Method and apparatus for generating information

Abstract

The embodiments of the present disclosure disclose a method and apparatus for generating information. A specific implementation of the method includes: obtaining the target device information of the terminal; in response to the presence of the target device information in a preset device fingerprint library, determining the device fingerprint identifier corresponding to the target device information as the target device fingerprint identifier, wherein the device fingerprint library includes a list of correspondences between device information and device fingerprint identifiers; determining the number of device information corresponding to the target device fingerprint; and generating the risk information of the terminal based on the correspondence between the preset risk level and the number of device information. Determining the target device fingerprint identifier of the terminal based on the target device information of the terminal, and then determining the risk information of the terminal based on the number of device information corresponding to the target device fingerprint can improve the accuracy of identifying high-risk terminals.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, specifically to the field of network technology, and particularly to a method and device for generating information. Background Art

[0002] In real life, the act of collecting information such as preferential promotions and free services from various channels such as major e-commerce platforms, banks, and physical stores, and selectively participating in activities to obtain material benefits at a relatively low cost or even zero cost is called "scraping wool", and the online group that is enthusiastic about "scraping wool" is called the "wool party". The wool party usually uses terminal devices to simulate the registration of a large number of false accounts. When the Internet platform conducts promotions or preferential activities, these false accounts are used to participate in the activities to brush more benefits, thereby obtaining benefits.

[0003] With the rapid rise of mobile Internet, Internet platforms are facing an increasingly high frequency of attacks by the "wool party" during operation, which has caused great trouble and relatively large economic losses to the business operation and user experience of Internet platforms. Therefore, Internet manufacturers need to identify risks at the device level.

[0004] In related technologies, the methods for identifying risks of terminal devices mainly include: constructing a graph based on the relationships between terminal devices, and identifying the risks of terminal devices by means of risk propagation or risk aggregation; and, simply summing up the various hardware parameters of the terminal device to obtain the device ID (Identity document) of the terminal device, and then identifying high-risk terminal devices based on the device ID. Summary of the Invention

[0005] Embodiments of the present disclosure propose a method and device for generating information.

[0006] In a first aspect, embodiments of the present disclosure provide a method for generating information, the method including: obtaining target device information of a terminal; in response to the existence of the target device information in a preset device fingerprint library, determining the device fingerprint identifier corresponding to the target device information, where the device fingerprint library includes a list of corresponding relationships between device information and device fingerprint identifiers; determining the number of device information corresponding to the target device fingerprint; generating risk degree information of the terminal based on a preset corresponding relationship between the risk degree and the number of device information.

[0007] In some embodiments, the method further includes: in response to the target device information not existing in the device fingerprint library, determining the device information with the highest similarity to the target device information from the device fingerprint library; determining the device information with the highest similarity to the target device information in the device fingerprint library as the reference device information; in response to the similarity between the reference device information and the target device information being greater than a preset similarity threshold, determining the device fingerprint identifier corresponding to the reference device information as the target device fingerprint identifier of the terminal.

[0008] In some embodiments, the device information includes a characteristic parameter sequence of the terminal, and the correspondence list also includes a first Sim hash value of each device information, and the first Sim hash value of each device information is generated by a first hash function based on the characteristic parameter sequence corresponding to the device information; the similarity between the device information in the device fingerprint library and the target device information is determined by the following steps: extracting the characteristic parameter sequence of the terminal from the target device information; using the first hash function to determine the Sim hash value of the characteristic parameter sequence of the terminal to obtain the first Sim hash value of the target device information; respectively determining the first Hamming distance between the first Sim hash value of each device information in the correspondence list and the first Sim hash value of the target device information; determining the first Hamming distance as the similarity between the device information in the correspondence list and the target device information; and, the similarity threshold includes a first Hamming distance threshold; in response to determining that the first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information is less than the first Hamming distance threshold, determining that the similarity between the reference device information and the target device information is greater than the similarity threshold.

[0009] In some embodiments, the device information also includes application information loaded on the terminal, and the correspondence list also includes a second Sim hash value of each device information, and the second Sim hash value of each device information is generated by a second hash function based on the application information loaded on the terminal; the similarity between the device information in the device fingerprint library and the target device information is determined by the following steps: obtaining an application list loaded on the terminal to obtain target application information; using a second hash function to determine the Sim hash value of the target application information to obtain a second Sim hash value of the target device information; determining a second Hamming distance between the second Sim hash value of each device information in the correspondence list and the second Sim hash value of the target device information; determining the similarity between the device information in the correspondence list and the target device information based on the first Hamming distance and the second Hamming distance; and the similarity threshold includes a first Hamming distance threshold and a second Hamming distance threshold; in response to the first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information being less than the first Hamming distance threshold and the second Hamming distance between the second Sim hash value of the reference device information and the second Sim hash value of the target device information being less than the second Hamming distance threshold, determining that the similarity between the reference device information and the target information is greater than the similarity threshold.

[0010] In some embodiments, the device fingerprint identification in the device fingerprint library is generated by a pre-trained fingerprint generation model through the following steps: extracting parameters of a preset type from the device information; using a third hash function to determine the Sim hash value of each preset type parameter respectively; determining the weighted sum of the Sim hash values ​​of each preset type parameter as the device fingerprint identification of the device information; the method also includes: in response to the similarity between the reference device information and the target device information being no greater than a preset similarity threshold, inputting the target device information into the fingerprint generation model to obtain the target device fingerprint identification; and determining the number of device information corresponding to the target device fingerprint to be 1.

