Method, device and server for determining black production equipment

Abstract

The application provides a kind of black production equipment determination method, device and server, it is related to the technical field of computer application, the method comprises: obtaining the atlas community established in advance, using known black production equipment, based on atlas community, search the associated user of known black production equipment by edge walking;With associated user as relevant point, find the suspected black production equipment included in the device node associated with associated user in atlas community;With suspected black production equipment as starting point, continue edge walking based on atlas community, until all user nodes and device nodes included in atlas community are traversed, and then all suspected black production equipment included in atlas community are determined.The black production equipment determination method, device and server provided by the application can find as many suspected black production equipment as possible according to the login flow of known black production equipment found, and can effectively improve the security of financial system after handing over to relevant personnel for post screening.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer application, and in particular to a method and device for determining black production equipment and a server. BACKGROUND

[0002] With the continuous development of Internet of Things technology, at present, online applications provide more and more convenience for bank customers, so that users can handle most of the business through online applications.

[0003] However, in addition to convenience, personal financial business must have security protection, especially in scenarios involving personal property and personal privacy. Therefore, almost all online businesses require personal information identification, for example, various business scenarios on mobile banking APP require face recognition and the like, in order to provide a security barrier for the safety of online banking business.

[0004] However, while providing protection for the business, it is also under attack and challenge from black production equipment from all over the place. At present, the most common means for discovering or identifying black production equipment is face attack screening based directly on machine vision technology, through which black production equipment that does not pass face recognition can be found. However, due to the small number of training samples, this technology has low screening accuracy and is difficult to prevent new attacks that have not occurred in history, reducing the security of online financial business. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a method and device for determining black production equipment and a server to alleviate the above technical problems.

[0006] In a first aspect, the present application provides a method for determining black production equipment, comprising: obtaining a pre-established graph community, wherein the graph community is constructed based on flow data within a preset period, and the graph community includes user nodes corresponding to a plurality of user identifiers, device nodes corresponding to a plurality of intelligent device identifiers, and edges connected between the user nodes and the device nodes, wherein the edges are used to represent login flow generated by users using the intelligent devices to log in to a financial system; the device identifier includes a device identifier of a normal device and a black production equipment identifier pre-marked as a known black production equipment; using the known black production equipment, performing edge walking based on the graph community to search for associated users of the known black production equipment; taking the associated users as relevant points, searching for suspected black production equipment included in the device nodes associated with the associated users in the graph community; taking the suspected black production equipment as a starting point, continuing to perform edge walking based on the graph community until all user nodes and device nodes included in the graph community are traversed, and then determining all suspected black production equipment included in the graph community.

[0007] With reference to the first aspect, in a first possible implementation form of the first aspect, the method further comprises: in response to the review operation on the suspected black production device, if the suspected black production device is determined as a black production device through the review operation, marking the suspected black production device as a known black production device.

[0008] With reference to the first aspect, in a second possible implementation form of the first aspect, the method further comprises: obtaining flow data in a preset period, wherein the flow data comprises login flow generated by all users through intelligent devices in the preset period according to a preset identification mode to log in a financial system; extracting a user identifier in the flow data and a device identifier of an intelligent device used by the user identifier to log in the financial system; establishing a graph community by taking the user identifier as a user node, the device identifier as a device node, and the login flow generated by each user to log in the financial system as an edge; wherein the device nodes included in the graph community comprise device nodes of normal devices and device nodes of known black production devices; one end of the edge generated by the login flow is connected to the user node, and the other end is connected to the device node.

[0009] With reference to the first aspect, in a third possible implementation form of the first aspect, the step of searching for associated users of the known black production device based on the graph community by using the known black production device comprises: investigating suspected attack flow of the known black production device according to the login flow of the known black production device; determining a user node connected by an edge where the suspected attack flow is located as an associated user of the known black production device based on the graph community.

[0010] With reference to the third possible implementation form of the first aspect, in a fourth possible implementation form of the first aspect, the step of investigating suspected attack flow of the known black production device according to the login flow of the known black production device comprises: determining, whether the login flow of the known black production device is higher than a preset flow threshold in a preset time period; wherein the preset time period is shorter than the preset period; if yes, determining the login flow of the known black production device as the suspected attack flow.

[0011] With the third possible implementation manner of the first aspect, the application provides a fifth possible implementation manner of the first aspect, wherein the step of searching for the suspected black production device included in the device node associated with the associated user in the graph community comprises: searching for a suspected attack flow associated with the associated user in the graph community; and determining the smart device corresponding to the device node associated with the suspected attack flow as the suspected black production device associated with the associated user.

