Methods, devices, and servers for screening black market equipment

Abstract

This invention provides a method, apparatus, and server for screening illicit devices, relating to the technical field of computer applications. The method includes: acquiring a pre-constructed directional graph; starting from a node containing one illicit device, performing edge-based walks based on the directional graph, calculating the importance factor of each node relative to other nodes; screening all nodes in the directional graph based on the importance factor to identify candidate nodes with values ​​exceeding a preset threshold; and identifying the smart devices corresponding to the candidate nodes as suspected illicit devices. The method, apparatus, and server provided by this invention, through the screening process using importance factors, can identify suspected illicit devices with high importance to illicit devices. These suspected illicit devices can be subsequently screened and confirmed, thereby helping to uncover hidden illicit devices and improve the security of financial transactions.

Description

Technical Field

[0001] This invention relates to the technical field of computer applications, and in particular to a method, apparatus, and server for screening black market equipment. Background Technology

[0002] With the continuous development of IoT technology, online applications are now providing more and more convenience for bank customers, enabling users to handle the vast majority of their business online.

[0003] However, beyond convenience, personal financial transactions must be secure, especially in scenarios involving personal assets and privacy. Therefore, almost all online services require the identification of personal information. For example, various business scenarios on mobile banking apps require facial recognition to provide a security barrier for online banking operations.

[0004] However, while safeguarding business operations, we also face the challenge of attacks from malicious devices from various regions. Currently, the most common method for detecting or identifying malicious devices is facial recognition screening based on machine vision technology. This method can identify malicious devices that fail facial recognition. However, this technology suffers from low screening accuracy due to the small number of training samples and is difficult to prevent new types of attacks that have never appeared before, thus reducing the security of online financial services. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method, apparatus and server for screening black market equipment, so as to alleviate the above-mentioned technical problems.

[0006] In a first aspect, embodiments of the present invention provide a method for screening illicit devices, comprising: acquiring a pre-constructed direction graph; wherein the direction graph includes multiple nodes, and edges pointing from one of the nodes to another; the nodes are used to represent multiple smart devices used by the same target customer to log in to a financial system, and the multiple smart devices include at least one known illicit device; the edges are used to represent the login order of the target customer logging into the financial system twice consecutively using different smart devices, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge; taking the node where one of the illicit devices is located as the starting point, performing edge-based walks based on the direction graph, and calculating the importance factor of each node relative to the other nodes; screening all nodes in the direction graph based on the importance factor to screen out candidate nodes with values ​​higher than a preset threshold; and identifying the smart devices corresponding to the candidate nodes as suspected illicit devices.

[0007] In conjunction with the first aspect, this embodiment of the invention provides a first possible implementation of the first aspect, wherein the method further includes: obtaining the device identifier of a known black market device; searching a preset database for login records associated with the device identifier based on the device identifier, wherein the login records record the login time when the black market device logged into the financial system, and the target customer who used the black market device to log into the financial system; extracting the customer identifier of the target customer, searching the preset database for login records generated by the customer identifier logging into the financial system within a preset time period, and the device identifier of at least one smart device used by the target customer when logging into the financial system; and generating a directional map based on the login records, using the device identifier of at least one smart device as a node.

[0008] In conjunction with the first possible implementation of the first aspect, this embodiment of the invention provides a second possible implementation of the first aspect, wherein the step of generating a directional map based on the login records, using the device identifier of at least one of the smart devices as nodes, includes: sorting the login records for a preset time period in chronological order; determining the edges between the nodes according to the sorted login records, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge; and connecting the nodes based on the edges to generate the directional map.

[0009] In conjunction with the first aspect, this embodiment of the invention provides a third possible implementation of the first aspect, wherein the step of calculating the importance factor of each node relative to the other nodes includes: calculating the importance factor of each node relative to the other nodes according to a preset sorting algorithm.

[0010] In conjunction with the third possible implementation of the first aspect, this embodiment of the invention provides a fourth possible implementation of the first aspect, wherein the sorting algorithm includes the PageRank algorithm; the step of calculating the importance factor of each node relative to other nodes according to a preset sorting algorithm includes: calculating the PR value of each node according to the PageRank algorithm; and determining the importance factor of each node relative to other nodes based on the PR value.

[0011] In conjunction with the first aspect, this embodiment of the invention provides a fifth possible implementation of the first aspect, wherein the step of filtering all nodes in the orientation spectrum based on the importance factor to filter out candidate nodes higher than a preset threshold includes: sorting each node in descending order according to the importance factor; and filtering the sorted nodes in descending order to filter out candidate nodes higher than the preset threshold.