[0011] In some embodiments, the method further includes: updating a device fingerprint library based on the target device information and the target device fingerprint identifier.

[0012] In a second aspect, an embodiment of the present disclosure provides a device for generating information, the device comprising: an information acquisition unit configured to acquire target device information of a terminal; a fingerprint determination unit configured to determine a device fingerprint identifier corresponding to the target device information as a target device fingerprint identifier in response to the presence of target device information in a preset device fingerprint library, the device fingerprint library including a list of correspondences between device information and device fingerprint identifiers; a quantity determination unit configured to determine the quantity of device information corresponding to the target device fingerprint; and an information generation unit configured to generate risk information of the terminal based on the correspondence between a preset risk level and the quantity of device information.

[0013] In some embodiments, the fingerprint determination unit further includes: a similarity determination module, configured to determine, in response to the absence of target device information in the device fingerprint library, device information with the highest similarity to the target device information from the device fingerprint library; a reference information determination module, configured to determine the device information with the highest similarity to the target device information in the device fingerprint library as the reference device information; and a fingerprint determination module, configured to determine, in response to the similarity between the reference device information and the target device information being greater than a preset similarity threshold, the device fingerprint identifier corresponding to the reference device information as the target device fingerprint identifier of the terminal.

[0014] In some embodiments, the device information includes a characteristic parameter sequence of the terminal, and the correspondence list also includes a first Sim hash value of each device information, and the first Sim hash value of each device information is generated by a first hash function based on the characteristic parameter sequence corresponding to the device information; the similarity determination module is further configured to: extract the characteristic parameter sequence of the terminal from the target device information; use the first hash function to determine the Sim hash value of the characteristic parameter sequence of the terminal to obtain the first Sim hash value of the target device information; determine the first Hamming distance between the first Sim hash value of each device information in the correspondence list and the first Sim hash value of the target device information respectively; determine the first Hamming distance as the similarity between the device information in the correspondence list and the target device information; and the similarity threshold includes a first Hamming distance threshold; the fingerprint determination module is further configured to: in response to determining that the first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information is less than the first Hamming distance threshold, determine that the similarity between the reference device information and the target device information is greater than the similarity threshold.

[0015] In some embodiments, the device information also includes application information loaded on the terminal, and the correspondence list also includes a second Sim hash value of each device information, and the second Sim hash value of each device information is generated by a second hash function based on the application information loaded on the terminal; the similarity determination unit is further configured to: obtain the application list loaded on the terminal to obtain target application information; use the second hash function to determine the Sim hash value of the target application information to obtain the second Sim hash value of the target device information; determine the second Hamming distance between the second Sim hash value of each device information in the correspondence list and the second Sim hash value of the target device information respectively; based on the first Hamming distance and the second Hamming distance, determine the similarity between the device information in the correspondence list and the target device information; and the similarity threshold includes a first Hamming distance threshold and a second Hamming distance threshold; the fingerprint determination module is further configured to: in response to the first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information being less than the first Hamming distance threshold and the second Hamming distance between the second Sim hash value of the reference device information and the second Sim hash value of the target device information being less than the second Hamming distance threshold, determine that the similarity between the reference device information and the target information is greater than the similarity threshold.

[0016] In some embodiments, the device fingerprint identification in the device fingerprint library is generated by a pre-trained fingerprint generation model through the following steps: extracting parameters of a preset type from the device information; using a third hash function to determine the Sim hash value of each preset type parameter respectively; determining the weighted sum of the Sim hash values ​​of each preset type parameter as the device fingerprint identification of the device information; the device also includes a fingerprint generation unit, which is configured to: in response to the similarity between the reference device information and the target device information being no greater than a preset similarity threshold, input the target device information into the fingerprint generation model to obtain the target device fingerprint identification; and determine the number of device information corresponding to the target device fingerprint to be 1.

[0017] In some embodiments, the apparatus further includes: an updating unit configured to update the device fingerprint library based on the target device information and the target device fingerprint identifier.

[0018] The method and apparatus for generating information provided by the embodiments of the present disclosure determine the target device fingerprint identification of the terminal based on the target device information of the terminal, and then determine the risk information of the terminal based on the amount of device information corresponding to the target device fingerprint, which can improve the accuracy of identifying high-risk terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Other features, objects and advantages of the present disclosure will become more apparent from a reading of the detailed description of non-limiting embodiments made with reference to the following drawings:

[0020] Figure 1 is an exemplary system architecture diagram in which some embodiments of the present disclosure may be applied;

[0021] Figure 2 is a flow chart of one embodiment of a method for generating information according to the present disclosure;

[0022] Figure 3 yes Figure 2 A schematic diagram of an application scenario of an embodiment of the method for generating information is shown;

[0023] Figure 4 is a flowchart of yet another embodiment of a method for generating information according to the present disclosure;

[0024] Figure 5 is a schematic structural diagram of an embodiment of an apparatus for generating information according to the present disclosure;

[0025] Figure 6 It is a schematic structural diagram of an electronic device suitable for implementing the embodiments of the present disclosure. DETAILED DESCRIPTION

[0026] The present disclosure will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are intended only to illustrate the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0027] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present disclosure can be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] Figure 1 An exemplary system architecture 100 is shown to which a method for generating information or an apparatus for generating information according to an embodiment of the present disclosure can be applied.