[0012] With the first possible implementation manner of the first aspect, the application provides a sixth possible implementation manner of the first aspect, wherein the method further comprises: extracting a sub-community corresponding to the suspected black production device in the graph community, so as to review the suspected black production device with respect to the sub-community.

[0013] In the second aspect, the application further provides a black production device determination apparatus, comprising: an acquisition module configured to acquire a pre-established graph community, wherein the graph community is constructed based on flow data in a preset period, and the graph community comprises user nodes corresponding to a plurality of user identifiers, device nodes corresponding to a plurality of device identifiers of smart devices, and edges connected between the user nodes and the device nodes, wherein the edges are used to represent login flows generated by users using the smart devices to log in to a financial system; the device identifiers comprise device identifiers of normal devices and black production device identifiers pre-marked as known black production devices; a search module configured to perform edge walking based on the graph community by using the known black production devices, to search for associated users of the known black production devices; a search module configured to search for suspected black production devices included in device nodes associated with the associated users in the graph community with the associated users as related points; and a traversal module configured to continue edge walking based on the graph community with the suspected black production devices as starting points, until all user nodes and device nodes included in the graph community are traversed, to determine all suspected black production devices included in the graph community.

[0014] In the third aspect, the application further provides a server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method of the first aspect when executing the computer program.

[0015] In the fourth aspect, the application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executable on a processor to execute the steps of the method of the first aspect.

[0016] The embodiments of the application have the following beneficial effects:

[0017] The method, device and server for determining black production equipment provided by the embodiment of the present application can obtain a pre-established graph community, and perform edge following based on the graph community by using a known black production equipment, to search for associated users of the known black production equipment, and find, in the graph community, suspected black production equipment included in equipment nodes associated with the associated users, taking the suspected black production equipment as a starting point, continue to perform edge following based on the graph community, until all user nodes and equipment nodes included in the graph community are traversed, and then all suspected black production equipment included in the graph community is determined, and since the edges of the graph community are used to represent login streams generated by users using smart equipment to log in to a financial system, the determination process of the black production equipment provided by the embodiment of the present application can find as many suspected black production equipment as possible according to the login streams of the known black production equipment found, and after being handed over to relevant personnel for post-screening, the security of the financial system can be effectively improved.

[0018] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and achieved by the structure particularly pointed out in the description, claims and drawings.

[0019] In order to make the above-mentioned objects, features and advantages of the present application more apparent, the following preferred embodiments are specifically described, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0021] Figure 1 A flowchart of a method for determining black production equipment provided by the embodiment of the present application is shown in the figure;

[0022] Figure 2 A schematic diagram of a graph community provided by the embodiment of the present application is shown in the figure;

[0023] Figure 3 A schematic diagram of a sub-community corresponding to suspected black production equipment provided by the embodiment of the present application is shown in the figure;

[0024] Figure 4 A structural schematic diagram of a determination device for black production equipment provided by the embodiment of the present application is shown in the figure;

[0025] Figure 5 This is a schematic diagram of the structure of a server provided in an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Currently, almost all online financial services require personal information verification. For example, mobile banking apps offer various service scenarios where users need to undergo facial recognition to log in. This facial recognition method provides a security barrier for online services. However, while safeguarding these services, it also faces the challenge of attacks from malicious devices across the country. Discovering and identifying these malicious devices from among the vast number of mobile devices using facial recognition login, blacklisting them, and strengthening defenses has become a pressing security issue.

[0028] One common method for detecting malicious devices is to screen for facial attacks directly using machine vision technology, which identifies devices that fail facial recognition. However, this technique suffers from low accuracy due to the small number of training samples and is difficult to prevent new types of attacks that have never appeared before.

[0029] Based on this, the present invention provides a method, apparatus and server for identifying black market devices, which can effectively screen black market devices to improve the security of online business.

[0030] To facilitate understanding of this embodiment, a method for determining black market equipment disclosed in this embodiment of the invention will first be described in detail.

[0031] In one possible implementation, embodiments of the present invention provide a method for identifying illicit devices. This method can be applied to a server in a financial system for screening and identifying illicit devices. Specifically, as shown... Figure 1 The flowchart shown illustrates a method for identifying black market equipment, the method comprising:

[0032] Step S102: Obtain the pre-established map community;

[0033] In this embodiment of the invention, the graph community is constructed based on transaction data within a preset period. The graph community includes user nodes corresponding to multiple user identifiers, device nodes corresponding to multiple smart device identifiers, and edges connecting the user nodes and device nodes. The edges of the graph community represent the login transaction data generated when a user logs into the financial system using a smart device. Furthermore, the device identifiers include those of normal devices and those of black market devices pre-marked as known black market devices.

