Method, device and equipment for determining security level of user equipment

Abstract

The present disclosure relates to a method for determining the security level of a user device, which is applied to an Internet service platform. The method comprises: obtaining user device data, processing the user device data through a first security identification model to obtain a blacklist probability of the user device, and processing the user device data through a second security identification model to obtain a credit rating score of the user device. The security level of the user device is determined based on the blacklist probability of the user device and the credit rating score of the user device. In this way, the security level of the user device can be determined quickly and accurately, the timeliness of data security can be guaranteed, the security of protection system data can be strengthened, and the technical defects existing when using existing blacklists to determine whether a user device is safe can be effectively avoided.

Description

Technical Field

[0001] The present disclosure relates to the field of device data processing, and in particular to a method, apparatus, electronic device, and computer-readable medium for determining a security level of a user device. Background Art

[0002] With the rapid development of the internet, more and more users are using their devices to apply for internet resources on internet service platforms. For example, a user sends a resource request to an internet service platform using their device. After receiving the request, the platform verifies it against a pre-set blacklist to determine whether the user device is safe.

[0003] However, when implementing the inventive concept of the present invention, the inventors found that the relevant technology has at least the following technical problems: the existing blacklist has limitations, and it is difficult for the blacklist to take into account the timeliness of the data, which results in the inability to accurately determine the security level of the user device when verifying it using the above method.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0005] In view of this, the present disclosure provides a method, apparatus, electronic device and computer-readable medium for determining the security level of a user device, which can effectively avoid the technical defects existing when using existing blacklists to determine whether a user device is safe.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for determining the security level of a user device is proposed, which is applied to an Internet service platform, including: obtaining user device data; processing the user device data through a first security identification model to obtain a blacklist probability of the user device, wherein the first security identification model is trained based on blacklist data of multiple historical user devices, and the blacklist data is false information related to the historical user device and has nothing to do with the historical credit performance of the historical user device on the Internet service platform; processing the user device data through a second security identification model to obtain a credit evaluation score of the user device, wherein the second security identification model is trained based on credit data of multiple historical user devices, and the credit data is information related to the historical credit performance of the historical user device on the Internet service platform; and determining the security level of the user device based on the blacklist probability of the user device and the credit evaluation score of the user device.

[0008] Optionally, the method further includes: obtaining an Internet service request of the user equipment; and responding to the Internet service request of the user equipment according to the security level of the user equipment.

[0009] Optionally, responding to the Internet service request of the user equipment according to the security level of the user equipment includes: if the security level of the user equipment is a high level, passing the Internet service request of the user equipment; if the security level of the user equipment is a medium level, sending the Internet service request of the user equipment to the service end; if the security level of the user equipment is a low level, rejecting the Internet service request of the user equipment and returning a rejection message to the user equipment.

[0010] Optionally, determining the security level of the user equipment according to the blacklist probability of the user equipment and the credit evaluation score of the user equipment includes: when the blacklist probability of the user equipment is less than a first threshold and the credit evaluation score of the user equipment is greater than a second threshold, determining that the security level of the user equipment is a high level; when the blacklist probability of the user equipment is greater than or equal to the first threshold and the credit evaluation score of the user equipment is less than or equal to the second threshold, determining that the security level of the user equipment is a low level; when the blacklist probability of the user equipment is less than the first threshold and the credit evaluation score of the user equipment is less than or equal to the second threshold, determining that the security level of the user equipment is a medium level, or when the blacklist probability of the user equipment is greater than or equal to the first threshold and the credit evaluation score of the user equipment is greater than the second threshold, determining that the security level of the user equipment is a medium level.

[0011] Optionally, the method further includes: determining a threshold combination according to the Internet service type, the threshold combination including specific values of the first threshold and the second threshold; and for a specific Internet service type, determining different threshold combinations according to different device groups to which the user equipment belongs.

[0012] Optionally, for a specific Internet service type, the first threshold and the second threshold satisfy the following relationship: M = aT1+(1 - a)T2; where M is a service type value, related to the Internet service type and taking a fixed value, a is a blacklist influence factor, taking different values according to different device groups, a is proportional to the blacklist probability of the device group and satisfies 0 < a < 1, and T1 and T2 are the first threshold and the second threshold respectively.

[0013] Optionally, the method also includes: obtaining multiple historical user device data, wherein the historical user device data includes historical user device data of an internal Internet service platform and historical user device data of a third-party Internet service platform; cleaning the multiple historical user device data to obtain multiple target historical user device data; classifying the multiple target historical user device data to obtain blacklist data of multiple historical user devices and credit data of multiple historical user devices; training the first security identification model based on the blacklist data of the multiple historical user devices, and training the second security identification model based on the credit data of the multiple historical user devices.

