IP geolocation recognition method and device based on deep learning and electronic equipment

Abstract

Embodiments of the present application provide a deep learning-based IP geographical location identification method and device and electronic equipment, and relate to the field of wireless security network management. The method comprises: in response to a geographical location identification request triggered for a first IP address to be identified, issuing a calling request instruction to a deep learning-based IP geographical location identification model; obtaining online data for the first IP address; performing feature vector processing on the at least one first data to obtain a feature vector of the first IP address; using the feature vector of the first IP address as input, identifying the geographical location of the first IP address by using the geographical location identification model; and outputting the geographical location of the first IP address. The method can improve the identification accuracy, efficiency and practicability of the geographical location of the IP address on the basis of improving the reusability of the IP address.

Description

Technical Field

[0001] This application relates to the field of security, particularly to the field of network management for wireless security, and more specifically, to a method, apparatus, and electronic device for IP geolocation identification based on deep learning. Background Technology

[0002] Currently, the main technical solutions in the industry for determining the optimal geographical location of an IP address are based on segmenting the IP address. The effectiveness of this method relies on the premise that IP addresses are allocated to different regional operators, and that this allocation remains fixed. In other words, once an IP address is assigned to an operator, the relationship between the IP address and its region remains unchanged in the long term.

[0003] However, in practical applications, after IP addresses are allocated, operators dynamically schedule them based on the load of IP addresses in different regions under their jurisdiction. IP addresses from regions with lower loads are allocated to regions with higher loads to achieve overall load balancing. For example, an IP segment originally belonging to "China-Guangdong Province-Zhongshan City" might be temporarily allocated to "China-Guangdong Province-Shenzhen City". Therefore, using traditional IP segmentation to determine the actual geographical location of network users is unreliable. Summary of the Invention

[0004] This application provides a method, apparatus, and electronic device for IP geolocation identification based on deep learning, which can improve the accuracy, efficiency, and practicality of IP address geolocation identification while enhancing the reusability of IP addresses.

[0005] On one hand, embodiments of this application provide a deep learning-based IP geolocation identification method, including:

[0006] In response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the invocation of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address;

[0007] Acquire online data for the first IP address, the online data including at least one piece of first data associated with the first IP address and used to construct real-time IP characteristics, which is obtained in real time from an online database;

[0008] The feature vector of the first IP address is obtained by performing feature vector processing on the at least one first data item, and the dimension of the feature vector of the first IP address is equal to the number of the at least one first data item.

[0009] Using the feature vector of the first IP address as input, the geographic location of the first IP address is identified using the geographic location recognition model;

[0010] Output the geographical location of the first IP address.

[0011] On the other hand, embodiments of this application provide an IP geolocation identification device based on deep learning, comprising:

[0012] Acquisition unit, used for:

[0013] In response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the invocation of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address;

[0014] Obtain online data for the first IP address, the online data including at least one piece of first data associated with the first IP address and used to construct real-time IP characteristics, obtained in real time from an online database;

[0015] A processing unit is configured to perform feature vector processing on the at least one piece of first data to obtain a feature vector of the first IP address. Optionally, the dimension of the feature vector of the first IP address is equal to the number of the at least one piece of first data.

[0016] The identification unit is used to identify the geographical location of the first IP address by taking the feature vector of the first IP address as input and using the geographical location identification model.

[0017] The output unit is used to output the geographical location of the first IP address.

[0018] In this embodiment of the application, in response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the invocation of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address; online data for the first IP address is obtained, the online data including at least one piece of first data associated with the first IP address and used to construct real-time IP features, which is obtained in real time from an online database; the geolocation of the first IP address is identified using the feature vector of the first IP address as input, and the geolocation of the first IP address is output. On the one hand, in response to a geolocation identification request triggered by a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the model to perform geolocation identification on the first IP address, thereby improving identification efficiency and the practicality of the solution. On the other hand, since the feature vector of the first IP address used to identify its geolocation is obtained from at least one first data processing operation associated with the first IP address and used to construct real-time IP features, it not only enables the determination of IP address geolocation at the IP address level but also avoids determining IP address geolocation based on IP segmentation. Therefore, it improves the accuracy of IP geolocation identification while enhancing IP address reusability. In short, in this embodiment, by calling a deep learning-based geolocation identification model to identify the geolocation of the first IP address, the accuracy, efficiency, and practicality of IP address geolocation identification are improved while enhancing IP address reusability.

[0019] Furthermore, by accurately identifying the geographical location of IP addresses, it is equivalent to accurately determining the true location of traffic, which directly helps with traffic fraud prevention and product operation. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is an example of a density-based convolutional network provided in the embodiments of this application.

[0022] Figure 2 yes Figure 1 An example of the specific structure of the dense block shown.

[0023] Figure 3 This is a schematic flowchart of the IP geolocation identification method based on deep learning provided in the embodiments of this application.

[0024] Figure 4 This is a performance comparison diagram of different models for IP address geolocation identification provided in the embodiments of this application.

[0025] Figure 5 This is a schematic diagram of the processing procedure of the geographic location recognition model provided in the embodiments of this application.

[0026] Figure 6 This is a schematic diagram of the online and offline parts of the geolocation recognition model provided in the embodiments of this application.

[0027] Figure 7 This is a schematic flowchart illustrating the method for online identification based on a geographic location identification model trained offline, as provided in the embodiments of this application.

[0028] Figure 8 This is a schematic flowchart of an IP geolocation identification device based on deep learning provided in an embodiment of this application.

[0029] Figure 9 This is a schematic flowchart of the electronic device provided in the embodiments of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0031] The solutions provided in this application may involve artificial intelligence technology.

[0032] Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that utilize digital computers or computers-controlled machines to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce new intelligent machines that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities.

[0033] It should be understood that artificial intelligence (AI) technology is a comprehensive discipline involving a wide range of fields, encompassing both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0034] With the research and advancement of artificial intelligence (AI) technology, AI is being studied and applied in various fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, and smart customer service. It is believed that with the development of technology, AI will be applied in more fields and play an increasingly important role.

[0035] This application's embodiments may relate to Computer Vision (CV) technology within artificial intelligence. Computer vision is a science that studies how to enable machines to "see." More specifically, it refers to machine vision that uses cameras and computers to replace human eyes in recognizing, tracking, and measuring targets, and further performs image processing to transform the computer-processed images into those more suitable for human observation or transmission to instruments for detection. As a scientific discipline, computer vision researches related theories and technologies, attempting to establish artificial intelligence systems capable of extracting information from images or multidimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, 3D object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping (SLAM), and other technologies, as well as common biometric recognition technologies such as facial recognition and fingerprint recognition.

[0036] This application's embodiments may also relate to Machine Learning (ML) in artificial intelligence technology. ML is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory, and many other disciplines. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0037] Furthermore, the solutions provided in this application may involve blockchain technology.

[0038] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying platform, a platform product service layer, and an application service layer.

[0039] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operational monitoring. The user management module is responsible for managing the identity information of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the correspondence between user real identities and blockchain addresses (access management). Furthermore, under authorization, it monitors and audits transactions of certain real identities and provides risk control rule configuration (risk control audit). The basic services module is deployed on all blockchain node devices to verify the validity of business requests. After consensus is reached on valid requests, they are recorded in storage. For a new business request, the basic services first perform interface adaptation parsing and authentication (interface adaptation), and then encrypt the business information through a consensus algorithm (consensus management). After encryption, the data is transmitted completely and consistently to the shared ledger (network communication) and recorded and stored. The smart contract module is responsible for contract registration, issuance, triggering, and execution. Developers can define contract logic using a programming language and publish it to the blockchain (contract registration). According to the contract terms, the key or other events are invoked to trigger execution and complete the contract logic. It also provides functions for contract upgrades and cancellations. The operation monitoring module is mainly responsible for deployment, configuration modification, contract settings, cloud adaptation, and real-time status visualization output during product release, such as alarms, monitoring network conditions, and monitoring the health status of node devices.