[0029] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. Network 104 is a medium for providing communication links between terminal devices 101, 102, 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0030] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104, sending user operation requests to the server and receiving information from the server. For example, a terminal device can obtain product information from the e-commerce platform's business server 105 via the network, then receive a user's purchase request and send it to server 105 to receive feedback from server 105, such as a prompt message indicating a successful purchase. For another example, a terminal device can also send acquired device information to the server and receive risk information returned by the server.

[0031] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be electronic devices with communication capabilities, including but not limited to smartphones, tablet computers, e-book readers, laptop computers, and desktop computers. When terminal devices 101, 102, and 103 are software, they can be installed in the electronic devices listed above. They can be implemented as multiple software programs or software modules, for example, to provide distributed services, or as a single software program or software module. This is not specifically limited here.

[0032] Server 105 can be a server that provides various services, such as a background server that processes the device information uploaded by terminal devices 101, 102, and 103 (determines the device fingerprint identifier corresponding to the device information and generates risk information), and feeds back the processing results (such as risk information) to the terminal device.

[0033] The backend server can also obtain device information of the terminal device through the network, and analyze, identify and process the device information to determine the risk level of the terminal device and generate risk information of the terminal device.

[0034] It should be noted that the method for generating information provided in the embodiments of the present disclosure can be executed by the server 105. Accordingly, the device for generating information can be provided in the server 105. This is not specifically limited here. It can also be executed by a terminal device, and accordingly, the device for generating information can be provided in the terminal device. This application does not limit this.

[0035] It should be noted that the server can be either hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When the server is software, it can be implemented as multiple software programs or software modules, for example, to provide distributed services, or as a single software program or software module. This is not specifically limited here.

[0036] Continue to refer Figure 2, shows a process 200 of an embodiment of a method for generating information according to the present disclosure. The method for generating information includes the following steps:

[0037] Step 201: Acquire target device information of the terminal.

[0038] In this embodiment, the target device information may include the hardware parameters of the terminal device, such as CPU (central processing unit) model, device model, UDID (Unique Device Identifier), IDFA (Identifier For Identifier), etc., and may also include other parameters of the terminal device, such as cellular mobile network IP address, wireless network ID, DNS (Domain Name System), WIFI IP, etc.

[0039] For example, when a user accesses a terminal device (e.g. Figure 1 The computer terminal or smart phone shown in Figure 1 When interacting with the server 105 shown in FIG, the execution entity may first obtain user authorization, for example, by presenting information to the user through registration guidance, in order to obtain permission to collect device information. The execution entity may then collect various parameters of the terminal device and generate a parameter sequence according to a preset order to obtain the target device information of the terminal.

[0040] Step 202: In response to the target device information existing in the preset device fingerprint library, the device fingerprint identifier corresponding to the target device information is determined as the target device fingerprint identifier. The device fingerprint library includes a list of correspondences between device information and device fingerprint identifiers.

[0041] In this embodiment, the device fingerprint identification is an identity identification of the terminal device generated by the execution entity based on the device information using a preset device fingerprint algorithm (for example, it can be a string generated by a hash mapping or other encryption algorithm), so as to mark the terminal device at the device's own parameter level and thereby identify the terminal device.

[0042] As an example, the execution entity may pre-store a device fingerprint library that includes a list of correspondences between device information and device fingerprint identifiers. Based on the target device information collected in step 201, the execution entity searches the device fingerprint library. If the target device information exists in the fingerprint library, the execution entity determines the target fingerprint identifier corresponding to the device information based on the list of correspondences between the device information and device fingerprint identifiers.

[0043] The execution entity can also extract various parameter information of the terminal from the target device information, such as the hardware parameters or other parameters of the terminal, and then set the parameter information as the retrieval condition to retrieve the device information pre-stored in the device fingerprint library. If the fingerprint library contains device information that meets the retrieval condition, the device fingerprint identifier corresponding to the device information is determined based on the correspondence list between the device information and the device fingerprint identifier, and the device fingerprint identifier is determined as the target device fingerprint identifier of the terminal.

[0044] Optionally, the device information may include the terminal ID of the terminal, which may be generated by the executing entity based on the user registration information uploaded by the terminal. Accordingly, the target device information includes the target terminal ID of the terminal. In this way, the executing entity can first search the device fingerprint library for the target terminal ID. If the target terminal ID exists in the device fingerprint library, the executing entity can determine the device information corresponding to the target terminal ID from the device fingerprint library. Then, based on the list of correspondences between device information and device fingerprint identifiers, the executing entity can determine the device fingerprint identifier corresponding to the device information, thereby obtaining the device fingerprint identifier of the terminal.

[0045] In a specific example of this implementation, the list of correspondences between device information and device fingerprint identifiers can be in the form shown in Table 1. The execution entity can first search the device fingerprint library for the target terminal identifier of the terminal. If the target terminal identifier exists in the device fingerprint library, the execution entity determines the target device fingerprint identifier corresponding to the target terminal identifier based on the list of correspondences between the device information and device fingerprint identifiers. If the target terminal identifier does not exist in the device fingerprint library, the execution entity sets the target device information as the search condition and searches the device fingerprint library again.