[0014] Optionally, the method also includes: obtaining new user device data; classifying the new user device data to obtain blacklist data of the new user device and credit data of the new user device; updating the blacklist data of the multiple historical user devices based on the blacklist data of the new user device, and updating the credit data of the multiple historical user devices based on the credit data of the new user device; updating the first security identification model based on the updated blacklist data of the multiple historical user devices, and updating the second security identification model based on the updated credit data of the multiple historical user devices.

[0015] Optionally, the first security identification model is a first decision tree model, and the second security identification model is a second decision tree model.

[0016] According to one aspect of the present disclosure, a device for determining the security level of a user device is proposed, which is applied to an Internet service platform, including: a first acquisition module, used to acquire user device data; a first identification module, used to process the user device data through a first security identification model to obtain a blacklist probability of the user device, wherein the first security identification model is trained based on the blacklist data of multiple historical user devices, and the blacklist data is false information related to the historical user device and has nothing to do with the historical credit performance of the historical user device on the Internet service platform; a second identification module, used to process the user device data through a second security identification model to obtain a credit evaluation score of the user device, wherein the second security identification model is trained based on the credit data of multiple historical user devices, and the credit data is information related to the historical credit performance of the historical user device on the Internet service platform; a security level determination module, used to determine the security level of the user device based on the blacklist probability of the user device and the credit evaluation score of the user device.

[0017] Optionally, the device further includes: a second acquisition module, configured to acquire an Internet service request of the user device; and a response module, configured to respond to the Internet service request of the user device according to the security level of the user device.

[0018] Optionally, the response module is configured to: if the security level of the user device is a high level, pass the Internet service request of the user device; if the security level of the user device is a medium level, send the Internet service request of the user device to the service end; if the security level of the user device is a low level, reject the Internet service request of the user device and return a rejection message to the user device.

[0019] Optionally, the security level determination module is configured to: when the blacklist probability of the user device is less than a first threshold and the credit evaluation score of the user device is greater than a second threshold, determine that the security level of the user device is a high level; when the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determine that the security level of the user device is a low level; when the blacklist probability of the user device is less than the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determine that the security level of the user device is a medium level, or when the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is greater than the second threshold, determine that the security level of the user device is a medium level.

[0020] Optionally, the device further includes: a first threshold combination determination module, configured to determine a threshold combination according to the Internet service type, the threshold combination including specific values of the first threshold and the second threshold; and a second threshold combination determination module, configured to determine different threshold combinations according to different device groups to which the user device belongs for a specific Internet service type.

[0021] Optionally, for a specific Internet service type, the first threshold and the second threshold satisfy the following relationship: M = aT1+(1 - a)T2; where M is a service type value, related to the Internet service type and taking a fixed value, a is a blacklist influence factor, taking different values according to different device groups, a is proportional to the blacklist probability of the device group and satisfies 0 < a < 1, and T1 and T2 are the first threshold and the second threshold respectively.

[0022] Optionally, the device also includes: a third acquisition module, used to acquire multiple historical user device data, wherein the historical user device data includes historical user device data of an internal Internet service platform and historical user device data of a third-party Internet service platform; a cleaning processing module, used to clean the multiple historical user device data to obtain multiple target historical user device data; a first classification module, used to classify the multiple target historical user device data to obtain blacklist data of multiple historical user devices and credit data of multiple historical user devices; a training module, used to train the first security identification model based on the blacklist data of the multiple historical user devices, and to train the second security identification model based on the credit data of the multiple historical user devices.

[0023] Optionally, the device also includes: a fourth acquisition module for acquiring newly added user device data; a second classification module for classifying the newly added user device data to obtain blacklist data of the newly added user device and credit data of the newly added user device; a first update module for updating the blacklist data of the multiple historical user devices based on the blacklist data of the newly added user device, and updating the credit data of the multiple historical user devices based on the credit data of the newly added user device; a second update module for updating the first security identification model based on the updated blacklist data of the multiple historical user devices, and updating the second security identification model based on the updated credit data of the multiple historical user devices.

[0024] Optionally, the first security identification model is a first decision tree model, and the second security identification model is a second decision tree model.

[0025] According to one aspect of the present disclosure, an electronic device is proposed, which includes: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method as described above.

[0026] According to one aspect of the present disclosure, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0027] According to the method, device, electronic device and computer-readable medium for determining the security level of a user device disclosed in the present invention, user device data is obtained, the user device data is processed by a first security identification model to obtain the blacklist probability of the user device, and the user device data is processed by a second security identification model to obtain the credit rating score of the user device. The security level of the user device is determined based on the blacklist probability of the user device and the credit rating score of the user device. In this way, the security level of the user device can be determined quickly and accurately, the timeliness of data security can be guaranteed, the security of system data can be strengthened, and the technical defects that exist when using existing blacklists to determine whether a user device is safe can be effectively avoided.

[0028] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and other objects, features and advantages of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the accompanying drawings. The drawings described below are only some embodiments of the present disclosure, and it is obvious to those skilled in the art that other drawings can be derived from these drawings without inventive effort.