[0012] In conjunction with the first aspect, the present invention provides a sixth possible implementation of the first aspect, wherein the above method further includes: responding to a review operation for the suspected black market device, and if the review operation determines the suspected black market device to be a black market device, then marking the suspected black market device as a known black market device.

[0013] Secondly, embodiments of the present invention also provide a screening device for black market devices, comprising: an acquisition module, configured to acquire a pre-constructed direction graph; wherein the direction graph includes multiple nodes, and edges pointing from one of the nodes to another; the nodes are used to represent multiple smart devices used by the same target customer to log in to a financial system, and the multiple smart devices include at least one known black market device; the edges are used to represent the login order of the target customer logging into the financial system twice consecutively using different smart devices, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge; a calculation module, configured to take the node where one of the black market devices is located as the starting point, perform edge-based walking based on the direction graph, and calculate the importance factor of each node relative to the other nodes; a screening module, configured to screen all nodes in the direction graph based on the importance factor to screen out candidate nodes higher than a preset threshold; and a determination module, configured to determine the smart device corresponding to the candidate node as a suspected black market device.

[0014] Thirdly, embodiments of the present invention also provide a server, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0015] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, performs the steps of the method described in the first aspect above.

[0016] The embodiments of the present invention bring the following beneficial effects:

[0017] The method, apparatus, and server for screening illicit devices provided in this invention can acquire a pre-constructed directional graph. Starting from a node in the directional graph where one of the illicit devices is located, the system performs edge-based walks on the directional graph, calculates the importance factor of each node relative to other nodes, and then filters all nodes in the directional graph based on the importance factor to identify candidate nodes with values ​​higher than a preset threshold. The smart devices corresponding to these candidate nodes are then identified as suspected illicit devices. By screening through importance factors, suspected illicit devices with high importance to illicit devices can be identified. These suspected illicit devices can be screened and confirmed post-event, thereby helping to uncover hidden illicit devices and improve the security of financial services.

[0018] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 A flowchart illustrating a method for screening black market equipment provided in an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of a direction pattern provided in an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of another orientation pattern provided in an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of the structure of a screening device for black market equipment provided in an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram of the structure of a server provided in an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Currently, one method for detecting black market devices is to directly screen for facial attacks based on machine vision technology, identifying devices that fail facial recognition. However, this technology often suffers from low screening accuracy due to the small number of training samples, and it is difficult to prevent new types of attacks that have never appeared before.

[0028] Based on this, the present invention provides a method, apparatus and server for screening black market equipment, which can effectively alleviate the above-mentioned technical problems.

[0029] To facilitate understanding of this embodiment, a method for screening black market equipment disclosed in this embodiment of the invention will first be described in detail.

[0030] In one possible implementation, embodiments of the present invention provide a method for screening black market equipment. Figure 1 A flowchart of a method for screening black market devices is shown, which includes the following steps:

[0031] Step S102: Obtain the pre-constructed orientation map;

[0032] In this embodiment of the invention, the directional map includes multiple nodes and an edge pointing from one node to another.

[0033] Specifically, nodes are used to represent multiple smart devices used by the same target customer to log in to the financial system, and at least one of the multiple smart devices is a known black market device; edges are used to represent the login order of the target customer when logging into the financial system twice in a row using different smart devices, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge.

[0034] In practice, the aforementioned target customer refers to the customer account used to log into the financial system. For example, a customer can register as a legitimate user and use a smart device to log into the financial system to conduct online financial business. After registration, the customer will have a customer account including a username and password. If the customer's sensitive personal information is leaked for some reason, the customer account may be attacked by black market devices. That is, the black market devices will log into the customer account. Furthermore, since the customer's sensitive personal information has been leaked, the customer may be attacked by multiple black market groups, that is, multiple black market devices will log into the customer account.

[0035] The aforementioned direction map is constructed based on the login logs of customer numbers, specifically for login logs of known black market devices, so as to facilitate the screening of hidden black market devices by the black market device screening method provided in the embodiments of the present invention.

[0036] Step S104: Starting from the node where one of the black market devices is located, perform edge-based walks based on the directional graph and calculate the importance factor of each node relative to other nodes.

[0037] Step S106: Filter all nodes in the orientation map based on importance factors to select candidate nodes that are higher than a preset threshold.

[0038] Step S108: Identify the smart devices corresponding to the candidate nodes as suspected black market devices.