[0046] Table 1

[0047]

[0048] In some optional implementations of this embodiment, in response to the target device information not existing in the device fingerprint library, the device information with the highest similarity to the target device information is determined from the device fingerprint library; the device information with the highest similarity to the target device information in the device fingerprint library is determined as the reference device information; in response to the similarity between the reference device information and the target device information being greater than a preset similarity threshold, the device fingerprint identifier corresponding to the reference device information is determined as the target device fingerprint identifier of the terminal.

[0049] In this implementation, the higher the similarity between device information, the higher the probability that the terminal devices represented by the device information are the same terminal device. A similarity threshold can be pre-set. If the similarity between two pieces of device information exceeds the threshold, it can be determined that the two pieces of device information correspond to the same device fingerprint, indicating that the two pieces of device information represent the same terminal device. This can improve the accuracy of identifying similar terminals.

[0050] For example, the execution entity can concatenate the various parameters of the terminal device into a string and use this string as the device information of the terminal device. Accordingly, the target device information is the string formed by concatenating the various parameters of the terminal. In this way, the execution entity can calculate the text similarity between the device information in the device fingerprint library and the target device information. This text similarity is the similarity between the device information and the target device information.

[0051] In a specific example of this implementation, the number of identical parameters contained in the device information can be used to represent similarity. Accordingly, the similarity threshold can be set to the number of identical parameters. In this way, when the execution entity uses the parameters in the target device information as search conditions and searches the device fingerprint library, the device information in the device fingerprint library can be sorted from largest to smallest according to the number of identical parameters. The device information ranked first is the reference device information. If the number of identical parameters between the reference device information and the target device information is greater than the preset number of identical parameters, the device fingerprint identifier corresponding to the reference information is determined as the target device fingerprint identifier.

[0052] In a further embodiment of the above-mentioned implementation, the device information includes a characteristic parameter sequence of the terminal, and the correspondence list also includes a first Sim hash value of each device information, and the first Sim hash value of each device information is generated by a first hash function based on the characteristic parameter sequence corresponding to the device information; the similarity between the device information in the device fingerprint library and the target device information is determined by the following steps: extracting the characteristic parameter sequence of the terminal from the target device information; using the first hash function to determine the Sim hash value of the characteristic parameter sequence of the terminal to obtain the first Sim hash value of the target device information; respectively determining the first Hamming distance between the first Sim hash value of each device information in the correspondence list and the first Sim hash value of the target device information; determining the first Hamming distance as the similarity between the device information in the correspondence list and the target device information; and, the similarity threshold includes a first Hamming distance threshold; in response to determining that the first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information is less than the first Hamming distance threshold, determining that the similarity between the reference device information and the target device information is greater than the similarity threshold.

[0053] In this embodiment, the first Sim-hash value is derived based on the device's characteristic parameter sequence, representing the device's parameter characteristics at the device level. Because both the first Sim-hash value of the target device information and the first Sim-hash value of the device information stored in the device fingerprint library are derived using the first hash function, the first Hamming distance represents the similarity between the target device information and the device information stored in the device fingerprint library. A smaller first Hamming distance indicates a higher degree of similarity. This further improves the accuracy and efficiency of identifying high-risk terminals.

[0054] As an example, the execution subject can extract the characteristic parameter sequence of the terminal from the target device information, and then connect the parameters in the parameter sequence into a string. The execution subject then uses a first hash function to map the string into a hash value, which is the first Sim hash value of the target device information. Thereafter, the execution subject can respectively calculate the first Hamming distance between the first Sim hash value of the device information pre-stored in the device fingerprint library and the first Sim hash value of the target device information, and determine the device information with the smallest first Hamming distance as the reference device information. If the first Hamming distance between the reference device information and the target device information is less than the preset first Hamming distance threshold, the device fingerprint identifier corresponding to the reference device information in the device information and device fingerprint identifier correspondence list is determined as the target device fingerprint identifier.

[0055] Optionally, the execution entity may also generate the first Sim hash value by using the first hash function to calculate each parameter in the device information respectively, obtain the hash value corresponding to each parameter, and then use the weighted sum of the hash values ​​of the parameters as the first Sim hash value of the device information.

[0056] Furthermore, the device information also includes application information loaded on the terminal, and the correspondence list also includes a second Sim hash value of each device information, and the second Sim hash value of each device information is generated by a second hash function based on the application information loaded on the terminal; the similarity between the device information in the device fingerprint library and the target device information is determined by the following steps: obtaining an application list loaded on the terminal to obtain target application information; using a second hash function to determine the Sim hash value of the target application information to obtain a second Sim hash value of the target device information; determining a second Hamming distance between the second Sim hash value of each device information in the correspondence list and the second Sim hash value of the target device information; determining the similarity between the device information in the correspondence list and the target device information based on the first Hamming distance and the second Hamming distance; and the similarity threshold includes a first Hamming distance threshold and a second Hamming distance threshold; in response to the first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information being less than the first Hamming distance threshold and the second Hamming distance between the second Sim hash value of the reference device information and the second Sim hash value of the target device information being less than the second Hamming distance threshold, determining that the similarity between the reference device information and the target information is greater than the similarity threshold.