[0030] Figure 1 The present invention is a system block diagram showing a method and apparatus for determining a security level of a user equipment according to an exemplary embodiment.

[0031] Figure 2 The figure is a flowchart showing a method for determining a security level of a user equipment according to an exemplary embodiment.

[0032] Figure 3 The figure is a flowchart showing a method for determining a security level of a user equipment according to another exemplary embodiment.

[0033] Figure 4 The figure is a flowchart showing a method for determining a security level of a user equipment according to another exemplary embodiment.

[0034] Figure 5 The figure is a flowchart showing a method for determining a security level of a user equipment according to another exemplary embodiment.

[0035] Figure 6 The figure is a flowchart showing a method for determining a security level of a user equipment according to another exemplary embodiment.

[0036] Figure 7 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0037] Figure 8This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0038] Figure 9 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0039] Figure 10 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0040] Figure 11 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0041] Figure 12 It is a block diagram of an electronic device according to an exemplary embodiment.

[0042] Figure 13 It is a block diagram of a computer-readable medium according to an exemplary embodiment. DETAILED DESCRIPTION

[0043] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. Like reference numerals in the drawings represent like or similar parts, and thus repetitive description thereof will be omitted.

[0044] In addition, the described features, structures or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure can be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, well-known methods, devices, implementations or operations are not shown or described in detail to avoid blurring various aspects of the present disclosure.

[0045] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0046] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, while others may be combined or partially combined. Therefore, the actual execution order may vary depending on the actual situation.

[0047] It should be understood that although the terms first, second, third, etc. may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Thus, the first component discussed below can be referred to as the second component without departing from the teachings of the present disclosure. As used herein, the term "and / or" includes any one of the associated listed items and all combinations of one or more of them.

[0048] Those skilled in the art will understand that the drawings are merely schematic diagrams of example embodiments, and the modules or processes in the drawings are not necessarily necessary for implementing the present disclosure, and therefore cannot be used to limit the scope of protection of the present disclosure.

[0049] Figure 1 The present invention is a system block diagram showing a method and apparatus for determining a security level of a user equipment according to an exemplary embodiment.

[0050] like Figure 1 As shown, system architecture 100 may include one or more user terminals 101, 102, 103, a network 104, and a server 105. Network 104 is a medium for providing a communication link between user terminals 101, 102, 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0051] It should be understood that Figure 1 The number of user terminals, networks, and servers in the embodiment is merely illustrative. Any number of user terminals, networks, and servers may be provided as needed. For example, server 105 may be a server cluster consisting of multiple servers.

[0052] Users can use user terminals 101, 102, 103 to interact with server 105 via network 104 to receive or send messages, etc. User terminals 101, 102, 103 can be various electronic devices with display screens, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, etc.

[0053] Server 105 can be a server that provides various services. For example, server 105 can obtain data from user devices 101, 102, and 103, process the user device data using a first security identification model to obtain a blacklist probability for the user device. The first security identification model is trained based on blacklist data of multiple historical user devices. The blacklist data is fraudulent information related to the historical user devices and is unrelated to the historical credit performance of the historical user devices on the internet service platform. The second security identification model is trained based on credit data of multiple historical user devices. The credit data is information related to the historical credit performance of the historical user devices on the internet service platform. The security level of the user device is determined based on the blacklist probability and the credit score of the user device. In this way, the security level of the user device can be quickly and accurately determined, ensuring the timeliness of data security, strengthening the security of system data, and effectively avoiding the technical defects of using existing blacklists to determine whether a user device is secure.

[0054] In some embodiments, the method for determining the security level of a user device provided in embodiments of the present invention is generally executed by server 105. Accordingly, the device for determining the security level of the user device is generally located in server 105. In other embodiments, certain terminals may have similar functions to a server and thus execute the method. Therefore, the method for determining the security level of a user device provided in embodiments of the present invention is not limited to execution on the server side.

[0055] Figure 2 The figure is a flowchart showing a method for determining a security level of a user equipment according to an exemplary embodiment.

[0056] like Figure 2 As shown, the method for determining the security level of a user device applied to an Internet service platform includes steps S210 to S240.

[0057] In step S210, user equipment data is obtained.

[0058] In step S220, the user device data is processed by a first security identification model to obtain a blacklist probability of the user device. The first security identification model is trained based on the blacklist data of multiple historical user devices. The blacklist data is false information related to historical user devices and has nothing to do with the historical credit performance of historical user devices on the Internet service platform.

[0059] In step S230, the user device data is processed by a second security identification model to obtain a credit rating score of the user device. The second security identification model is trained based on the credit data of multiple historical user devices. The credit data is information related to the historical credit performance of historical user devices on the Internet service platform.

[0060] In step S240, the security level of the user equipment is determined according to the blacklist probability of the user equipment and the credit rating score of the user equipment.