[0039] In practical use, the aforementioned important factors actually represent the importance or weight of the corresponding node relative to the starting point. Since the edges of the directional graph are pointed to according to the login order of the target customer using different smart devices to log in to the financial system twice consecutively, the more times the target customer's corresponding customer number logs in, the more edges are generated. At this time, the important factor is also larger, which can also be understood as the weight being larger. When the target customer is attacked by black market devices or suspected black market devices, multiple edges will be generated, and the corresponding important factor will also be larger. Therefore, the process of steps S104 to S108 above is actually a process of screening suspected black market devices based on node importance. This process relies on the target customer's overall login history, that is, the overall login situation, without needing to analyze which specific login history it is, which also facilitates the verification of the screened suspected black market devices.

[0040] The method for screening illicit devices provided in this invention can obtain a pre-constructed directional graph, and starting from a node in the directional graph where one of the illicit devices is located, perform edge-based walks based on the directional graph to calculate the importance factor of each node relative to other nodes. Then, based on the importance factor, all nodes in the directional graph are screened to select candidate nodes that are higher than a preset threshold. The smart devices corresponding to the candidate nodes are then identified as suspected illicit devices. By screening through importance factors, suspected illicit devices with high importance to illicit devices can be screened out. These suspected illicit devices can be screened and confirmed afterward, which helps to uncover hidden illicit devices and improve the security of financial services.

[0041] In practical use, the direction graph construction used in the screening process of the aforementioned black market devices is inspired by social graphs or recommendation algorithms, and is constructed using reasonable assumptions. For example, it is assumed that a black market gang owns N black market devices (N>1); one black market device can attack multiple different customers. Since the customer's sensitive personal information has been leaked, a customer may be attacked by multiple black market gangs. When the username and password contained in the customer's account are leaked, in addition to logging in on normal devices, the customer may also log in to the financial system on multiple known black market devices or hidden black market devices. Therefore, a relationship graph can be formed between devices and customers, and suspected black market devices can be found by "following the vines".

[0042] This "following the clues" approach relies on customer login records to construct a directional graph, thereby achieving the aforementioned... Figure 1 The method for screening black market devices is shown. Specifically, in this embodiment of the invention, the process of constructing the orientation map includes the following steps:

[0043] (1) Obtain the device identifier of known black market devices;

[0044] (2) Search for the login records associated with the device identifier in the preset database based on the device identifier;

[0045] The login log records include the login times of the financial system accessed by the black market devices, as well as the target customers who used the black market devices to access the financial system.

[0046] (3) Extract the customer identifier of the target customer, search the database for the login records generated by the customer identifier logging into the financial system within a preset time period, and the device identifier of at least one smart device used by the target customer when logging into the financial system.

[0047] (4) Using the device identifier of at least one smart device as a node, generate a directional map based on the login record.

[0048] Specifically, when generating a directional graph based on login records, login records for a preset time period can be sorted in chronological order; then, edges between nodes can be determined according to the sorted login records, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge; finally, the nodes are connected based on the edges to generate the directional graph.

[0049] For ease of understanding, Figure 2 A schematic diagram of a radiation pattern is shown, and, Figure 2The illustration uses two directional graphs as examples. Specifically, it uses a smartphone as an example of a smart device, and assumes that a customer logs into the financial system using facial recognition verification. Figure 2 As shown, this includes normal devices, known black market devices, and unknown black market devices. The unknown black market devices are hidden black market devices that are yet to be screened.

[0050] When generating the directional graph following the steps above, smartphones can be used as nodes. These smartphones are categorized into normal devices, known malicious devices, and unknown malicious devices to be identified. Known malicious devices are those that failed facial recognition in the past and were manually identified as malicious. The relationships in the directional graph established based on these steps are as follows: if the same customer account has logged in on both device A and device B, they are connected by an edge. The more times a user logs in on either device A or device B, the more edges exist between them, which can be interpreted as a larger edge weight. Furthermore, this edge is directional: if a user logs in on device A first and then on device B, the edge points from A to B; otherwise, it points in the opposite direction. Due to the custom edge design, a node will not have edges pointing to itself, thus avoiding potential pitfalls.

[0051] Furthermore, after the orientation map is constructed, all individual nodes can be removed to refine the orientation map. Additionally, the black market device screening method provided in this embodiment can be applied to the constructed orientation map to further calculate the importance factors of nodes based on the orientation map, thereby facilitating the screening of hidden black market devices within the orientation map.

[0052] In specific implementation, when calculating the importance factor in this embodiment of the invention, the importance factor of each node relative to other nodes can be calculated according to a preset sorting algorithm.

[0053] Specifically, the ranking algorithm in this embodiment of the invention includes the PageRank algorithm. When calculating the importance factor, the PageRank value of each node can be calculated according to the PageRank algorithm; then, the importance factor of each node relative to other nodes is determined based on the PageRank value.