[0057] Generally, there is a certain degree of overlap in the applications installed by the same user on different terminals. Therefore, in this implementation, the overlap of application information installed on the device is introduced into the calculation process of device information similarity, which can further improve the accuracy of risk identification.

[0058] In a specific example, the execution entity can obtain a list of applications installed on the terminal, and then combine the names of the various applications in the application list into a string to obtain the target application information of the terminal. Subsequently, a second hash function is used to map the target application information into a second Sim hash value. The execution entity then calculates the first Hamming distance and the second Hamming distance between the target device information and the device information pre-stored in the device fingerprint library, and uses the weighted sum of the first and second Hamming distances as the similarity to determine the reference device information. Subsequently, if the first and second Hamming distances corresponding to the reference device information are both less than a preset distance threshold, the device fingerprint identifier corresponding to the reference device information in the list of correspondences between device information and device fingerprint identifiers is determined as the target device fingerprint identifier.

[0059] Step 203: Determine the amount of device information corresponding to the target device fingerprint.

[0060] In this embodiment, the execution entity may determine the number of device information corresponding to the same device fingerprint identifier from the list of correspondences between device information and device fingerprint identifiers.

[0061] Step 204: Generate risk degree information of the terminal based on the correspondence between the preset risk degree and the quantity of device information.

[0062] In real life, collecting information such as preferential promotions and free services from various channels like major e-commerce platforms, banks, and physical stores, and selectively participating in activities to obtain material benefits at a relatively low cost or even zero cost. This behavior is called "scraping wool", and the online group enthusiastic about "scraping wool" is called the "wool party". The "wool party" has caused great troubles to the business operations and user experiences of Internet platforms. Therefore, Internet manufacturers need to identify risks at the device level.

[0063] Generally, the more device information corresponds to the same device fingerprint identifier, the greater the probability that the device corresponding to the device fingerprint identifier is a virtual device label. Considering the actual scenario, the greater the probability that the device corresponding to the device fingerprint identifier is operated by the "wool party".

[0064] In this embodiment, the risk degree information is used to represent the probability that the terminal is a high-risk device. For example, it can be the probability that the wool party operates the terminal to make a profit.

[0065] As an example, the execution entity can pre-store a correspondence list of risk levels and quantities as shown in Table 2. In this way, the execution entity can determine the risk level of the terminal based on the quantity of device information corresponding to the target device fingerprint identifier obtained in Step 203, and generate risk degree information based on the risk level of the terminal.

[0066] Table 2

[0067]

[0068] Continue to refer to Figure 3 , Figure 3 is a schematic diagram of an application scenario of an embodiment of the method shown in Figure 2. In Figure 3In the example, server 304 can be a business server of an e-commerce platform, and users can interact with server 304 through terminal devices 301, 302, and 303. For example, they can register an account on the e-commerce platform and participate in promotional activities launched by the e-commerce platform. The execution subject is server 304, which can collect target device information of terminal devices 301, 302, and 303 through the network, which are target device information 1, target device information 2, and target device information 3, respectively. Afterwards, the server inputs target device information 1, target device information 2, and target device information 3 into a pre-configured device fingerprint library, determines the corresponding target device fingerprint identification 1, target device fingerprint identification 2, and target device fingerprint identification 3, as well as the number of device information corresponding to each target device fingerprint identification, and finally determines the risk level of the terminal according to the number of device information corresponding to each target device fingerprint identification, that is, obtains the risk information of the terminal. The higher the risk level, the greater the probability that the terminal is operated by a wool party.

[0069] The method and apparatus for generating information provided by the embodiments of the present disclosure determine the target device fingerprint identification of the terminal based on the target device information of the terminal, and then determine the risk information of the terminal based on the amount of device information corresponding to the target device fingerprint, which can improve the accuracy of identifying high-risk terminals.

[0070] Further references Figure 4 , which shows a process 400 of another embodiment of a method for generating information. The process 400 of the method for generating information includes the following steps:

[0071] Step 401: Acquire target device information of the terminal. This step corresponds to the aforementioned step 201 and will not be described again here.

[0072] Step 402 : In response to the target device information not existing in the device fingerprint database, device information having the highest similarity to the target device information is determined from the device fingerprint database.

[0073] Step 403: Determine the device information in the device fingerprint database that has the highest similarity to the target device information as the reference device information.

[0074] Step 404 : In response to the similarity between the reference device information and the target device information being no greater than a preset similarity threshold, the target device information is input into a pre-trained fingerprint generation model to obtain a target device fingerprint identifier.

[0075] In this embodiment, the device fingerprint identifier in the device fingerprint library is generated by a pre-trained fingerprint generation model through the following steps: extracting preset parameters from the device information; using a third hash function to determine the Sim hash value of each preset parameter; and determining the device fingerprint identifier of the device information by taking the weighted sum of the Sim hash values ​​of each preset parameter. The preset parameters may include, for example, the hardware parameters and other parameters described in the above examples. For example, a machine learning model such as a regression model, a support vector machine, or a decision tree may be used as the fingerprint generation model.