[0034] Step S104: Using known black market devices, perform edge-walking based on the graph community to search for associated users of the known black market devices;

[0035] Step S106: Using the associated user as the relevant point, search for suspected black market devices in the device nodes associated with the associated user in the graph community;

[0036] Step S108: Starting from the suspected black market device, continue walking along the edges of the graph cluster until all user nodes and device nodes included in the graph cluster are traversed, thereby identifying all suspected black market devices included in the graph cluster.

[0037] In practical use, the user nodes included in the above graph cluster actually represent users who use financial services and log in, while the device nodes represent the smart devices used by users to log in to financial devices, such as smartphones, tablets, desktop computers, and other smart devices that can connect to the Internet. Therefore, the nodes included in the above graph cluster are usually users and nodes of the smart devices held by users. In addition, the above device nodes include nodes that are pre-marked as known black market devices. For normal devices that are not marked, there may be hidden suspected black market devices. Through the process of steps S104 to S108 above, suspicious transaction data can be found by "following the clues" based on the above known black market devices, and then suspected black market devices can be identified.

[0038] Therefore, the method for determining black production equipment provided by the embodiment of the present application can obtain a pre-established graph community, and perform edge walking based on the graph community by using a known black production equipment, to search for associated users of the known black production equipment, and take the associated users as relevant points to find suspected black production equipment included in equipment nodes associated with the associated users in the graph community; and then, based on the graph community, continue to perform edge walking from the suspected black production equipment as a starting point, until all user nodes and equipment nodes included in the graph community are traversed, so as to determine all suspected black production equipment included in the graph community. Since the edges of the graph community are used to represent login streams generated by users using smart equipment to log in to a financial system, the determination process of the black production equipment provided by the embodiment of the present application can find as many suspected black production equipment as possible according to the login streams of the known black production equipment that has been found, and after being handed over to relevant personnel for post-screening, the security of the financial system can be effectively improved.

[0039] In actual use, the graph community is actually a graph constructed by being inspired by a social graph. For example, the graph can take a user and a smart device, such as a mobile phone, held by the user as nodes of the graph community. The smart device is divided into normal equipment, known black production equipment, and unknown black production equipment hidden in the normal equipment, that is, the suspected black production equipment in the embodiment of the present application. Further, in the embodiment of the present application, the known black production equipment is a black device that has not passed a security identification, such as a face recognition, and has been determined to be black production by a human being.

[0040] The user nodes in the graph community are not distinguished from normal users and black production users, because it is assumed that all users are normal users, and there are normal streams and attack streams in the login streams, which are only generated by the black production equipment by using the user information leakage and device intrusion.

[0041] In actual use, it is assumed that a black production team has N black production devices (N > 1); the team members will use one black production device to attack multiple different users; and since the personal sensitive information of the user has been leaked, one user may be attacked by multiple black production teams. Therefore, based on the assumption, a relationship graph can be formed between the smart equipment and the user, that is, black production equipment-user-normal equipment-suspected black production equipment, a graph community can be formed, and the suspicious stream can be found and the suspected black production equipment can be determined by using the method for determining black production equipment provided by the embodiment of the present application.

[0042] Further, for the suspected black production equipment determined in the step S108, further response to the review operation of the suspected black production equipment, if the suspected black production equipment is determined as the black production equipment through the review operation, the suspected black production equipment can be marked as the known black production equipment, and the corresponding graph community is updated, so as to continue to investigate the black production equipment.

[0043] Further, in order to guarantee the security of the financial business, the graph community can be set to a maintenance mode of periodic update, and the determination method of the black production equipment provided by the embodiment of the application can be triggered to be executed once when the graph community is updated. In addition, in the interval period between every two graph community updates, the determination method of the black production equipment provided by the embodiment of the application can also be triggered to be executed according to the actual use. The specific triggering period and the update period of the graph community can be set according to the actual use, and the embodiment of the application does not limit this.

[0044] Specifically, when updating the graph community, each iteration can be selected in units of months, or in units of weeks, or in units of preset days, such as 20 days, 30 days, and the like. In order to facilitate understanding, taking the iteration in units of months as an example, at this time, when the graph community is constructed, the selected black production equipment is the full amount of black production equipment associated from the known attack flow in the month, and the normal equipment is the non-black production equipment logged in the month. The purpose of the iteration update of the graph community is to screen out the suspicious equipment from the normal equipment, that is, the suspected black production equipment in the embodiment of the application, so as to mine new black production equipment.