[0054] Furthermore, after calculating the importance factors, when filtering nodes, each node can first be sorted in descending order according to the importance factors; then the nodes in descending order can be filtered to select candidate nodes that are higher than the preset threshold.

[0055] For ease of understanding, Figure 2 On this basis, Figure 3 A schematic diagram of another orientation pattern is shown, in which, Figure 3 What is shown is the Figure 2The diagram shown illustrates the importance factor of each node in the directional spectrum. After calculating the importance factor of each node using the PageRank algorithm described above, it can be followed... Figure 3 The schematic diagram shown is labeled, and the directional patterns after labeling are then filtered.

[0056] Specifically, in this embodiment of the invention, the important factor determined is the PageRank (PR) value calculated based on the PageRank algorithm. This PageRank algorithm, also known as the Personalized PageRank algorithm, is typically used to measure the stationary distribution of a specific type of random walk. It starts a random walk from a random node and jumps to another random node with probability p in each iteration. After multiple iterations, it converges to obtain the stable probability (PR) value for each node. In this embodiment of the invention, the use of the PageRank algorithm aims to initialize the system with known malicious devices and then start PageRank random walks from these initialized nodes. Furthermore, the algorithm can determine the importance of each node based on its in-degree and out-degree frequencies and its distance from important nodes, thereby achieving the goal of coloring the user base of malicious devices in the graph.

[0057] Furthermore, to facilitate node screening, after calculating the PR value of each node relative to other nodes, each node will form a list of length equal to the number of all nodes, representing the importance score of that node relative to each of the other nodes. The average of this list can be used to calculate the average importance score of that node relative to all other nodes. When sorting in descending order, the nodes can be sorted in descending order of their average importance scores. After removing known black market devices, the smart devices corresponding to the other candidate nodes that are above a preset threshold are the suspected black market devices identified in this embodiment of the invention.

[0058] Furthermore, for the aforementioned suspected illicit devices, a review operation can be performed. If the review operation confirms that the suspected illicit device is indeed an illicit device, it will be marked as a known illicit device. For devices confirmed as known illicit devices, they can be added to the directional graph for iterative updates to facilitate a new round of screening for illicit devices.

[0059] Therefore, the black market device screening method provided in this embodiment of the invention uses smart devices, such as smartphones, as nodes and customer login records to financial systems as relationships, such as login records for financial systems via facial recognition. It can establish a directional graph and initialize it with discovered black market devices as key points. The Personalized PageRank algorithm is used to calculate the importance factor of each node. Finally, nodes with high importance factors are handed over to relevant personnel for post-screening, which improves the security of financial systems, especially for financial systems that use facial recognition for login.

[0060] Furthermore, the screening method for black market devices provided in this embodiment of the invention can expand the search boundaries of suspected black market devices by utilizing the possible correlations between them. Together with machine vision technology, it forms a security firewall for facial recognition. Moreover, the facial black market attack data and attack methods mined by this technology can be reused for training machine vision technology, forming a closed loop of complementary technologies and spiraling upward development.

[0061] Furthermore, based on the above embodiments, this invention also provides a screening device for black market equipment, such as... Figure 4 The diagram shows a structural schematic of a screening device for illegal equipment, which includes the following structure:

[0062] The acquisition module 40 is used to acquire a pre-constructed direction graph; wherein the direction graph includes multiple nodes and edges pointing from one of the nodes to another; the nodes are used to represent multiple smart devices used by the same target customer to log in to the financial system, and the multiple smart devices include at least one known black market device; the edges are used to represent the login order of the target customer logging into the financial system twice consecutively using different smart devices, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge;

[0063] Calculation module 42 is used to calculate the importance factor of each node relative to the other nodes by taking one of the black market devices as the starting point and performing edge-following walks based on the direction map.

[0064] The filtering module 44 is used to filter all nodes in the orientation map based on the important factors, so as to filter out candidate nodes that are higher than a preset threshold.

[0065] The determination module 46 is used to determine the smart device corresponding to the candidate node as a suspected black market device.

[0066] The black market equipment screening device provided in this embodiment of the invention has the same technical features as the black market equipment screening method provided in the above embodiments, so it can also solve the same technical problems and achieve the same technical effects.

[0067] Furthermore, embodiments of the present invention also provide a server, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method.

[0068] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the above-described method.

[0069] Furthermore, this embodiment of the invention also provides a schematic diagram of a server structure, such as... Figure 5 The diagram shows the structure of the server, which includes a processor 51 and a memory 50. The memory 50 stores computer-executable instructions that can be executed by the processor 51, and the processor 51 executes the computer-executable instructions to implement the above-described method.