[0076] As an example, the execution entity can construct an initial fingerprint generation model and build a sample set based on the device information of the terminal device. Each training sample in the sample set is labeled with the sample device fingerprint. The execution entity then inputs the training samples into the initial fingerprint generation model, using the sample device fingerprint labeled with the training samples as the desired output. The initial fingerprint generation model is trained using machine learning methods to learn the weights of various parameters. The trained fingerprint generation model is obtained until the loss function converges.

[0077] As an example, the execution entity can input the target device information into the fingerprint generation model to extract preset types of target parameters from the target device information; then use the third hash function to map each type of target parameter into a Sim hash value; finally, based on the weights learned by the fingerprint generation model during the training process, each type of target parameter is mapped into a weighted sum of the Sim hash values ​​to obtain the target device fingerprint identification.

[0078] Step 405: The number of device information corresponding to the target device fingerprint is determined to be 1.

[0079] Step 406: Generate risk information of the terminal based on the correspondence between the preset risk and the amount of device information.

[0080] In this embodiment, there is no device fingerprint identifier corresponding to the target device information in the device fingerprint database. The device information corresponding to the target device fingerprint identifier is only one piece of target device information. Therefore, the risk information finally obtained is the lowest level.

[0081] from Figure 4 As can be seen, process 400 of the method for generating information in this embodiment demonstrates that, when a device fingerprint identifier corresponding to the target device information does not exist in the device fingerprint library, a pre-trained fingerprint generation model can be used to generate a target device fingerprint identifier based on the target device information. Using a machine learning model to generate a device fingerprint identifier based on device information avoids the low terminal device identification capability of simply summing device parameters to generate a device fingerprint, thereby improving the accuracy of identifying high-risk terminals.

[0082] In some optional implementations of the above embodiment, the method further includes: updating the device fingerprint library based on the target device information and the target device fingerprint identifier.

[0083] In this implementation, if the target device information and its corresponding target device fingerprint identifier exist in the device fingerprint library, there is no need to update the device fingerprint library.

[0084] If the target device information does not exist in the device fingerprint library, but the target device fingerprint identifier is determined through the similarity of the device information, the corresponding relationship between the target device information and the target device fingerprint identifier is added to the device fingerprint library, and the number of device information corresponding to the target device fingerprint identifier is updated.

[0085] If the target device information and the target device fingerprint identifier do not exist in the device fingerprint library, a corresponding relationship between the target device information and the target device fingerprint identifier is added to the device fingerprint library, and the number of device information corresponding to the target device fingerprint identifier is set to 1.

[0086] In this way, the timeliness of the data in the device fingerprint library can be ensured.

[0087] Further references Figure 5 As an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of a device for generating information. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0088] like Figure 5 As shown, the device 500 for generating information in this embodiment includes: an information acquisition unit 501, configured to acquire target device information of the terminal; a fingerprint determination unit 502, configured to determine the device fingerprint identifier corresponding to the target device information as the target device fingerprint identifier in response to the existence of the target device information in a preset device fingerprint library, and the device fingerprint library includes a list of correspondences between device information and device fingerprint identifiers; a quantity determination unit 503, configured to determine the number of device information corresponding to the target device fingerprint; an information generation unit 504, configured to generate risk information of the terminal based on the correspondence between the preset risk level and the number of device information.

[0089] In this embodiment, the fingerprint determination unit 502 further includes: a similarity determination module, configured to, in response to the target device information not existing in the device fingerprint library, determine the device information with the highest similarity to the target device information from the device fingerprint library; a reference information determination module, configured to determine the device information with the highest similarity to the target device information in the device fingerprint library as the reference device information; and a fingerprint determination module, configured to, in response to the similarity between the reference device information and the target device information being greater than a preset similarity threshold, determine the device fingerprint identifier corresponding to the reference device information as the target device fingerprint identifier of the terminal.

[0090] In this embodiment, the device information includes a characteristic parameter sequence of the terminal, and the correspondence list also includes a first Sim hash value of each device information, and the first Sim hash value of each device information is generated by a first hash function based on the characteristic parameter sequence corresponding to the device information; the similarity determination module is further configured to: extract the characteristic parameter sequence of the terminal from the target device information; use the first hash function to determine the Sim hash value of the characteristic parameter sequence of the terminal to obtain the first Sim hash value of the target device information; determine the first Hamming distance between the first Sim hash value of each device information in the correspondence list and the first Sim hash value of the target device information respectively; determine the first Hamming distance as the similarity between the device information in the correspondence list and the target device information; and the similarity threshold includes a first Hamming distance threshold; the fingerprint determination module is further configured to: in response to determining that the first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information is less than the first Hamming distance threshold, determine that the similarity between the reference device information and the target device information is greater than the similarity threshold.

[0091] In this embodiment, the device information also includes application information loaded on the terminal, and the correspondence list also includes a second Sim-hash value of each device information, where the second Sim-hash value of each device information is generated by a second hash function based on the application information loaded on the terminal; the similarity determination unit is further configured to: obtain the application list loaded on the terminal to obtain target application information; use the second hash function to determine the Sim-hash value of the target application information to obtain the second Sim-hash value of the target device information; determine the second Hamming distance between the second Sim-hash value of each device information in the correspondence list and the second Sim-hash value of the target device information; determine the similarity between the device information in the correspondence list and the target device information based on the first Hamming distance and the second Hamming distance; and the similarity threshold includes a first Hamming distance threshold and a second Hamming distance threshold; the fingerprint determination module is further configured to: in response to the first Hamming distance between the first Sim-hash value of the reference device information and the first Sim-hash value of the target device information being less than the first Hamming distance threshold and the second Hamming distance between the second Sim-hash value of the reference device information and the second Sim-hash value of the target device information being less than the second Hamming distance threshold, determine that the similarity between the reference device information and the target information is greater than the similarity threshold.

