the method according to any one of claims 1-6.

10. A computer-readable storage medium, wherein: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images