[0040] The platform's product service layer provides the basic capabilities and implementation frameworks for typical applications. Developers can leverage these basic capabilities, along with the specific characteristics of their business needs, to implement blockchain-based business logic. The application service layer provides blockchain-based application services to business stakeholders.

[0041] Furthermore, embodiments of this application relate to the field of security, and more particularly to the field of network management for wireless security. Specifically, it relates to the field of security management of Internet Protocol (IP) addresses in wireless security.

[0042] To facilitate understanding of the proposed solution, the relevant terms used in this application will be explained below.

[0043] 1. WiFi Manager:

[0044] A free WiFi management software offering exclusive access to hundreds of millions of hotspots nationwide. It features industry-leading security scanning and monitoring, one-click detection, and intelligent risk identification to safeguard your WiFi connections. The product supports both Android and iOS platforms.

[0045] 2. WiFi type:

[0046] WiFi Manager uses self-developed technology to identify different types of WiFi, including risky WiFi, bot WiFi, free WiFi, and private WiFi.

[0047] 3. Internet Protocol version 4 (IPv4):

[0048] Internet Protocol version 4 (IPv4), also known as the fourth version of the Internet Protocol, is the fourth revision in the development process of the Internet Protocol. IPv4 uses 32-bit (4-byte) addresses, and there are only 4,294,967,296 (2^32) addresses in the address space. Because some addresses are reserved for special purposes, such as private networks (approximately 18 million addresses) and multicast addresses (approximately 270 million addresses), the number of addresses that can be routed on the Internet is reduced. As addresses are continuously allocated to end users, the problem of IPv4 address exhaustion arises.

[0049] 4. Geographic location matching:

[0050] Geographic location matching is a service or process used to geolocate IP addresses assigned by operators, identifying the geographical range in which the IP address is assigned and used. The matching results of geographic location matching can be accurate to the district or county level.

[0051] 5. Uncertainty regarding IP address geolocation:

[0052] Due to the objective contradiction between the scarcity of IPv4 addresses and the explosive growth in demand for network access, operators dynamically allocate IP addresses belonging to different regions in order to alleviate the conflict. For example, an IP segment originally belonging to "China-Guangdong Province-Zhongshan City" might be temporarily assigned to "China-Guangdong Province-Shenzhen City". In this case, the actual location of the IP address originally belonging to Zhongshan City is Shenzhen City.

[0053] Currently, the main technical solutions in the industry for determining the optimal geographical location of an IP address are based on segmenting the IP address. The effectiveness of this method relies on the premise that IP addresses are allocated to different regional operators, and that this allocation remains fixed. In other words, once an IP address is assigned to an operator, the relationship between the IP address and its region remains unchanged in the long term.

[0054] However, in practical applications, after IP addresses are allocated, operators dynamically schedule them based on the load of IP addresses in different regions under their jurisdiction. IP addresses from regions with lower loads are allocated to regions with higher loads to achieve overall load balancing. For example, an IP segment originally belonging to "China-Guangdong Province-Zhongshan City" might be temporarily allocated to "China-Guangdong Province-Shenzhen City". In this case, determining the geographical location of an IP address based on IP segmentation is unreliable.

[0055] Based on this, this application provides a scheme for identifying the geographical location of IP addresses using a deep learning-based geographical location identification model. Based on WiFi geographical location and combined with deep learning modeling methods, a simple, easy-to-use, highly accurate, and practical scheme for identifying the geographical location of IP addresses is explored. The scheme provided in this application can improve the reusability of IP addresses while enhancing the accuracy, efficiency, and practicality of geographical location identification. Furthermore, accurately identifying the geographical location of IP addresses is equivalent to accurately determining the true location of traffic, which directly helps with traffic fraud prevention and product operation.

[0056] It should be noted that the geographic location recognition model involved in this application can be any deep learning or machine learning-based model for recognition, and the embodiments of this application do not specifically limit it. As an example, the geographic location recognition model includes, but is not limited to: traditional learning models, ensemble learning models, or deep learning models. Optionally, traditional learning models include, but are not limited to: tree models (regression trees) or logistic regression (LR) models; ensemble learning models include, but are not limited to: improved gradient boosting algorithms (XGBoost) or random forest models; deep learning models include, but are not limited to: Long Short-Term Memory (LSTM) networks or neural networks. Of course, in other embodiments of this application, other machine learning models can also be used, and this application does not specifically limit them. For ease of understanding, the geographic location recognition model provided in this application is illustrated below using a density convolutional network (DenseNet) model as an example. The defining characteristic of density-based convolutional neural networks (DCNNs) is the dense connection between all preceding and subsequent layers. This feature reuse is achieved through channel-based connections, significantly reducing the number of network parameters and mitigating gradient vanishing. This allows DCNNs to achieve superior performance compared to other network structures with fewer parameters and lower computational costs. Compared to other models, DCNNs naturally integrate identity mapping, deep supervision, and diverse depth features. Identity mapping alleviates gradient vanishing, enhances feature propagation, encourages feature reuse, and greatly reduces the number of parameters. Furthermore, each layer has a gradient directly from the original input to the loss function, providing implicit deep supervision, which is beneficial for training deep networks. Finally, dense connections act as a regularization mechanism, reducing overfitting on small training sets.

[0057] Figure 1 This is an example of a density-based convolutional network provided in the embodiments of this application.

[0058] like Figure 1As shown, the density convolutional network comprises three dense blocks: Dense Block 1, Dense Block 2, and Dense Block 3. Each dense block contains the same number of layers, specifically five layers per block. The internal structure of each of these three dense blocks is densely connected. In practical applications, the training set passes through a convolutional layer before entering Dense Block 1. The output channel of this convolutional layer is 16, and the size of the feature map remains unchanged. Between two dense blocks is a transition layer, which may include a 1×1 convolutional layer and a pooling layer. Dense Block 3 is followed by a pooling layer and a softmax classifier. As an example in this application, the feature map sizes of these three dense blocks can be 32×32, 16×16, and 8×8, respectively.

[0059] Figure 2 yes Figure 1 An example of the specific structure of the dense block shown.

[0060] like Figure 2 As shown, Figure 1The density-based convolutional network shown comprises three dense blocks: Dense Block 1, Dense Block 2, and Dense Block 3. Each of these three dense blocks contains five layers: X0, X1, X2, X3, X4, and X5, and each of these three dense blocks is configured with dense connections. Dense connections can be understood as connections from any layer to all subsequent layers. For example, layers may be connected to Batch Normalization (BN) layers, ReLU activation function layers, and convolutional layers (e.g., 3×3 convolutional layers). At each layer of the network, the input is first fed to the BN layer, where normalization is performed, before proceeding to the next layer. The BN layer is a learnable, parameterized network layer. As an example, a layer H1 can be placed between X0 and X1, which includes a batch normalization (BN) layer and an activation function layer; a layer H2 can be placed between X1 and X2, which includes a BN layer, an activation function (ReLU) layer, and a convolutional layer; a layer H3 can be placed between X2 and X3, which includes a BN layer, an activation function (ReLU) layer, and a convolutional layer; a layer H4 can be placed between X3 and X4, which includes a BN layer, an activation function (ReLU) layer, and a convolutional layer; X4 is connected to the next dense block through a transition layer. All layers in a dense block of a density-convolutional network are interconnected, or in other words, each layer receives all the layers preceding it as additional input. Therefore, in a density-convolutional network, each layer is concatenated with all the preceding layers in the channel dimension, serving as the input to the next layer.

[0061] To facilitate understanding, the terminology used in density-based convolutional networks will be explained below.