[0061] The method can obtain user device data, process the user device data through a first security identification model to obtain the blacklist probability of the user device, and process the user device data through a second security identification model to obtain the credit evaluation score of the user device. The security level of the user device is determined based on the blacklist probability of the user device and the credit evaluation score of the user device. In this way, the security level of the user device can be determined quickly and accurately, the timeliness of data security can be guaranteed, the security of protection system data can be strengthened, and the technical defects existing when using existing blacklists to determine whether user devices are safe can be effectively avoided.

[0062] In one embodiment, the user device data may be user data associated with the user device. For example, the application data disclosed by a user using the user device on an internet service platform may include, but is not limited to, public information such as the user's name, ID number, occupation, age, place of origin, and annual income. For example, the user's historical performance data on the internet service platform may include the user's historical credit data.

[0063] In one embodiment, the first security identification model is a first decision tree model. The blacklist probability of the user device can be obtained by processing the application data through the first decision tree model.

[0064] In one embodiment, the second security identification model is a second decision tree model. The credit rating score of the user device can be obtained by processing the historical credit data through the second decision tree model.

[0065] In one embodiment, by processing user device data respectively through the above-mentioned first decision tree model and the above-mentioned second decision tree model, the blacklist probability of the user device and the credit rating score of the user device can be obtained, and based on the blacklist probability of the user device and the credit rating score of the user device, the security level of the user device can be quickly and accurately determined. Compared with using the existing blacklist to determine whether the user device is at risk, this method can better ensure the timeliness of the risk, and this method is highly scalable and can be applied to various scenarios, effectively avoiding the limitations of the existing blacklist.

[0066] In one embodiment, determining the security level of a user device based on the blacklist probability of the user device and the credit evaluation score of the user device can specifically include: when the blacklist probability of the user device is less than a first threshold and the credit evaluation score of the user device is greater than a second threshold, determining the security level of the user device is high; when the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determining the security level of the user device is low; when the blacklist probability of the user device is less than the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determining the security level of the user device is medium; or when the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is greater than the second threshold, determining the security level of the user device is medium. In this way, the specific security level of the user device can be quickly and accurately obtained, for example, low, medium, or high. In this embodiment, the Internet service platform can set different response strategies for user devices of different security levels. For example, for low-level user devices, the Internet service platform can directly send a message to the user device denying the user device access to the platform's resources. For mid-level user devices, the internet service platform can send the device data to relevant personnel for manual confirmation. Clear manual confirmation criteria are established to verify whether the user device poses corresponding risks before approving or rejecting the device. For high-level user devices, the internet service platform can label the device and monitor user behavior over a period of time to further determine the risk of the device.

[0067] In one embodiment, the first threshold and the second threshold can be set according to actual business scenarios and are not limited here.

[0068] Figure 3 The figure is a flowchart showing a method for determining a security level of a user equipment according to another exemplary embodiment.

[0069] like Figure 3 As shown, the above method may further include steps S310 to S320.

[0070] In step S310, an Internet service request of the user equipment is obtained.

[0071] In step S320, the Internet service request of the user equipment is responded to according to the security level of the user equipment.

[0072] The method can respond to the Internet service request of the user device according to the security level of the user device, so that the user device can be responded to in a targeted manner, further ensuring the data security of the Internet service platform.

[0073] In one embodiment, the security level of the user device can be low, medium, or high. The Internet service platform sets different response strategies for different security levels. For example, based on the security level of the user device, responding to the user device's Internet service request may specifically include: if the user device's security level is high, approving the user device's Internet service request; if the user device's security level is medium, sending the user device's Internet service request to the service end; and if the user device's security level is low, rejecting the user device's Internet service request and returning a rejection message to the user device.

[0074] Figure 4 The figure is a flowchart showing a method for determining a security level of a user equipment according to another exemplary embodiment.

[0075] like Figure 4 As shown, the above method may further include steps S410 to S420.

[0076] In step S410, a threshold combination is determined according to the Internet service type, where the threshold combination includes specific values ​​of the first threshold and the second threshold.

[0077] In step S420 , for a specific Internet service type, different threshold combinations are determined according to different device groups to which the user device belongs.

[0078] This method allows for flexible determination of threshold combinations based on the type of internet service, making the risk level determined based on this threshold combination more accurate. Furthermore, for specific internet service types, different threshold combinations can be determined based on the device groups to which the user device belongs. This allows for targeted determination of threshold combinations based on the device groups to which the user device belongs, making the security level determined based on this threshold combination more accurate.

[0079] In one embodiment, the aforementioned internet service types can be configured based on the actual business scenario. For example, if the business scenario is applying for financial resources, the internet service type can be large-value resources or small-value financial resources, etc. For another example, if the business scenario is shopping, the internet service type can be high-consumption products or low-consumption products, etc. For another example, if the business scenario is a taxi-hailing platform, the internet service type can be express, carpooling, premium car, etc.

[0080] In one embodiment, specific values ​​of the first threshold and the second threshold in the above threshold combination can be set according to historical Internet resource service data.