[0092] In this embodiment, the device fingerprint identification in the device fingerprint library is generated by a pre-trained fingerprint generation model through the following steps: extracting parameters of a preset type from the device information; using a third hash function to determine the Sim hash value of each preset type parameter respectively; determining the weighted sum of the Sim hash values ​​of each preset type parameter as the device fingerprint identification of the device information; the device 500 also includes a fingerprint generation unit, which is configured to: in response to the similarity between the reference device information and the target device information being no greater than a preset similarity threshold, input the target device information into the fingerprint generation model to obtain the target device fingerprint identification; and determine the number of device information corresponding to the target device fingerprint to be 1.

[0093] In this embodiment, the apparatus 500 further includes: an updating unit configured to update the device fingerprint library based on the target device information and the target device fingerprint identifier.

[0094] Reference below Figure 6 , which shows an electronic device (eg, Figure 1 The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), and PADs (tablet computers), as well as fixed terminals such as digital TVs and desktop computers. Figure 6The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0095] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0096] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead. Figure 6 Each block shown in the figure may represent one device, or may represent multiple devices as needed.

[0097] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed. It should be noted that the computer-readable medium described in the embodiment of the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, an electromagnetic signal, an optical signal, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wire, optical cable, RF (radio frequency), etc., or any suitable combination thereof.

[0098] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: obtain target device information of the terminal; in response to the presence of the target device information in a preset device fingerprint library, determine the device fingerprint identifier corresponding to the target device information as the target device fingerprint identifier, wherein the device fingerprint library includes a list of correspondences between device information and device fingerprint identifiers; determine the amount of device information corresponding to the target device fingerprint; and generate risk information for the terminal based on the correspondence between the preset risk level and the amount of device information.

[0099] Computer program code for performing the operations of embodiments of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0100] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0101] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The units described may also be provided in a processor. For example, they may be described as follows: a processor includes an information acquisition unit, a fingerprint determination unit, a quantity determination unit, and an information generation unit. The names of these units do not, in some cases, constitute limitations on the units themselves. For example, the information acquisition unit may also be described as a "unit for acquiring target device information of a terminal."

[0102] The above description is merely a preferred embodiment of the present disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also encompass other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned inventive concept. For example, a technical solution formed by mutually replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A method for generating information, wherein: include: Get the target device information of the terminal; In response to the target device information existing in a preset device fingerprint library, determining the device fingerprint identifier corresponding to the target device information as the target device fingerprint identifier, the device fingerprint library including a correspondence list between device information and device fingerprint identifiers, the device information including a characteristic parameter sequence of a terminal, the correspondence list also including a first Sim hash value of each piece of device information, the first Sim hash value of each piece of device information being generated by a first hash function based on the characteristic parameter sequence corresponding to the device information; Determining the amount of device information corresponding to the target device fingerprint; generating risk information of the terminal based on a correspondence between a preset risk level and the amount of device information; In response to the target device information not existing in the device fingerprint library, determining reference device information having the highest similarity to the target device information from the device fingerprint library; In response to the similarity between the reference device information and the target device information being greater than a preset similarity threshold, the device fingerprint identifier corresponding to the reference device information is determined as the target device fingerprint identifier of the terminal, and the corresponding relationship between the target device information and the target device fingerprint identifier is added to the device fingerprint library, and the number of device information corresponding to the target device fingerprint identifier is updated.

2. The method according to claim 1, wherein The similarity between the device information in the device fingerprint library and the target device information is determined by the following steps: extracting the characteristic parameter sequence of the terminal from the target device information; using the first hash function to determine the Sim hash value of the characteristic parameter sequence of the terminal to obtain a first Sim hash value of the target device information; Determine the first Hamming distance between the first Sim hash value of each device information in the correspondence list and the first Sim hash value of the target device information respectively; determine the first Hamming distance as the similarity between the device information in the correspondence list and the target device information; And, the similarity threshold includes a first Hamming distance threshold; In response to determining that a first Hamming distance between the first Sim-hash value of the reference device information and the first Sim-hash value of the target device information is less than the first Hamming distance threshold, determining that the similarity between the reference device information and the target device information is greater than the similarity threshold.

3. The method according to claim 2, wherein: The device information also includes application information loaded on the terminal, and the correspondence list also includes a second Sim hash value of each device information, where the second Sim hash value of each device information is generated by a second hash function based on the application information loaded on the terminal; The similarity between the device information in the device fingerprint library and the target device information is determined by the following steps: obtaining a list of applications loaded on the terminal to obtain target application information; using the second hash function to determine a Sim hash value of the target application information to obtain a second Sim hash value of the target device information; Determine the second Hamming distance between the second Sim hash value of each device information in the correspondence list and the second Sim hash value of the target device information respectively; determine the similarity between the device information in the correspondence list and the target device information based on the first Hamming distance and the second Hamming distance; And, the similarity threshold includes a first Hamming distance threshold and a second Hamming distance threshold; In response to a first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information being less than the first Hamming distance threshold and a second Hamming distance between the second Sim hash value of the reference device information and the second Sim hash value of the target device information being less than the second Hamming distance threshold, it is determined that the similarity between the reference device information and the target device information is greater than the similarity threshold.