[0062] Pooling Layer:

[0063] When feature map sizes differ, dense blocks cannot be implemented using dense connections alone. Density convolutional networks divide the network into multiple densely connected blocks. Downsampling operations are required between these blocks. Since each layer in the network receives features from all preceding layers as input, to prevent the feature dimensionality of later layers from growing too rapidly with increasing network layers, downsampling after each stage first compresses the feature dimensionality to half of the current input using a convolutional layer before proceeding with the downsampling operation. Specifically, downsampling is performed using pooling layers within the transformation layer. Sampling is achieved using pooling techniques to reduce feature dimensionality while preserving effective information, thus mitigating overfitting to some extent. It is also used to maintain invariance to rotation, translation, and scaling. Sampling includes maximum sampling, average sampling, summation region sampling, and random region sampling. Similarly, pooling can be categorized into maximum pooling, average pooling, random pooling, and summation region pooling.

[0064] Dense Connectivity:

[0065] Dense blocks employ dense connections within themselves. Connections from any layer can reach all subsequent layers. Between layers are batch normalization (BN) layers, ReLU activation function layers, and convolutional layers (e.g., 3×3 convolutional layers). At the input of each layer, a batch normalization layer is inserted, performing a normalization process before proceeding to the next layer. The batch normalization layer is a learnable, parameterized network layer.

[0066] Growth Rate:

[0067] The growth rate refers to the number of convolutional layers in each dense block up to the last 3x3 layer, denoted as k. Since each dense block is ultimately connected by concatenation, the feature dimension of the next layer increases by k with each dense block. A larger feature dimension means more information flows through the network, resulting in a more powerful network, but also increasing the overall model size and computational cost. If each layer produces k feature maps, then the number of feature maps input to the Lth layer is k0 + k(L-1), where k0 is the input dimension. The difference between density-based convolutional networks and other network structures is that the layers in a density-based convolutional network can be very narrow.

[0068] Bottleneck Layers:

[0069] A 1×1 convolutional layer can serve as a bottleneck layer before a 3×3 convolutional layer, reducing the dimensionality (channels) of the input feature map and thus improving computational efficiency. Furthermore, this application introduces this structure into a density-based convolutional network, enabling the 1×1 convolutional layer to output a 4k-dimensional feature map. A density-based convolutional network incorporating this structure can also be called DenseNet-B.

[0070] Batch size:

[0071] The batch size is the number of samples selected in a single training iteration. The value of the batch size determines the time required to complete each epoch and the smoothness of the gradient between iterations during deep learning training. For a training set of size N, if the sampling method for each epoch uses the most common method of sampling N samples once, let the batch size be b, then the number of iterations required for each epoch (including forward and backward directions) is N / b. Therefore, the time required to complete each epoch generally increases with the number of iterations. If the batch size is too small, it takes too much time and causes severe gradient oscillations, which is detrimental to convergence; if the batch size is too large, the gradient direction remains unchanged across different batch sizes, making it easy to get trapped in local minima. This application does not specifically limit the value of the batch size; for example, a suitable batch size can be determined based on actual needs or scenarios. Of course, in databases with small sample sizes, not using a batch size is feasible and effective. However, for large databases, inputting all data into the network at once will definitely cause memory overflow; in this case, a batch size can be used for network training.

[0072] As an example in this application, for the density convolutional network model, the batch size can be set to 32. The initial learning rate is 0.1, divided by 5 at the 50% and 75% time points of the epoch. When training the neural network, the learning rate controls the update speed of the parameters. A learning rate that is too small will significantly reduce the convergence speed and increase training time; a learning rate that is too large may cause the parameters to oscillate around the optimal solution. An epoch refers to the process of all data being fed into the network to complete one forward computation and backpropagation.

[0073] Figure 3This is a schematic flowchart of the IP geolocation identification method 100 based on deep learning provided in this application embodiment. It should be noted that the solution provided in this application embodiment can be executed by any electronic device with data processing capabilities. For example, the electronic device can be implemented as a server. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and big data and artificial intelligence platforms. The server can be directly or indirectly connected via wired or wireless communication, and this application does not impose any limitations on this.

[0074] like Figure 3 As shown, the method 100 may include:

[0075] S110, in response to the geolocation identification request triggered for the first IP address to be identified, a call request instruction is sent to the deep learning-based IP geolocation identification model to request the call of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address;

[0076] S120, Obtain online data for the first IP address, the online data including at least one piece of first data associated with the first IP address and used to construct real-time IP characteristics, obtained in real time from an online database;

[0077] S130, perform feature vector processing on the at least one piece of first data to obtain the feature vector of the first IP address. Optionally, the dimension of the feature vector of the first IP address is equal to the number of the at least one piece of first data;

[0078] S140, using the feature vector of the first IP address as input, the geographical location of the first IP address is identified using the geographical location identification model;

[0079] S150 outputs the geographical location of the first IP address.

[0080] In other words, the recognition process of the geolocation recognition model can be initiated through an online service. For example, when a client calls the service interface, the server invokes a stored geolocation recognition model, retrieves at least one piece of first data from the online database, processes it based on this first data to obtain a feature vector for the first IP address, and inputs this feature vector into the deep learning-based geolocation recognition model for geolocation recognition processing, thus obtaining the geolocation recognition result returned by the deep learning-based geolocation recognition model. Optionally, the at least one piece of first data can be raw data or data processed from raw data, such as numerical values ​​directly used to construct a feature vector; in this case, the first data can also be called feature data. Optionally, the at least one piece of first data can also be called at least one basic profile feature.

[0081] In this embodiment, in response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the invocation of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address; online data for the first IP address is acquired, the online data including at least one piece of first data associated with the first IP address and used to construct real-time IP features, which is obtained in real time from an online database; the at least one piece of first data is processed into a feature vector of the first IP address, the dimension of the feature vector of the first IP address being equal to the number of the at least one piece of first data; the geolocation of the first IP address is identified using the geolocation identification model with the feature vector of the first IP address as input; and the geolocation of the first IP address is output. On the one hand, in response to a geolocation identification request triggered by a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the model to perform geolocation identification on the first IP address, thereby improving identification efficiency and the practicality of the solution. On the other hand, since the feature vector of the first IP address used to identify its geolocation is obtained from at least one first data processing operation associated with the first IP address and used to construct real-time IP features, it not only enables the determination of IP address geolocation at the IP address level but also avoids determining IP address geolocation based on IP segmentation. Therefore, it improves the accuracy of IP geolocation identification while enhancing IP address reusability. In short, in this embodiment, by calling a deep learning-based geolocation identification model to identify the geolocation of the first IP address, the accuracy, efficiency, and practicality of IP address geolocation identification are improved while enhancing IP address reusability.

[0082] Furthermore, by accurately identifying the geographical location of IP addresses, it is equivalent to accurately determining the true location of traffic, which directly helps with traffic fraud prevention and product operation.

[0083] Figure 4 This embodiment of the application provides a comparison of the performance of a location recognition model based on a density convolutional network and a conventional classification model, using weighted F1 score as the evaluation metric. Figure 4 As shown, judging from the F1 score of the weights, the geographic location recognition model based on density convolutional networks improves performance by 38.68% compared to conventional classification models. In other words, applying deep learning modeling schemes to business scenarios of accurate IP geographic location recognition can improve the accuracy or recognition effect of identifying the geographic location of IP addresses.

[0084] It should be noted that the specific implementation of the online database in this application embodiment is not limited. For example, the online database can be implemented using a cache, which is a high-speed, small-capacity temporary memory. It can be implemented using a high-speed static memory chip or integrated into the central processing unit (CPU) chip to store the instructions or operation data most frequently accessed by the CPU. The basic principle of the cache is that data exchange between the CPU and the cache is in units of words, while data exchange between the cache and main memory is in units of blocks. A block consists of several fixed-length words. When the CPU reads a word from main memory, it issues the memory address of this word to the cache and main memory. At this time, the cache control logic determines whether the word is currently in the cache based on the address: if it is in the cache, the word is immediately transferred to the CPU; if it is not in the cache, the word is read from main memory and sent to the CPU using a main memory read cycle. At the same time, the entire data block containing this word is read from main memory and sent to the cache.