[0081] In one embodiment, the above-mentioned specific type of Internet service can be set according to the user attributes of the user using the user device. In this way, for a specific type of Internet service, different threshold combinations can be determined according to different device groups to which the user device belongs. In this embodiment, the device group may refer to the population to which the user device belongs. For example, the device group may refer to the devices of the population from a certain region. For another example, the device group may be the devices of a certain gender population. For another example, the device group may be the devices of a certain age group population. For another example, the device group may be the devices of the population with an annual income within a certain range.

[0082] In one embodiment, for a specific type of Internet service, the first threshold and the second threshold satisfy the following relationship:

[0083] M = aT1+(1 - a)T2

[0084] Where M is the service type value, which is related to the type of Internet service and takes a fixed value, a is the blacklist influence factor, which takes different values according to different device groups, a is proportional to the blacklist probability of the device group and satisfies 0 < a < 1, and T1 and T2 are the first threshold and the second threshold respectively.

[0085] Figure 5 It is a flowchart of a method for determining the security level of a user device shown according to another exemplary embodiment.

[0086] As Figure 5 shown, the above method may further include steps S510 to step S540.

[0087] In step S510, a plurality of historical user device data is obtained, and the historical user device data includes historical user device data of the internal Internet service platform and historical user device data of the third-party Internet service platform.

[0088] In step S520, the plurality of historical user device data is cleaned to obtain a plurality of target historical user device data.

[0089] In step S530, the plurality of target historical user device data is classified to obtain blacklist data of a plurality of historical user devices and credit data of a plurality of historical user devices.

[0090] In step S540, the first security recognition model is trained based on the blacklist data of the plurality of historical user devices, and the second security recognition model is trained based on the credit data of the plurality of historical user devices.

[0091] This method can train the first security identification model and the second security identification model respectively based on the blacklist data of multiple historical user devices and the credit data of multiple historical user devices from different data sources. The blacklist probability and credit evaluation score of the user device obtained by the first security identification model and the second security identification model trained in this way are more accurate when used.

[0092] In one embodiment, the blacklist data of the historical user devices may be fake information related to the historical user devices, such as user name, user ID number, user occupation, user age, user place of origin, user annual income, and other fake information.

[0093] In one embodiment, the above-mentioned historical credit data of the user device may be information related to the historical credit performance of the historical user device on the Internet service platform, such as a credit score.

[0094] Figure 6 The figure is a flowchart showing a method for determining a security level of a user equipment according to another exemplary embodiment.

[0095] like Figure 6 As shown, the above method may further include steps S510 to S540.

[0096] In step S610, newly added user equipment data is obtained.

[0097] In step S620, the newly added user equipment data is classified to obtain blacklist data of the newly added user equipment and credit data of the newly added user equipment.

[0098] In step S630, the blacklist data of the plurality of historical user devices is updated based on the blacklist data of the newly added user device, and the credit data of the plurality of historical user devices is updated based on the credit data of the newly added user device.

[0099] In step S640 , the first security identification model is updated based on the updated blacklist data of the plurality of historical user devices, and the second security identification model is updated based on the updated credit data of the plurality of historical user devices.

[0100] This method can update the blacklist data of multiple historical user devices based on the blacklist data of the newly added user device, and update the credit data of multiple historical user devices based on the credit data of the newly added user device. In this way, the first security identification model can be updated in a timely manner based on the updated blacklist data of the multiple historical user devices, and the second security identification model can be updated based on the updated credit data of the multiple historical user devices. In this way, the timeliness of the risk levels obtained using the updated first security identification model and the second security identification model can be ensured.

[0101] In one embodiment, newly added user device data is classified to obtain blacklist data and credit data for the newly added user device. For example, different classification rules are set for historical blacklist data and historical credit data for historical user devices. Based on the different classification rules, the newly added user device data is processed to obtain the blacklist data and credit data for the newly added user device.

[0102] Those skilled in the art will appreciate that all or part of the steps implementing the above embodiments can be implemented as a computer program executed by a CPU. When executed by the CPU, the computer program performs the functions defined in the above method provided by the present disclosure. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0103] Furthermore, it should be noted that the aforementioned figures are merely illustrative of the processes included in the methods according to exemplary embodiments of the present disclosure and are not intended to be limiting. It is readily understood that the processes illustrated in the aforementioned figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0104] The following are embodiments of the apparatus disclosed herein, which can be used to implement the method embodiments disclosed herein. For details not disclosed in the apparatus embodiments disclosed herein, please refer to the method embodiments disclosed herein.

[0105] Figure 7 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0106] like Figure 7 As shown, the apparatus 700 for determining the security level of the user equipment includes: a first acquisition module 701 , a first identification module 702 , a second identification module 703 and a security level determination module 704 .

[0107] Specifically, the first acquisition module 701 is configured to acquire user equipment data.