4. The method according to claim 1, wherein The device fingerprint identifier in the device fingerprint library is generated by a pre-trained fingerprint generation model through the following steps: extracting parameters of a preset type from the device information; using a third hash function to determine the Sim hash value of each preset type parameter; Determine the weighted sum of the Sim hash values ​​of the preset type parameters as the device fingerprint identifier of the device information; The method further includes: in response to the similarity between the reference device information and the target device information being no greater than a preset similarity threshold, inputting the target device information into the fingerprint generation model to obtain the target device fingerprint identification; and determining the number of device information corresponding to the target device fingerprint to be 1.

5. The method according to any one of claims 1 to 4, further comprising: The device fingerprint database is updated based on the target device information and the target device fingerprint identifier.

6. A device for generating information, wherein: include: an information acquisition unit, configured to acquire target device information of a terminal; a fingerprint determination unit configured to, in response to the target device information existing in a preset device fingerprint library, determine the device fingerprint identifier corresponding to the target device information as the target device fingerprint identifier, wherein the device fingerprint library includes a correspondence list between device information and device fingerprint identifiers, the device information includes a characteristic parameter sequence of the terminal, and the correspondence list also includes a first Sim hash value of each piece of device information, where the first Sim hash value of each piece of device information is generated by a first hash function based on the characteristic parameter sequence corresponding to the device information; a quantity determining unit, configured to determine the quantity of device information corresponding to the target device fingerprint; an information generating unit configured to generate risk information of the terminal based on a correspondence between a preset risk level and an amount of device information; The fingerprint determination unit further includes: a similarity determination module, configured to, in response to the target device information not existing in the device fingerprint library, determine the device information with the highest similarity to the target device information from the device fingerprint library; a reference information determination module, configured to determine the device information with the highest similarity to the target device information in the device fingerprint library as the reference device information; and a fingerprint determination module, configured to, in response to the similarity between the reference device information and the target device information being greater than a preset similarity threshold, determine the device fingerprint identifier corresponding to the reference device information as the target device fingerprint identifier of the terminal, add a corresponding relationship between the target device information and the target device fingerprint identifier in the device fingerprint library, and update the number of device information corresponding to the target device fingerprint identifier.

7. The device according to claim 6, wherein The similarity determination module is further configured to: extract a characteristic parameter sequence of the terminal from the target device information; use the first hash function to determine a Sim hash value of the characteristic parameter sequence of the terminal to obtain a first Sim hash value of the target device information; Determine the first Hamming distance between the first Sim hash value of each device information in the correspondence list and the first Sim hash value of the target device information respectively; determine the first Hamming distance as the similarity between the device information in the correspondence list and the target device information; And, the similarity threshold includes a first Hamming distance threshold; The fingerprint determination module is further configured to: in response to determining that a first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information is less than the first Hamming distance threshold, determine that the similarity between the reference device information and the target device information is greater than the similarity threshold.

8. The device according to claim 7, wherein The device information also includes application information loaded on the terminal, and the correspondence list also includes a second Sim hash value of each device information, where the second Sim hash value of each device information is generated by a second hash function based on the application information loaded on the terminal; The similarity determination unit is further configured to: obtain a list of applications loaded on the terminal to obtain target application information; use the second hash function to determine a Sim hash value of the target application information to obtain a second Sim hash value of the target device information; Determine the second Hamming distance between the second Sim hash value of each device information in the correspondence list and the second Sim hash value of the target device information respectively; determine the similarity between the device information in the correspondence list and the target device information based on the first Hamming distance and the second Hamming distance; And, the similarity threshold includes a first Hamming distance threshold and a second Hamming distance threshold; The fingerprint determination module is further configured to: in response to a first Hamming distance between the first Sim hash value of the reference device information and the first Sim hash value of the target device information being less than the first Hamming distance threshold and a second Hamming distance between the second Sim hash value of the reference device information and the second Sim hash value of the target device information being less than the second Hamming distance threshold, determine that the similarity between the reference device information and the target device information is greater than the similarity threshold.

9. The device according to claim 6, wherein The device fingerprint identification in the device fingerprint library is generated by a pre-trained fingerprint generation model through the following steps: extracting parameters of a preset type from the device information; using a third hash function to determine the Sim hash value of each of the preset type parameters; and determining the weighted sum of the Sim hash values ​​of the preset type parameters as the device fingerprint identification of the device information; The apparatus further includes a fingerprint generating unit configured to: in response to the similarity between the reference device information and the target device information being no greater than a preset similarity threshold, input the target device information into the fingerprint generating model to obtain a fingerprint identification of the target device; and The number of device information corresponding to the target device fingerprint is determined to be 1.

10. The device according to any one of claims 6 to 9, further comprising: An updating unit is configured to update the device fingerprint library based on the target device information and the target device fingerprint identifier.

11. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

12. A computer-readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images