[0085] In some embodiments, the at least one first data item is used to characterize the number of times at least one raw data item associated with the first IP address is reported in the target time dimension; the S130 may include: performing time-dimensional data processing on the at least one first data item to obtain at least one numerical value, the at least one numerical value being used to characterize the ratio of the number of times the at least one raw data item is reported in the historical time dimension to the at least one first data item; and performing feature vector concatenation processing on the at least one numerical value to obtain the feature vector of the first IP address.

[0086] In this embodiment, the duration of the historical time dimension can be greater than or equal to the duration of the target time dimension. For example, the number of times the at least one piece of original data is reported in the historical time dimension can be the full dataset. Of course, in other alternative embodiments of this application, the at least one piece of first data can also be directly concatenated to obtain the feature vector of the first IP address.

[0087] In one implementation, in each of at least one time dimension, the at least one first data item is processed in the time dimension to obtain the at least one numerical value, and the at least one time dimension includes the target time dimension; based on this, at least one feature vector is obtained by concatenating the at least one numerical value in each time dimension; and the at least one feature vector is subjected to feature vector concatenation processing to obtain the feature vector of the first IP address.

[0088] In this application, the specific implementation of the at least one time dimension is not limited. As an example, the at least one time dimension includes, but is not limited to, hours, days, weeks, months, quarters, half-years, and years. As another example, the at least one time dimension can be user-defined, such as at least one time period set by the user. Optionally, the at least one dimension may partially overlap or not overlap at all.

[0089] In one implementation, before performing time-dimensional data processing on the at least one first data item to obtain at least one numerical value, historical data is obtained from an offline database. The historical data includes at least one second data item associated with the first IP address. The at least one second data item is used to characterize the number of times the at least one original data item associated with the first IP address was reported in the historical time dimension. Based on this, the ratio of the at least one second data item to the at least one first data item is determined as the at least one numerical value.

[0090] Of course, in other alternative embodiments of this application, the historical data can also be historically reported data obtained from an online database, and this application does not specifically limit this.

[0091] In some embodiments, before retrieving online data for the first IP address from an online database, the method 100 may further include:

[0092] The raw dataset is obtained through a service request. The raw dataset includes at least one piece of raw data associated with the first IP address. The raw data includes any one of the following: the user using the first IP address, the Wi-Fi using the first IP address, and the geographical location of the Wi-Fi. The Wi-Fi is uniquely identified by a Service Set Identifier (SSID) or a Basic Service Set Identifier (DSSID). The geographical location of the Wi-Fi is obtained through a map application. The at least one piece of raw data is processed into the at least one piece of first data using feature engineering. The online data is stored in the online database.

[0093] Of course, in other alternative embodiments, before retrieving online data for the first IP address from the online database, method 100 may further include:

[0094] The raw dataset is obtained through a service request. The raw dataset includes at least one piece of raw data associated with the first IP address. The raw data includes any one of the following: the user using the first IP address, the Wi-Fi using the first IP address, and the geographical location of the Wi-Fi. The Wi-Fi is uniquely identified by a Service Set Identifier (SSID) or a Basic Service Set Identifier (DSSID). The geographical location of the Wi-Fi is obtained through a map application. The raw dataset is stored in the online database. Based on this, the at least one piece of raw data can be obtained from the online database. The at least one piece of raw data is processed into the at least one piece of first data using feature engineering.

[0095] Feature engineering can include modules or processes such as feature extraction, feature construction, and feature selection. Feature extraction automatically constructs new features, transforming raw data into a set of features with clear physical, statistical, or kernel significance. Feature construction involves manually constructing new features from the raw data. Feature selection selects a subset of features with the most statistical significance from the feature set, thereby achieving dimensionality reduction. For feature extraction, the object of feature extraction is the raw data, i.e., the original features, which are used to construct new features, that is, to transform the raw data into a set of features with clear physical or statistical significance. Raw data can include static data and dynamic data, where static data can be attribute information of users or devices, and dynamic features can be data representing user operation behavior. Of course, the specific form of the raw data is not limited in this application embodiment. As an example, the raw data can be constructed as tabular data to obtain a feature matrix. Based on this, Principal Component Analysis (PCA) can be used to extract features and create new features. For feature construction, feature construction refers to manually constructing new features from the raw data. Specifically, by using real data samples to identify IP geographic locations, the potential forms and data structures of new features can be determined, enabling better application in geographic location recognition models. Feature construction requires strong insight and analytical capabilities, demanding the ability to identify physically meaningful features from the raw data. Assuming the raw data is tabular, new features can be created using mixed or combined attributes, or by decomposing or segmenting existing features. For feature selection, features can be ranked based on their importance, and then selected based on the ranking results. Assuming a standard tabular dataset exists, each row (category item) represents a sample data point, and each column (feature item) represents a feature. Among these features, some carry rich information, while others carry little. Features carrying little information are considered irrelevant data. Feature importance can be measured by the correlation (feature importance) between feature items and category items, and then feature selection can be made based on the feature ranking results.

[0096] It should be noted that the embodiments of this application do not limit the specific processes involved in feature engineering. As examples, the processes involved in feature engineering include, but are not limited to: binning, one-hot encoding, feature hashing, embedding, log transformation, feature scaling, normalization, or feature interaction. Of course, other processes may also be included, and the embodiments of this application do not limit them.

[0097] It should also be noted that a feature is an abstract result of the characteristics of an object or a group of objects. Derived features refer to new features obtained through feature learning from the original data. Derived features are generally caused by two reasons: changes in the data itself, resulting in many features that were not originally present; and during feature learning, the algorithm generates derived features based on certain relationships between features, sometimes reflecting the relationships between data features more effectively. Derived features also require machine learning and deep learning algorithms to have stronger learning capabilities, namely incremental learning, online learning, and transfer learning. In computer science, derived features refer to new features obtained through feature learning from the original data. In machine learning, there are several reasons for the generation of derived features: the data has a time attribute, exhibiting strong temporal characteristics; the data is dynamic, disordered, infinite, or bursty. Data features are divided into continuous features and categorical features, with categorical features also known as discrete features. Different data types require different processing methods. For example, for continuous features, normalization is a commonly used method for processing continuous data features, aiming to quickly find the optimal solution through gradient descent. Feature standard normalization can be mainly divided into linear normalization and nonlinear normalization.

[0098] As an example of this application, feature engineering can be achieved through at least one of the following processes:

[0099] 1. One-Hot Encoding:

[0100] For characteristic data such as provinces and cities, one-hot encoding can be used to process the data. One-hot encoding, also known as one-bit valid encoding, uses an N-bit state register to encode N states. Each state has its own independent register bit, and at any given time, only one bit is valid.

[0101] 2. Count Encoding:

[0102] To determine the frequency of occurrence of "IP_A" in "China-Guangdong-Guangzhou", a counting encoding method can be used to identify the degree of association between "IP_A" and "China-Guangdong-Guangzhou". This can be implemented using a counting function.

[0103] 3. Category Embedding:

[0104] Data analysis reveals that many categories exhibit strong sparsity in their feature data. To avoid overfitting and improve model stability, neural networks are introduced to transform high-dimensional, sparse categorical variables into low-dimensional, dense embedding variables. Overfitting refers to making assumptions overly strict in an attempt to obtain consistent hypotheses. Embedding refers to mapping one feature data point into another (i.e., the embedded variable). Embedding transforms large, sparse vectors into a low-dimensional space that preserves semantic relationships, thus reducing dimensionality. In practice, category embedding can be achieved through feature derivation processes, namely, generating derived features through feature transformation, feature squaring, and feature addition / subtraction.