[0045] Specifically, the embodiment of the application further includes an iteration update process of the graph community, which specifically includes the following steps:

[0046] (1) obtaining flow data in a preset period;

[0047] In the embodiment of the application, taking the preset period as one month as an example, the flow data includes the login flow generated by all users through the intelligent equipment to log in the financial system according to the preset identification mode in the preset period;

[0048] (2) extracting the user identifier in the flow data and the device identifier of the intelligent equipment used by the user identifier to log in the financial system;

[0049] (3) taking the user identifier as a user node, the device identifier as a device node, and each login flow generated by the user to log in the financial system as an edge, establishing the graph community;

[0050] The device nodes included in the graph community established based on the water data in the preset period include device nodes of normal devices and device nodes of known black production devices; one end of the edge generated by the login water is connected to the user node, and the other end is connected to the device node.

[0051] For ease of understanding, Figure 2 A schematic diagram of a graph community is shown, as Figure 2 It is illustrated by taking face recognition as an example in a preset identification mode, at this time Figure 2 The login water in the face recognition login water is not included in the graph community, and each face recognition login water is an edge in the graph community, i.e., a relationship in the graph community. The water type can be divided into normal face water, known attack water, and unknown attack water that needs to be mined. The known attack water is the water generated when the known black production device logs into the financial system, as Figure 2 It is illustrated, including normal face water, known attack water, and unknown attack water that needs to be mined. It also includes users, known black production devices, normal devices, and suspected black production devices. Moreover, a user and a device are connected by one to more different types of water, and a device can be connected to one to more users. In actual use, after the above-mentioned graph community is constructed, all single nodes, such as single devices or single users, need to be removed to perfect the graph community.

[0052] Further, based on the graph community shown in Figure 2 In the step S104, the known black production device is used to perform edge-based walking based on the graph community to search for the associated users of the known black production device, which includes: according to the login water of the known black production device, investigating the suspected attack water of the known black production device; and based on the graph community, determining the user nodes connected by the edges of the suspected attack water as the associated users of the known black production device.

[0053] When investigating the suspected attack water, it is usually first determined whether the login water of the known black production device is higher than a preset water threshold in a preset time period; the length of the preset time period is less than the length of the preset period; if so, the login water of the known black production device is determined as the suspected attack water.

[0054] In actual use, in order to exclude the normal login water of the black production device, a water threshold is usually set, for example, according to experience, the average value of the normal login water in a preset time period can be calculated as the water threshold, for example, taking the face recognition frequency of 10 times per customer per week as the water threshold. If the known black production device has more login water than the average face recognition frequency in the industry in a week, i.e., exceeds the above-mentioned water threshold, the login water is considered as suspected attack water.

[0055] The above-mentioned process of edge-based walking based on graph communities is actually to check the dense flow of known black market devices during the attack period (preset time period), such as within a week, in order to identify the suspected attack flow of known black market devices, and then determine the user nodes connected to the edges where the suspected attack flow is located as the associated users of the known black market devices.

[0056] Furthermore, after identifying suspected attack streams, in step S106 above, when searching for suspected black market devices, one can first search for suspected attack streams associated with related users in the graph cluster; then, the smart devices corresponding to the device nodes associated with the suspected attack streams are identified as suspected black market devices associated with the related users.

[0057] In this process, discovered attack devices are used as black market seeds. That is, known black market devices are explored by traversing edges within the graph community, searching for associated users and devices. Users associated with known black market devices are designated as relevant points. The flow of traffic from these users to other devices is considered as suspected attack flow, and devices associated with suspected attack flow are designated as suspected black market devices. This process of traversing edges is repeated using suspected and known black market devices as seeds until convergence, thus identifying independent black market communities. In practical use, since normal users do not log into many other smart devices, the size of a graph community is usually not very large. Therefore, the convergence condition for edge-traversing is traversing all nodes in the entire graph community. Based on the above... Figure 2 The path of the network can be summarized as follows: black market device -> associated user -> suspected black market device -> other associated user -> other suspected black market device..., ultimately achieving the goal of "following the vine to find the melon" to find all suspected black market devices.