[0108] The first identification module 702 is used to process the user device data through a first security identification model to obtain a blacklist probability of the user device. The first security identification model is trained based on the blacklist data of multiple historical user devices. The blacklist data is fake information related to historical user devices and has nothing to do with the historical credit performance of the historical user devices on the Internet service platform.

[0109] The second identification module 703 is used to process the user device data through a second security identification model to obtain a credit rating score of the user device. The second security identification model is trained based on the credit data of multiple historical user devices. The credit data is information related to the historical credit performance of historical user devices on the Internet service platform.

[0110] The security level determination module 704 is configured to determine the security level of the user equipment according to the blacklist probability of the user equipment and the credit rating score of the user equipment.

[0111] The device 700 for determining the security level of the user device can obtain user device data, process the user device data through a first security identification model to obtain the blacklist probability of the user device, and process the user device data through a second security identification model to obtain the credit rating score of the user device. The security level of the user device is determined based on the blacklist probability of the user device and the credit rating score of the user device. In this way, the security level of the user device can be determined quickly and accurately, the timeliness of data security can be guaranteed, the security of system data can be strengthened, and the technical defects existing when using existing blacklists to determine whether user devices are safe can be effectively avoided.

[0112] According to an embodiment of the present invention, the device 700 for determining the security level of the user equipment can be used to implement Figure 2 The embodiment describes a method for determining the security level of a user equipment.

[0113] Figure 8 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0114] like Figure 8 As shown, the apparatus 700 for determining the security level of the user equipment may further include: a second acquisition module 705 and a response module 706 .

[0115] Specifically, the second obtaining module 705 is configured to obtain the Internet service request of the user equipment.

[0116] The response module 706 is configured to respond to the Internet service request of the user equipment according to the security level of the user equipment.

[0117] The device 700 for determining the security level of the user equipment can respond to the Internet service request of the user equipment according to the security level of the user equipment, so as to respond to the user equipment in a targeted manner and further ensure the data security of the Internet service platform.

[0118] Optionally, the above-mentioned response module 706 is configured to: if the security level of the user device is high, approve the Internet service request of the user device; if the security level of the user device is medium, send the Internet service request of the user device to the service end; if the security level of the user device is low, reject the Internet service request of the user device and return the rejection information to the user device.

[0119] Optionally, the above-mentioned security level determination module 704 is configured to: when the blacklist probability of the user device is less than a first threshold and the credit evaluation score of the user device is greater than a second threshold, determine that the security level of the user device is a high level; when the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determine that the security level of the user device is a low level; when the blacklist probability of the user device is less than the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determine that the security level of the user device is a medium level, or when the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is greater than the second threshold, determine that the security level of the user device is a medium level.

[0120] According to an embodiment of the present invention, the device 700 for determining the security level of the user equipment can be used to implement Figure 3 The embodiment describes a method for determining the security level of a user equipment.

[0121] Figure 9 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0122] like Figure 9 As shown, the apparatus 700 for determining the security level of the user equipment may further include: a first threshold combination determining module 707 and a second threshold combination determining module 708 .

[0123] Specifically, the first threshold combination determining module 707 is configured to determine a threshold combination according to the Internet service type, where the threshold combination includes specific values ​​of the first threshold and the second threshold.

[0124] The second threshold combination determination module 708 is configured to determine different threshold combinations for a specific Internet service type according to the device group to which the user device belongs.

[0125] The user device security level determination device 700 can flexibly determine a threshold combination based on the type of Internet service, thereby making the security level determined based on the threshold combination more accurate. In addition, for specific Internet service types, different threshold combinations can be determined based on the device group to which the user device belongs. This allows the threshold combination to be determined specifically based on the device group to which the user device belongs, thereby making the security level determined based on the threshold combination more accurate.

[0126] According to an embodiment of the present invention, the device 700 for determining the security level of the user equipment can be used to implement Figure 4 The embodiment describes a method for determining the security level of a user equipment.

[0127] Figure 10 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0128] like Figure 10 As shown, the apparatus 700 for determining the security level of the user equipment may further include: a third acquisition module 709 , a cleaning module 710 , a first classification module 711 and a training module 712 .

[0129] Specifically, the third acquisition module 709 is configured to acquire a plurality of historical user equipment data, wherein the historical user equipment data includes historical user equipment data of an internal Internet service platform and historical user equipment data of a third-party Internet service platform.

[0130] The cleaning module 710 is configured to clean the plurality of historical user equipment data to obtain a plurality of target historical user equipment data.

[0131] The first classification module 711 is configured to classify the target historical user device data to obtain blacklist data of the target historical user devices and credit data of the target historical user devices.

[0132] The training module 712 is configured to train the first security recognition model based on the blacklist data of the plurality of historical user devices, and to train the second security recognition model based on the credit data of the plurality of historical user devices.

[0133] The device 700 for determining the security level of the user device can respectively train the first security identification model and the second security identification model based on the blacklist data of multiple historical user devices and the credit data of multiple historical user devices from different data sources. The blacklist probability and credit evaluation score of the user device obtained by the first security identification model and the second security identification model trained in this way are more accurate when used.