[0105] 4. Not a Number (NaN) Embedding:

[0106] The non-numerical embedding process for feature data specifically includes: ① Discarding feature data with too many missing values: This involves setting a missing value filtering threshold = sample data size × n, where n can be set to 0.4, but the specific threshold can be adjusted based on the application scenario. If the number of missing values ​​for a feature exceeds this threshold, that feature is filtered out, and single-value features are also deleted. ② Outlier handling: Based on the feature distribution, outliers that are too large and rank in the top 1 / m are discarded, where m can be set to 10000, but the specific threshold can be adjusted based on the application scenario. ③ Imputation: Missing values ​​can be imputed. Missing values ​​can refer to feature data with missing labels or feature data lacking key information. For example, continuous features are imputed with the mean, and discrete features are imputed with a constant as a separate category. Continuous features are uncountable, while discrete features are countable. Discrete features can be directly represented by data; continuous features are uncountable, but continuous features can be represented by formulas.

[0107] 5. Feature Scaling.

[0108] Based on the distribution of numerical features, an appropriate normalization method is selected to eliminate dimensional differences between features, making the model more stable. For example, Gaussian normalization is chosen for features that conform to or approximately conform to a normal distribution. Here, dimension refers to the fundamental property of a physical quantity. Physics studies can quantitatively describe various physical phenomena, and the various physical quantities used in the description have close relationships, that is, they have definite functional relationships. To accurately describe these relationships, physical quantities can be divided into fundamental quantities and derived quantities. Fundamental quantities are physical quantities with independent dimensions, while derived quantities are physical quantities whose dimensions can be expressed as a combination of the dimensions of fundamental quantities; all derived quantities can be derived from fundamental quantities, thus establishing the functional relationships between all physical quantities. This functional relationship is usually called a system of quantities.

[0109] As another example of this application, feature engineering can be used to process raw data. For example, non-embedded feature engineering methods or embedded deep learning feature engineering methods can be used to process raw data. As examples, non-embedded feature engineering methods include, but are not limited to, Spark-based feature processing methods. Embedded feature engineering methods include, but are not limited to, TensorFlow-based feature processing methods. Specifically, Spark-based feature processing methods can be implemented through the Spark computing engine; TensorFlow-based feature processing methods can be implemented through the TensorFlow computing engine. Spark is a safe, formally defined programming language. Spark is a distributed big data computing framework based on in-memory computing. Spark provides interactive querying, near real-time processing, and ensures high fault tolerance and scalability, allowing users to deploy Spark on a large number of inexpensive hardware devices to form a cluster. It executes various concurrent operations and computations on the cluster by running a user-defined main function. Tensor flow, where a tensor is an N-dimensional array and a flow is the computation of a data-driven graph, describes the process of tensors flowing from one end of the graph to the other. Tensor flow is a system that transmits complex data structures to artificial intelligence neural networks for analysis and processing. It can be used in various machine learning and deep learning fields, such as speech recognition and image recognition, and can run on a wide range of devices, from a small smartphone to thousands of data center servers.

[0110] In one implementation, the original dataset also includes a timestamp corresponding to each of the at least one piece of original data, the timestamp being used to identify the reporting time of the original data; based on this, under the target time dimension, for each piece of original data, the number of timestamps corresponding to the original data calculated using the feature engineering is determined as one of the first data in the at least one piece of first data.

[0111] In other words, this timestamp can be used to count the number of times the raw data was reported.

[0112] In some embodiments, the method 100 may further include:

[0113] Output feedback information on the geographical location of the first IP address. This feedback information is used to indicate whether the output geographical location of the first IP address is the actual geographical location of the first IP address.

[0114] In other words, it can provide feedback on the online recognition results, that is, on the user interface (UI) side, it can record or provide feedback on the online business results of the IP geolocation output by the model in real time.

[0115] In some embodiments, the first IP address is the client's outgoing IP address.

[0116] In this embodiment, feature vectors and geographical locations are constructed at the granularity of the client's exit IP address. Since the client's exit IP address can uniquely identify the device, accurately identifying the geographical location of the client's exit IP address is equivalent to accurately determining the true location of traffic, which directly helps with traffic fraud prevention and product operation. It should be noted that the client's exit IP address can also be called an external IP address. The difference between an inbound IP address and an external IP address is that an inbound IP address is generally limited to the address of the local router to the outside world. Even if there are multiple routers, the IP address displayed on each router is different. If information is sent using a non-external IP address, the sent information must be translated by the router and then the information will be recognized by the external network. In other alternative embodiments, the first IP address can also be an internal IP address similar to an external IP address. This application does not specifically limit this.

[0117] In some embodiments, before retrieving online data for the first IP address from an online database, the method 100 may further include:

[0118] Training data is obtained from an offline database. This training data includes at least one piece of training data associated with the second IP address. Each piece of training data is used to characterize the number of times the at least one piece of raw data associated with the second IP address is reported in the training time dimension. Based on this, the at least one piece of training data is processed into a feature vector of the second IP address. The geographical location of the labeled second IP address is obtained. The feature vector of the second IP address and the geographical location of the labeled second IP address are used as a training sample in the training set. The geographical location recognition model is trained using the training set as input.

[0119] In other words, the training set may include multiple training samples. These training samples can be positive or negative. This article only uses one training sample as an example; the remaining training samples can be generated in the same way, and to avoid repetition, they will not be elaborated upon here. Optionally, the at least one piece of second data can be the original data or data processed from the original data. For example, it can be numerical values ​​directly used to concatenate into a feature vector; in this case, the second data can also be called feature data.

[0120] In some embodiments, the method 100 may further include:

[0121] The geographic location recognition model is evaluated offline using a weighted F1 score metric. If the offline evaluation result is positive, the files included in the geographic location recognition model are uploaded to the network. If the offline evaluation result is negative, the geographic location recognition model is retrained until the offline evaluation result is positive. In one implementation, the geographic location recognition model is retrained by adjusting at least one of the following: the training time dimension of the training samples, the drill-down dimension of the training samples, and the parameters of the geographic location recognition model.

[0122] It should be noted that the embodiments of this application can perform offline evaluation on the trained geolocation recognition model. However, the embodiments of this application do not limit the specific methods or evaluation metrics for offline evaluation. The weighted F1 score is only one example of the evaluation metric in this application. Regarding the weighted F1 score, since the geolocation recognition model is essentially a multi-class problem for identifying the geolocation of IP addresses, there is a sample imbalance problem in the multi-class samples. For example, the number of IP addresses in China-Guangdong-Guangzhou is much greater than that in China-Tibet-Linzhi. Using the weighted F1 score as an evaluation metric can well reflect the classification differences between categories with different sample sizes. The weighted F1 score can be used to comprehensively reflect the results of precision and recall. Specifically, the F1 score of each category is calculated first, and then the final F1 score is calculated. The difference from the standard F1 score is that the weight of the F1 score of each category can be assigned based on the number of samples in each category. Therefore, the final F1 score can be calculated based on the weight of the F1 score of each category and the corresponding F1 score. In one implementation, the harmonic mean of precision and recall can be used to determine the weighted F1 score. In another implementation, the weighted F1 score can be determined using the following formulas: S = (2*p*r) / (p+r); p = TP / (TP+FP); r = TP / (TP+FN). Where S represents the weighted F1 score; p represents precision, which indicates how many samples identified as positive are actually positive; r represents recall, which indicates how many positive samples are correctly identified; True Positive (TP) represents a true positive example correctly identified as a positive example; False Positive (FP) represents a true negative example incorrectly identified as a positive example; False Negative (FN) represents a true positive example incorrectly identified as a negative example.

[0123] In some embodiments, the method 100 may further include:

[0124] The geolocation recognition model uploaded to the network is evaluated online using A / B testing. If the online evaluation result is positive, the files included in the geolocation recognition model are fixed. If the online evaluation result is negative, the geolocation recognition model is retrained, and the retrained and re-uploaded geolocation recognition model is evaluated online until the online evaluation result is positive. In one implementation, the geolocation recognition model is retrained by adjusting at least one of the following: the training time dimension of the training samples, the drill-down dimension of the training samples, and the parameters of the geolocation recognition model.