[0070] exist Figure 5 In the illustrated embodiment, the server further includes a bus 52 and a communication interface 53, wherein the processor 51, the communication interface 53, and the memory 50 are connected via the bus 52.

[0071] The memory 50 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 53 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc. The bus 52 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 52 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0072] Processor 51 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 51 or by instructions in software form. Processor 51 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory. The processor 51 reads the information in the memory and, in conjunction with its hardware, completes the aforementioned method.

[0073] The computer program product of the black market equipment screening method, device and server provided in the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation, please refer to the method embodiments, which will not be repeated here.

[0074] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0075] Furthermore, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0076] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0077] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0078] Finally, it should be noted that the above embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for screening black market equipment, characterized in that, include: Obtain a pre-constructed direction graph; wherein the direction graph includes multiple nodes and edges pointing from one of the nodes to another; the nodes are used to represent multiple smart devices used by the same target customer to log in to the financial system, and the multiple smart devices include at least one known black market device; the edges are used to represent the login sequence of the target customer logging into the financial system twice consecutively using different smart devices, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge; the target customer refers to the customer ID used to log into the financial system, and the direction graph is constructed based on the login history of the customer ID; Starting from the node where one of the black market devices is located, edge-based walks are performed based on the directional graph to calculate the importance factor of each node relative to the other nodes; wherein, the more times the customer number corresponding to the target customer logs into the financial system, the more edges are generated, and the greater the importance factor is. Based on the aforementioned important factors, all nodes in the orientation map are screened to select candidate nodes that are above a preset threshold. The smart devices corresponding to the candidate nodes are identified as suspected black market devices.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the device identifier of known black market devices; Based on the device identifier, the system searches a preset database for login records associated with the device identifier. The login records contain the login times when the black market device logged into the financial system, as well as the target customers who used the black market device to log into the financial system. Extract the customer identifier of the target customer, search the database for login records generated by the customer identifier logging into the financial system within a preset time period, and the device identifier of at least one smart device used by the target customer when logging into the financial system; Using the device identifier of at least one of the smart devices as nodes, a directional map is generated based on the login record.

3. The method according to claim 2, characterized in that, The step of generating a directional map based on the login record, using the device identifier of at least one of the smart devices as a node, includes: The login records within the preset time period are sorted in chronological order; The edges between the nodes are determined according to the sorted login records, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge. The nodes are connected based on the edges to generate the direction map.

4. The method according to claim 1, characterized in that, The step of calculating the importance factor of each of the nodes relative to the other nodes includes: The importance factor of each node relative to the other nodes is calculated according to a preset sorting algorithm.

5. The method according to claim 4, characterized in that, The sorting algorithm includes the PageRank algorithm; The step of calculating the importance factor of each node relative to the other nodes according to a preset sorting algorithm includes: The PageRank value of each node is calculated according to the PageRank algorithm. The importance factor of each node relative to the other nodes is determined based on the PR value.

6. The method according to claim 1, characterized in that, The step of filtering all nodes in the orientation map based on the aforementioned importance factors to select candidate nodes that exceed a preset threshold includes: Sort each node in descending order according to the aforementioned important factors; The nodes sorted in descending order are then filtered to select candidate nodes that are above a preset threshold.

7. The method according to claim 1, characterized in that, The method further includes: In response to the verification operation of the suspected black market device, if the verification operation confirms that the suspected black market device is a black market device, then the suspected black market device is marked as a known black market device.

8. A screening device for black market equipment, characterized in that, include: An acquisition module is used to acquire a pre-constructed direction graph; wherein the direction graph includes multiple nodes and edges pointing from one of the nodes to another; the nodes represent multiple smart devices used by the same target customer to log in to the financial system, and the multiple smart devices include at least one known black market device; the edges represent the login sequence of the target customer logging into the financial system twice consecutively using different smart devices, wherein the login time of the node corresponding to the starting point of the edge is earlier than the login time of the node corresponding to the ending point of the edge; the target customer refers to the customer ID used to log into the financial system, and the direction graph is constructed based on the login history of the customer ID; The calculation module is used to start from the node where one of the black market devices is located, and perform edge-based walks based on the direction graph to calculate the importance factor of each node relative to the other nodes; wherein, the more times the customer number corresponding to the target customer logs into the financial system, the more edges are generated, and the greater the importance factor is; The filtering module is used to filter all nodes in the orientation map based on the important factors, so as to filter out candidate nodes that are higher than a preset threshold. The determination module is used to identify the smart devices corresponding to the candidate nodes as suspected black market devices.

9. A server, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the method described in any one of claims 1-7.

Images