[0058] Furthermore, after identifying suspected illicit devices, sub-clusters corresponding to these devices can be extracted from the aforementioned graph clusters to facilitate further verification of the suspected illicit devices based on these sub-clusters. For ease of understanding, based on... Figure 2 The shown map community, Figure 3 The diagram illustrates a sub-cluster corresponding to a suspected illicit device, including Cluster 1 and Cluster 2. Specifically, when extracting sub-clusters, suspected illicit devices can be grouped together, and suspected attack streams can be submitted to reviewers for confirmation of whether they are indeed illicit devices. If a device is confirmed to be illicit, it is marked as a known illicit device, and the newly confirmed known illicit devices are then added to the graph cluster for iterative updates, facilitating a new round of investigation into illicit devices.

[0059] Therefore, the method for identifying illicit devices provided in this invention establishes a graph community using smart devices and device holders (users) as nodes and login transaction records as edges. Then, based on the login transaction records of discovered illicit devices, it traces and identifies as many suspected illicit devices as possible, handing them over to relevant personnel for post-event screening to improve the identification security of the financial system. Furthermore, this invention utilizes the potential correlations between illicit devices to expand the search boundaries for suspected illicit devices. Together with related identification technologies, such as machine vision technology, this forms a security firewall for the financial system. Moreover, the attack data and attack methods of illicit devices mined by this technology can be reused for training machine vision technology, forming a closed loop of complementary and spiraling technological development.

[0060] Furthermore, based on the above embodiments, this invention also provides a device for identifying black market equipment, such as... Figure 4 The diagram shows a structural schematic of a device for identifying black market equipment, as shown below. Figure 4 As shown, it includes the following structure:

[0061] The acquisition module 40 is used to acquire a pre-established graph community, wherein the graph community is constructed based on transaction data within a preset period, and the graph community includes user nodes corresponding to multiple user identifiers, device nodes corresponding to multiple smart device identifiers, and edges connecting the user nodes and the device nodes, wherein the edges are used to represent the login transaction data generated by a user logging into the financial system using the smart device; the device identifiers include device identifiers of normal devices and black market device identifiers pre-marked as known black market devices;

[0062] Search module 42 is used to search for associated users of the known black market devices by performing edge-walking based on the graph community using the known black market devices.

[0063] The search module 44 is used to search for suspected black market devices in the graph cluster, using the associated user as the relevant point.

[0064] The traversal module 46 is used to start from the suspected black market device and continue to walk along the edges of the graph cluster until all user nodes and device nodes included in the graph cluster are traversed, thereby determining all suspected black market devices included in the graph cluster.

[0065] The device for identifying black market equipment provided in this embodiment of the invention has the same technical features as the method for identifying black market equipment provided in the above embodiments, so it can also solve the same technical problems and achieve the same technical effects.

[0066] Further, the embodiment of the present application further provides a server, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0067] The embodiment of the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the above method.

[0068] Further, the embodiment of the present application further provides a structural diagram of a server, as shown in Figure 5 Fig. 1, which is a structural diagram of the server, wherein the server comprises a processor 51 and a memory 50, the memory 50 stores computer executable instructions executable by the processor 51, and the processor 51 executes the computer executable instructions to implement the above method.

[0069] In the embodiment shown in Figure 5 Fig. 1, the server further comprises a bus 52 and a communication interface 53, wherein the processor 51, the communication interface 53 and the memory 50 are connected through the bus 52.

[0070] The memory 50 can include a high-speed random access memory (RAM) and can also include a non-volatile memory such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 53 (which can be wired or wireless), and the Internet, a wide area network, a local area network, a metropolitan area network, etc. can be used. The bus 52 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 52 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0071] The processor 51 can be an integrated circuit chip with processing capability. In the implementation process, each step of the above method can be completed by the integrated logic circuit of hardware in the processor 51 or the instruction in the form of software. The processor 51 described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory, and the processor 51 reads the information in the memory, and combines the hardware to complete the foregoing method.

[0072] The method and device for determining the black production equipment and the computer program product of the server provided by the embodiments of the present application include a computer readable storage medium storing program codes, the instructions included in the program codes can be used to execute the method described in the foregoing method embodiments, and the specific implementation can be referred to the method embodiments, which will not be described here.

[0073] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0074] In addition, in the description of the embodiments of the present application, unless otherwise explicitly specified and limited, the terms "mounting", "connecting", "connecting" should be understood in a broad sense, for example, can be fixedly connected, can also be detachably connected, or integrally connected; can be mechanically connected, can also be electrically connected; can be directly connected, can also be indirectly connected through an intermediate medium, can be the communication inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0075] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the present application that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of software products. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0076] In the description of the present application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the purpose of facilitating the description of the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, the terms "first", "second", "third" are only for the purpose of description, and cannot be understood as indicating or implying relative importance.