[0125] It should be noted that the embodiments of this application can perform online evaluation of the trained geolocation recognition model. However, the embodiments of this application do not limit the specific methods or evaluation metrics for online evaluation. The metrics used for online model evaluation can be used to consider the help that the geolocation recognition model brings to specific businesses. A / B testing as an evaluation metric is only one example of this application. Regarding A / B testing, it is a method used to test the online performance of a geolocation recognition model. In the test, there are generally two groups of users: a control group and an experimental group. The control group uses a conventional classification model, and the experimental group uses the geolocation recognition model provided in this application. Based on this, the positive and negative values ​​of various business metrics for the geolocation recognition model provided in this application can be tested to evaluate the performance of the geolocation recognition model. If the evaluation metric is negative, the geolocation recognition model is retrained until the geolocation recognition model performs as expected.

[0126] In some embodiments, if either the offline or online evaluation results of the geolocation recognition model are unsatisfactory, the geolocation recognition model is retrained until all evaluation metrics pass. For example, adjustments can be made by using different model adjustment directions. This includes selecting different training time dimensions, different positive and negative samples for different drill-down dimensions, and adjusting the key parameters of the geolocation recognition model. For instance, a grid search can be performed on the key parameters of the geolocation recognition model to select the optimal parameter combination. Drill-down dimensions are specific to certain scenarios. When there is a hierarchical relationship between dimensions, such as province > city > district, drill-down dimensions can accelerate queries at each level. The purpose of drill-down is to change the dimensional hierarchy and transform the granularity of analysis.

[0127] It should be noted that the specific implementation method of the geolocation recognition model is not limited in the embodiments of this application. As an example of this application, the trained geolocation recognition model can be fixed based on the Saver() function of TensorFlow. For example, the geolocation recognition model and its parameters can be saved and restored using the Saver() function of TensorFlow. In the implementation, the following four files can be generated: a checkpoint text file, which records a list of file path information for the geolocation recognition model; model checkpoint data (model.ckpt.data), which records information about network weights; and model checkpoint index data (model.ckpt.index.data) and index, which can be a binary file used to store the variable weight information of the geolocation recognition model.

[0128] Figure 5 This is a schematic diagram of the processing procedure of the geographic location recognition model provided in the embodiments of this application.

[0129] like Figure 5 As shown, the processing of a geographic location recognition model can include the accumulation of raw data, the data processing based on feature engineering, and the training and evaluation of the model.

[0130] Regarding the accumulation of raw data, on the one hand, the log data from real-time online requests is stored in the Hadoop Distributed File System (HDFS), i.e., the reporting and storage of log data. HDFS is a distributed file system designed to run on commodity hardware. While it shares many similarities with other distributed file systems, its differences are also significant. HDFS is a highly fault-tolerant system, suitable for deployment on inexpensive machines; it provides high-throughput data access, making it ideal for applications on large-scale datasets. Furthermore, log data for training models can be extracted and stored from the stored log data. On the other hand, considering storage costs and subsequent computational efficiency, key information from the log data can be extracted using Hive Structured Query Language (Hive SQL), i.e., redundant data is discarded to obtain the raw data. The extracted raw data can then be stored.

[0131] Feature engineering-based data processing utilizes feature engineering to process accumulated raw data. Based on the raw features stored in HDFS, appropriate feature processing methods are applied to obtain feature data. For example, non-embedded feature engineering methods or embedded deep learning feature engineering methods can be used to process accumulated raw data. As examples, non-embedded feature engineering methods include, but are not limited to, Spark-based methods. Embedded feature engineering methods include, but are not limited to, TensorFlow-based methods. Specifically, Spark-based methods can be implemented using the Spark computing engine; TensorFlow-based methods can be implemented using the TensorFlow computing engine.

[0132] Spark is a secure, formally defined programming language designed to support applications where security or commercial integration is a critical factor. Spark is a distributed big data computing framework based on in-memory computing. It provides interactive querying, near real-time processing, and high fault tolerance and scalability, allowing users to deploy Spark on a large number of inexpensive hardware devices to form clusters. It executes various concurrent operations and computations on the cluster by running a user-defined main function. Tensor flow, where a tensor is an N-dimensional array and a flow is computation based on a data flow graph, describes the process of tensors flowing from one end of the graph to the other. Tensor flow is a system that transmits complex data structures to artificial intelligence neural networks for analysis and processing. Tensor flow can be used in various machine learning and deep learning fields such as speech recognition and image recognition, and it can run on a wide range of devices, from a small smartphone to thousands of data center servers.

[0133] After processing the accumulated raw data using feature engineering, feature data can be obtained. This feature data is stored in HDFS and can be used for training and evaluation of geolocation recognition models.

[0134] For the model training and evaluation process, firstly, feature data is read from HDFS to the local processor using Hive SQL. Then, the read feature data is processed (e.g., concatenated) to obtain feature vectors, which can be used to train the geolocation recognition model. Finally, the model is evaluated using the built-in model evaluation method, and the evaluation results are divided into two cases. In the first case, the evaluation metrics are positive, in which case the geolocation recognition model can be pushed online for A / B testing. If the A / B test also shows that all business metrics are positive, then all traffic is connected for official online use.

[0135] Figure 6 This is a schematic diagram of the online and offline parts of the geolocation recognition model provided in the embodiments of this application.

[0136] like Figure 6 As shown, on the one hand, a geolocation recognition model can be used for online identification; on the other hand, this geolocation recognition model can be trained offline. For the online part, for each service request based on IPv4, at least one feature data of the IP address is obtained from the online database, and this feature data is processed into a feature vector that can be used for real-time model input. Then, based on the offline-trained geolocation recognition model, using the obtained feature vector as input, the most likely geolocation of the IP address is identified. Finally, feedback information on the identified geolocation can be output to indicate whether the online geolocation identification matches actual behavior. For the offline part, raw data is first reported. After field parsing processing of the reported raw data, parsed data is obtained. Then, the parsed data is accumulated to obtain training data. For example, hourly features can be constructed using accumulated hourly data, daily features can be constructed using accumulated daily data, and full features can be constructed using accumulated full data. The constructed hourly, daily, and full-scale features can be used to construct training samples, that is, to process the acquired raw dataset into a multi-dimensional feature vector for IP addresses in a training sample. Based on the processed multi-dimensional feature vector for IP addresses and the labeled geographical locations, the geographical location recognition model is trained, and finally, a trained geographical location recognition model can be obtained.

[0137] It should be noted that the accumulated data involved in the embodiments of this application may include various types of accumulated data. For example, the accumulated data may include some or all of the following types of data: Wireless-Fidelity (WiFi) data, Service Set Identifier (SSID), WiFi location, Internet Protocol (IP) information, and timestamps. For example, wireless-fidelity data may include a Basic Service Set Identifier (DSSID), WiFi data may be the Media Access Control (MAC) address of each wireless access point, where the MAC address is the address used by the MAC protocol. The SSID may be a user-defined name for each wireless access point. WiFi location can be real data collected by a multi-party map application; the WiFi location can be obtained based on the SSID. IP information may be the client's egress IP used when a user sends a service request to the WiFi manager after connecting to WiFi, inquiring about the current WiFi type; the egress IP may also be called the external IP or client IP. The timestamp may refer to the timestamp corresponding to the device requesting the WiFi manager service, in seconds.

[0138] Figure 7 This is a schematic flowchart of a method 200 for online identification based on a geographic location recognition model trained offline, provided in this application embodiment. It should be noted that the solution provided in this application embodiment can be executed by any electronic device with data processing capabilities. For example, the electronic device can be implemented as a server. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and big data and artificial intelligence platforms. The server can be directly or indirectly connected via wired or wireless communication, and this application does not impose any limitations on this.

[0139] like Figure 7 As shown, the method 200 may include some or all of the following:

[0140] S211, extract the geographical location of the labeled IP address.

[0141] Historical geographic locations of IP addresses can be extracted from HDFS using Spark or Hive SQL. These historical geographic locations can be used to construct positive and / or negative sample sets. Optionally, the historical geographic location of the IP address can also be the historical geographic location of a WiFi network.