[0134] According to an embodiment of the present invention, the device 700 for determining the security level of the user equipment can be used to implement Figure 5 The embodiment describes a method for determining the security level of a user equipment.

[0135] Figure 11 This is a block diagram of a device for determining a security level of user equipment according to another exemplary embodiment.

[0136] like Figure 11 As shown, the apparatus 700 for determining the security level of the user equipment may further include: a fourth acquisition module 713 , a second classification module 714 , a first update module 715 and a second update module 716 .

[0137] Specifically, the fourth acquisition module 713 is configured to acquire newly added user equipment data.

[0138] The second classification module 714 is configured to classify the newly added user equipment data to obtain blacklist data of the newly added user equipment and credit data of the newly added user equipment.

[0139] The first updating module 715 is configured to update the blacklist data of the plurality of historical user devices based on the blacklist data of the newly added user device, and update the credit data of the plurality of historical user devices based on the credit data of the newly added user device.

[0140] The second updating module 716 is configured to update the first security identification model based on the updated blacklist data of multiple historical user devices, and to update the second security identification model based on the updated credit data of multiple historical user devices.

[0141] The device 700 for determining the security level of the user device can update the blacklist data of multiple historical user devices based on the blacklist data of the newly added user device, and update the credit data of multiple historical user devices based on the credit data of the newly added user device. In this way, the first security identification model can be updated in a timely manner based on the updated blacklist data of the multiple historical user devices, and the second security identification model can be updated based on the updated credit data of the multiple historical user devices. In this way, the timeliness of the security level obtained using the updated first security identification model and the second security identification model can be ensured.

[0142] According to an embodiment of the present invention, the device 700 for determining the security level of the user equipment can be used to implement Figure 6 The embodiment describes a method for determining the security level of a user equipment.

[0143] Figure 12 It is a block diagram of an electronic device according to an exemplary embodiment.

[0144] Refer to the following Figure 12 800 according to this embodiment of the present disclosure will be described. Figure 12 The electronic device 800 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0145] like Figure 12 As shown, electronic device 800 is implemented as a general-purpose computing device. Components of electronic device 800 may include, but are not limited to, at least one processing unit 810, at least one storage unit 820, a bus 830 connecting various system components (including storage unit 820 and processing unit 810), a display unit 840, and the like.

[0146] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps of various exemplary embodiments of the present disclosure in this specification. For example, the processing unit 810 can perform the following steps: Figures 2 to 6 Follow the steps shown in .

[0147] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0148] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include an implementation of a network environment.

[0149] Bus 830 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0150] The electronic device 800 can also communicate with one or more external devices (e.g., a keyboard, pointing device, Bluetooth device, etc.) that allow a user to interact with the electronic device 800, and / or any device that allows the electronic device 800 to communicate with one or more other computing devices (e.g., a router, modem, etc.). This communication can occur via an input / output (I / O) interface 850. Furthermore, the electronic device 800 can communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 860. The network adapter 860 can communicate with other modules of the electronic device 800 via the bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the electronic device 800, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0151] Through the above description of the embodiments, it is easy for those skilled in the art to understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Figure 13 As shown, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the embodiment of the present disclosure.

[0152] The software product can be any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0153] The computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. The data signal propagated may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or component. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0154] The program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0155] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by a device, the computer-readable medium realizes the following functions: obtaining user device data; processing the user device data through a first security identification model to obtain the blacklist probability of the user device, and the first security identification model is trained based on the blacklist data of multiple historical user devices, and the blacklist data is false information related to the historical user device and has nothing to do with the historical credit performance of the historical user device on the Internet service platform; processing the user device data through a second security identification model to obtain the credit evaluation score of the user device, and the second security identification model is trained based on the credit data of multiple historical user devices, and the credit data is information related to the historical credit performance of the historical user device on the Internet service platform; determining the security level of the user device based on the blacklist probability of the user device and the credit evaluation score of the user device.

[0156] Those skilled in the art will appreciate that the modules described above can be distributed in the device according to the description of the embodiment, or can be modified accordingly to be used in one or more devices that are different from the embodiment. The modules of the above embodiment can be combined into one module or further divided into multiple submodules.

[0157] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0158] While the exemplary embodiments of the present disclosure have been specifically illustrated and described above, it should be understood that the present disclosure is not limited to the detailed structures, configurations, or implementations described herein; rather, the present disclosure is intended to encompass various modifications and equivalent configurations within the spirit and scope of the appended claims.