[0077] Finally, it should be noted that the above embodiments are only specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, and are not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily think of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed by the present application, or make equivalent replacements to some of the technical features; and these modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for identifying black market equipment, characterized in that, include: A pre-established graph community is obtained, wherein the graph community is constructed based on transaction data within a preset period, and the graph community includes user nodes corresponding to multiple user identifiers, device nodes corresponding to multiple smart device identifiers, and edges connecting the user nodes and the device nodes, wherein the edges are used to represent the login transaction data generated by a user logging into the financial system using the smart device; the device identifiers include device identifiers of normal devices and black market device identifiers pre-marked as known black market devices; one end of the edge generated by the login transaction data is connected to the user node, and the other end is connected to the device node; the user node represents a user who uses financial services and logs in, and the device node represents the smart device used by the user to log into the financial system; Using the known black market devices, edge-following is performed based on the graph community to search for users associated with the known black market devices; Using the associated users as relevant points, search for suspected black market devices among the device nodes associated with the associated users in the graph cluster; Starting with the suspected illicit device, the process continues to traverse the graph cluster until all user nodes and device nodes included in the graph cluster are traversed, thereby identifying all suspected illicit devices included in the graph cluster.

2. The method according to claim 1, characterized in that, The method further includes: In response to the verification operation of the suspected black market device, if the verification operation confirms that the suspected black market device is a black market device, then the suspected black market device is marked as a known black market device.

3. The method according to claim 1, characterized in that, The method further includes: Obtain transaction data within a preset period, wherein the transaction data includes login transaction data generated by all users logging into the financial system through smart devices according to a preset recognition pattern within the preset period; Extract the user identifier from the transaction data, and the device identifier of the smart device used by the user to log in to the financial system; The graph community is established using the user identifier as the user node, the device identifier as the device node, and the login transaction data generated by each user logging into the financial system as the edge. The device nodes included in the graph community include device nodes of normal devices and device nodes of known black market devices.

4. The method according to claim 1, characterized in that, The step of using the known illicit devices to perform edge-following traversal based on the graph community to search for associated users of the known illicit devices includes: Based on the login logs of the known malicious devices, investigate the suspected attack logs of the known malicious devices; Based on the graph community, the user nodes connected to the edges where the suspected attack flow is located are identified as associated users of the known black market devices.

5. The method according to claim 4, characterized in that, The steps for investigating suspected attack logs of known malicious devices based on their login logs include: Determine whether the login transaction volume of the known black market device exceeds a preset threshold within a preset time period; wherein the duration of the preset time period is less than the duration of the preset cycle; If so, the login transaction records of the known malicious devices will be identified as the suspected attack transaction records.

6. The method according to claim 4, characterized in that, The step of searching for suspected illicit devices among the device nodes associated with the associated user in the graph cluster includes: Search the graph community for suspected attack flows associated with the associated users; The smart devices corresponding to the device nodes associated with the suspected attack flow are identified as suspected black market devices associated with the associated users.

7. The method according to claim 2, characterized in that, The method further includes: Extract the sub-community corresponding to the suspected black market device from the map community, so as to verify the suspected black market device by referring to the sub-community.

8. A device for identifying black market equipment, characterized in that, include: The acquisition module is used to acquire a pre-established graph community, wherein the graph community is constructed based on transaction data within a preset period, and the graph community includes user nodes corresponding to multiple user identifiers, device nodes corresponding to multiple smart device identifiers, and edges connecting the user nodes and the device nodes, wherein the edges are used to represent the login transaction data generated by a user logging into the financial system using the smart device; the device identifiers include device identifiers of normal devices and black market device identifiers pre-marked as known black market devices; one end of the edge generated by the login transaction data is connected to the user node, and the other end is connected to the device node; the user node represents a user who uses financial services and logs in, and the device node represents the smart device used by the user to log into the financial system; The search module is used to search for users associated with the known black market devices by performing edge-following traversal based on the graph community. The search module is used to search for suspected black market devices in the network of graphs, using the associated user as the relevant point. The traversal module is used to start from the suspected black market device and continue to traverse along the edges of the graph cluster until all user nodes and device nodes included in the graph cluster are traversed, thereby determining all suspected black market devices included in the graph cluster.

9. A server, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the method described in any one of claims 1-7.

Images