[0142] S212, Extract at least one feature vector of the IP address in at least one time dimension.

[0143] Extract geographic location feature data of IP addresses across different dimensions. From a historical cumulative database, extract geographic location feature data of IP addresses across multiple dimensions, including hourly, daily, weekly, monthly, quarterly, semi-annual, and grade-level data. By concatenating the feature data from each time dimension, at least one feature vector is obtained. The number of these at least one feature vectors is equal to the number of these at least one time dimension.

[0144] S213, perform feature vector concatenation on the at least one feature vector to obtain the feature vector of the IP address.

[0145] The feature vector of the IP address is obtained by concatenating the at least one feature vector. Thus, for each IP address, a positive sample set and / or a negative sample set can be constructed based on the labeled historical geographical locations and the constructed feature vector.

[0146] S214: Using the geographic location and feature vector of the labeled IP address as a training sample in the training set, train the geographic location recognition model. Alternatively, train the model using a density-based convolutional network algorithm based on existing labeled positive and negative samples.

[0147] Training data is obtained from an offline database. This training data includes at least one piece of training data associated with the second IP address. Each piece of training data is used to characterize the number of times the at least one piece of raw data associated with the second IP address is reported in the training time dimension. Based on this, the at least one piece of training data is processed into a feature vector of the second IP address. The geographical location of the labeled second IP address is obtained. The feature vector of the second IP address and the geographical location of the labeled second IP address are used as a training sample in the training set. The geographical location recognition model is trained using the training set as input.

[0148] In other words, the training set may include multiple training samples. These training samples can be positive or negative. This article only uses one training sample as an example; the remaining training samples can be generated in the same way, and to avoid repetition, they will not be elaborated upon here. Optionally, the at least one piece of second data can be the original data or data processed from the original data. For example, it can be numerical values ​​directly used to concatenate into a feature vector; in this case, the second data can also be called feature data.

[0149] S215, Conduct an offline evaluation of the geolocation identification model.

[0150] The trained geolocation recognition model can be evaluated offline. However, this application does not limit the specific method or evaluation index for offline evaluation. For example, the weighted F1 score index can be used to evaluate the geolocation recognition model offline. Regarding the weighted F1 score, since the geolocation recognition model is used to identify the geolocation of IP addresses, it is essentially a multi-classification problem. In multi-class samples, there is a sample imbalance problem. For example, the number of IP addresses in China-Guangdong-Guangzhou is much greater than that in China-Tibet-Nyingchi. Using the weighted F1 score as an evaluation index can well reflect the classification differences in different sample sizes.

[0151] S216, Determine whether the offline evaluation result of the offline evaluation of the geographic location recognition model is positive?

[0152] If the offline evaluation result of the geolocation recognition model is positive, the files included in the geolocation recognition model are uploaded to the network; if the offline evaluation result of the geolocation recognition model is negative, the geolocation recognition model is retrained until the offline evaluation result of the geolocation recognition model is positive. In one implementation, the geolocation recognition model is retrained by adjusting at least one of the following: the training time dimension of the training samples, the drill-down dimension of the training samples, and the parameters of the geolocation recognition model.

[0153] S217, conduct an online evaluation of the geolocation identification model.

[0154] The trained geolocation recognition model can be evaluated online. However, this application embodiment does not limit the specific method or evaluation index for online evaluation. The index used for online model evaluation can be used to consider the help that the geolocation recognition model brings to specific business, for example, A / B testing can be used as an evaluation index. Regarding A / B testing, it is a method used to test the online performance of the geolocation recognition model. In the test, there are generally two groups of users, a control group and an experimental group. The control group uses a conventional classification model, and the experimental group uses the geolocation recognition model provided in this application. Based on this, the positive and negative values ​​of various business indicators for the geolocation recognition model provided in this application can be tested to evaluate the performance of the geolocation recognition model. If the evaluation index is negative, the geolocation recognition model is retrained until the geolocation recognition model's performance meets expectations.

[0155] S218, Determine whether the online evaluation result of the online evaluation of the geographic location identification model is positive.

[0156] If the online evaluation result of the geolocation recognition model is positive, the files included in the geolocation recognition model are fixed; if the online evaluation result of the geolocation recognition model is negative, the geolocation recognition model is retrained, and the retrained and re-uploaded geolocation recognition model is evaluated online until the online evaluation result of the geolocation recognition model is positive. In one implementation, the geolocation recognition model is retrained by adjusting at least one of the following: the training time dimension of the training samples, the drill-down dimension of the training samples, and the parameters of the geolocation recognition model.

[0157] S219, Save the geolocation identification model.

[0158] The trained geolocation recognition model can be saved using the TensorFlow Saver() function. For example, the geolocation recognition model can be saved using TensorFlow Saver() for easy retrieval and restoration of its parameters. The implementation generates the following four files: a checkpoint text file, which records the path information of the geolocation recognition model files; model checkpoint data (model.ckpt.data), which records network weight information; and model checkpoint index data (model.ckpt.index.data) and an index, which can be a binary file used to store the variable weight information of the geolocation recognition model.

[0159] S220, in response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the call of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address.

[0160] When the client calls the service interface, the server invokes the saved geolocation recognition model, then retrieves at least one piece of first data for the IP address from the online database. Based on this first piece of first data, it processes it to obtain the feature vector of the first IP address and inputs the feature vector into the deep learning-based geolocation recognition model for geolocation recognition processing, obtaining the geolocation recognition result returned by the deep learning-based geolocation recognition model. Optionally, the at least one piece of first data can be raw data or data processed from raw data, such as numerical values ​​directly used to construct the feature vector. In this case, the first data can also be called feature data.

[0161] S221, output feedback information of the geographical location of the first IP address, which is used to characterize whether the output geographical location of the first IP address is the real geographical location of the first IP address.

[0162] In other words, it can provide feedback on the online recognition results, that is, on the user interface (UI) side, it can record or provide feedback on the online business results of the IP geolocation output by the model in real time.

[0163] It should be noted that the method for identifying IP geographic location provided in this application has strong reusability. For example, by changing the business type of the positive sample, such as the geographic location of IPv6 or the risk type of the device, and by accumulating corresponding log data on the server side, the same method of feature concatenation, feature processing, and model training can be used to produce the same result.

[0164] The preferred embodiments of this application have been described in detail above with reference to the accompanying drawings. However, this application is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this application, various simple modifications can be made to the technical solutions of this application, and these simple modifications all fall within the protection scope of this application. For example, the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, this application will not describe the various possible combinations separately. Furthermore, various different embodiments of this application can also be arbitrarily combined, as long as they do not violate the spirit of this application, they should also be considered as the content disclosed in this application. It should also be understood that in the various method embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0165] The methods provided in the embodiments of this application have been described above. The apparatus provided in the embodiments of this application will be described below.

[0166] Figure 8 This is a schematic block diagram of the IP geolocation identification device 300 based on deep learning provided in the embodiments of this application.

[0167] like Figure 8 As shown, the device 300 may include:

[0168] Acquisition unit 310 is used for:

[0169] In response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the invocation of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address;

[0170] Obtain online data for the first IP address, the online data including at least one piece of first data associated with the first IP address and used to construct real-time IP characteristics, obtained in real time from an online database;

[0171] Processing unit 320 is configured to process the at least one piece of first data into a feature vector of the first IP address. Optionally, the dimension of the feature vector of the first IP address is equal to the number of the at least one piece of first data.

[0172] The identification unit 330 is used to identify the geographical location of the first IP address by taking the feature vector of the first IP address as input and using the geographical location identification model.

[0173] Output unit 340 is used to output the geographical location of the first IP address.

[0174] In some embodiments, the at least one piece of first data is used to characterize the number of times at least one piece of raw data associated with the first IP address is reported in the target time dimension; the processing unit 320 is specifically used for:

[0175] The at least one first data item is processed in the time dimension to obtain at least one value, which is used to characterize the ratio of the number of times the at least one original data item was reported to the at least one first data item in the historical time dimension.