Claims

1. A method for determining the security level of a user device, applied to an Internet service platform, characterized in that: Including: Obtain user device data; Process the user device data through a first security identification model to obtain the blacklist probability of the user device. The first security identification model is trained based on the blacklist data of multiple historical user devices. The blacklist data is false information related to the historical user devices and has nothing to do with the historical credit performance of the historical user devices on the Internet service platform; Process the user device data through a second security identification model to obtain the credit evaluation score of the user device. The second security identification model is trained based on the credit data of multiple historical user devices. The credit data is information related to the historical credit performance of the historical user devices on the Internet service platform; Determine the security level of the user device according to the blacklist probability and credit evaluation score of the user device, including: Determine a threshold combination including specific values of a first threshold and a second threshold according to the Internet service type. And for a specific Internet service type, different threshold combinations are determined according to the different device groups to which the user device belongs. The first threshold and the second threshold satisfy the following relationship: M = aT1 + (1 - a)T2 Where, M is the service type value, related to the Internet service type, taking a fixed value, a is the blacklist influence factor, taking different values according to the different device groups, a is proportional to the blacklist probability of the device group and satisfies 0 < a < 1, T1 and T2 are the first threshold and the second threshold respectively; When the blacklist probability of the user device is less than the first threshold and the credit evaluation score of the user device is greater than the second threshold, determine that the security level of the user device is a high level; When the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determine that the security level of the user device is a low level; When the blacklist probability of the user device is less than the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determine that the security level of the user device is a medium level, or when the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is greater than the second threshold, determine that the security level of the user device is a medium level.

2. The method according to claim 1, wherein Also including: Obtain the Internet service request of the user device; Respond to the Internet service request of the user device according to the security level of the user device.

3. The method according to claim 2, wherein Responding to the Internet service request of the user device according to the security level of the user device includes: If the security level of the user device is a high level, pass the Internet service request of the user device; If the security level of the user device is a medium level, send the Internet service request of the user device to the service end; If the security level of the user device is a low level, reject the Internet service request of the user device and return a rejection message to the user device.

4. The method according to claim 1, wherein For a specific Internet service type, different threshold combinations are determined according to the different device groups to which the user device belongs. It also includes: determining different threshold combinations according to the user attribute settings of the user device according to the different device groups to which the user device belongs.

5. The method according to claim 1, wherein Also including: Obtain multiple historical user device data. The historical user device data includes the historical user device data of the internal Internet platform and the historical user device data of the third-party Internet platform; Clean the data of multiple historical user devices to obtain multiple target historical user device data; Classify the multiple target historical user device data to obtain blacklist data of multiple historical user devices and credit data of multiple historical user devices; Train a first security recognition model based on the blacklist data of multiple historical user devices, and train a second security recognition model based on the credit data of multiple historical user devices.

6. The method according to claim 5, wherein It further includes: Obtain the data of newly added user devices; Classify the data of newly added user devices to obtain blacklist data of newly added user devices and credit data of newly added user devices; Update the blacklist data of multiple historical user devices based on the blacklist data of newly added user devices, and update the credit data of multiple historical user devices based on the credit data of newly added user devices; Update the first security recognition model based on the updated blacklist data of multiple historical user devices, and update the second security recognition model based on the updated credit data of multiple historical user devices.

7. The method according to any one of claims 1 to 6, wherein The first security recognition model is a first decision tree model, and the second security recognition model is a second decision tree model.

8. A device for determining the security level of a user device, applied to an Internet service platform, characterized in that: It includes: A first acquisition module for acquiring user device data; A first recognition module for processing the user device data through the first security recognition model to obtain the blacklist probability of the user device. The first security recognition model is trained based on the blacklist data of multiple historical user devices. The blacklist data is false information related to historical user devices and has nothing to do with the historical credit performance of historical user devices on the Internet service platform; A second recognition module for processing the user device data through the second security recognition model to obtain the credit evaluation score of the user device. The second security recognition model is trained based on the credit data of multiple historical user devices. The credit data is information related to the historical credit performance of historical user devices on the Internet service platform; A security level determination module for determining the security level of the user device according to the blacklist probability and credit evaluation score of the user device, including: Determine a threshold combination including a first threshold and a second threshold according to the Internet service type. And for a specific Internet service type, different threshold combinations are determined according to different device groups to which the user device belongs. The first threshold and the second threshold satisfy the following relationship: M = aT1 + (1 - a)T2 Where, M is the service type value, related to the Internet service type, taking a fixed value. a is the blacklist influence factor, taking different values according to different device groups. a is proportional to the blacklist probability of the device group and satisfies 0 < a < 1. T1 and T2 are the first threshold and the second threshold respectively; When the blacklist probability of the user device is less than the first threshold and the credit evaluation score of the user device is greater than the second threshold, determine that the security level of the user device is a high level; When the blacklist probability of the user device is greater than or equal to the first threshold and the credit evaluation score of the user device is less than or equal to the second threshold, determine that the security level of the user device is a low level; When the blacklist probability of the user device is less than the first threshold and the credit rating score of the user device is less than or equal to the second threshold, the security level of the user device is determined to be medium. Alternatively, when the blacklist probability of the user device is greater than or equal to the first threshold and the credit rating score of the user device is greater than the second threshold, the security level of the user device is determined to be medium.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs; When one or more programs are executed by one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images