[0176] The feature vector of the first IP address is obtained by concatenating the feature vectors of the at least one numerical value.

[0177] In some embodiments, the processing unit 320 is specifically used for:

[0178] In each of the at least one time dimension, the at least one first data item is processed into the at least one numerical value, the at least one time dimension including the target time dimension;

[0179] By concatenating at least one value in each time dimension, at least one feature vector is obtained;

[0180] The feature vector of the first IP address is obtained by concatenating the feature vectors of the at least one feature vector.

[0181] In some embodiments, before the processing unit 320 performs time-dimensional data processing on the at least one piece of first data to obtain at least one numerical value, the acquisition unit 310 is further configured to:

[0182] Historical data is obtained from an offline database. This historical data includes at least one piece of second data associated with the first IP address. Each piece of second data is used to characterize the number of times the at least one piece of original data associated with the first IP address was reported in the historical time dimension.

[0183] Specifically, the processing unit 320 is used for:

[0184] The ratio of the at least one second data point to the at least one first data point is determined as the at least one numerical value.

[0185] In some embodiments, before the acquisition unit 310 acquires online data for the first IP address from the online database, the processing unit 320 is further configured to:

[0186] The raw dataset is obtained through a service request. The raw dataset includes at least one piece of raw data associated with the first IP address. The raw data includes any one of the following: the user using the first IP address, the Wi-Fi using the first IP address, and the geographical location of the Wi-Fi. The Wi-Fi is uniquely identified by a Service Set Identifier (SSID) or a Basic Service Set Identifier (DSSID). The geographical location of the Wi-Fi is obtained through a map application. The at least one piece of raw data is processed into the at least one piece of first data using feature engineering. The online data is stored in the online database.

[0187] In some embodiments, the raw dataset further includes a timestamp corresponding to each of the at least one piece of raw data, the timestamp being used to identify the reporting time of the raw data; the processing unit 320 is specifically used for:

[0188] Under the target time dimension, for each piece of raw data, the number of timestamps corresponding to the raw data calculated using the feature engineering is determined as one of the first data in the at least one piece of first data.

[0189] In some embodiments, the device 300 may further include:

[0190] The feedback unit is used to output feedback information of the geographical location of the first IP address, which is used to characterize whether the output geographical location of the first IP address is the real geographical location of the first IP address.

[0191] In some embodiments, the first IP address is the client's outgoing IP address.

[0192] In some embodiments, the device 300 may further include:

[0193] Training units are used for:

[0194] Training data is obtained from an offline database. This training data includes at least one piece of training data associated with the second IP address. Each piece of training data is used to represent the number of times the at least one piece of raw data associated with the second IP address is reported in the training time dimension. The at least one piece of training data is processed into a feature vector of the second IP address. The geographical location of the labeled second IP address is obtained. The feature vector of the second IP address and the geographical location of the labeled second IP address are used as a training sample in the training set. The geographical location recognition model is trained using the training set as input.

[0195] In some embodiments, the device 300 may further include:

[0196] Offline assessment units are used for:

[0197] The weighted F1 score metric was used to evaluate the geographic location identification model offline.

[0198] If the offline evaluation result of the geographic location recognition model is positive, the files included in the geographic location recognition model are uploaded to the network; if the offline evaluation result of the geographic location recognition model is negative, the geographic location recognition model is retrained until the offline evaluation result of the geographic location recognition model is positive.

[0199] In some embodiments, the device 300 may further include:

[0200] Online assessment units are used for:

[0201] The geolocation recognition model, which has been uploaded to the network, was evaluated online using A / B testing.

[0202] If the online evaluation result of the geographic location recognition model is positive, then the files included in the geographic location recognition model are fixed; if the online evaluation result of the geographic location recognition model is negative, then the geographic location recognition model is retrained, and the retrained and re-uploaded geographic location recognition model is evaluated online until the online evaluation result of the geographic location recognition model is positive.

[0203] In some embodiments, the training unit is further configured to:

[0204] The geolocation recognition model is retrained by adjusting at least one of the following: the training time dimension of the training samples, the drill-down dimension of the training samples, and the parameters of the geolocation recognition model.

[0205] It should be understood that the device embodiments and method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, further details are omitted here. Specifically, the device 300 can correspond to the corresponding subject in executing method 100 or method 200 of the embodiments of this application, and each unit in the device 300 is for implementing the corresponding process in method 100 or method 200, which will not be described in detail here for the sake of brevity.

[0206] It should also be understood that the various units in the device 300 involved in the embodiments of this application can be individually or entirely merged into one or more other units, or some of the units can be further divided into multiple functionally smaller units. This can achieve the same operation without affecting the technical effect of the embodiments of this application. The above-mentioned units are based on logical function division. In practical applications, the function of one unit can also be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of this application, the device 300 may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by multiple units working together. According to another embodiment of this application, the device 300 involved in the embodiments of this application and the deep learning-based IP geolocation identification method of the embodiments of this application can be constructed by running a computer program (including program code) capable of performing the steps involved in the corresponding method on a general-purpose computing device including processing elements and storage elements such as a central processing unit (CPU), random access storage medium (RAM), and read-only storage medium (ROM). The computer program may be recorded on, for example, a computer-readable storage medium, loaded into an electronic device through the computer-readable storage medium, and run therein to implement the corresponding methods of the embodiments of this application.

[0207] In other words, the units mentioned above can be implemented in hardware, in software instructions, or in a combination of hardware and software. Specifically, the steps of the method embodiments in this application can be completed by the integrated logic circuits in the processor's hardware and / or by software instructions. The steps of the method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or executed by a combination of hardware and software in the decoding processor. Optionally, the software can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. This storage medium is located in memory, and the processor reads the information in the memory and completes the steps in the above method embodiments in conjunction with its hardware.

[0208] Figure 9 This is a schematic structural diagram of the electronic device 300 provided in the embodiments of this application.

[0209] like Figure 9As shown, the electronic device 400 includes at least a processor 410 and a computer-readable storage medium 420. The processor 410 and the computer-readable storage medium 420 can be connected via a bus or other means. The computer-readable storage medium 420 stores a computer program 421, which includes computer instructions. The processor 410 executes the computer instructions stored in the computer-readable storage medium 420. The processor 410 is the computing and control core of the electronic device 400, and is adapted to implement one or more computer instructions, specifically to load and execute one or more computer instructions to achieve a corresponding method flow or function.

[0210] As an example, processor 410 may also be referred to as a central processing unit (CPU). Processor 410 may include, but is not limited to: general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0211] As an example, the computer-readable storage medium 420 may be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage device; optionally, it may also be at least one computer-readable storage medium located remotely from the aforementioned processor 410. Specifically, the computer-readable storage medium 420 includes, but is not limited to, volatile memory and / or non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0212] In one implementation, the electronic device 400 may be Figure 9 The illustrated device 300 for IP geolocation identification based on deep learning; the computer-readable storage medium 420 stores computer instructions; the processor 410 loads and executes the computer instructions stored in the computer-readable storage medium 420 to implement... Figures 3 to 7 The corresponding steps in the method embodiment shown are as follows; in specific implementation, the computer instructions in the computer-readable storage medium 420 are loaded and executed by the processor 410, and will not be described again here to avoid repetition.

[0213] According to another aspect of this application, embodiments of this application also provide a computer-readable storage medium (Memory), which is a memory device in electronic device 400 for storing programs and data. For example, computer-readable storage medium 420. It is understood that computer-readable storage medium 420 here may include both built-in storage media in electronic device 400 and extended storage media supported by electronic device 400. The computer-readable storage medium provides storage space that stores the operating system of electronic device 400. Furthermore, the storage space also stores one or more computer instructions suitable for loading and execution by processor 410, which may be one or more computer programs 421 (including program code).

[0214] According to another aspect of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. For example, computer program 421. In this case, electronic device 400 may be a computer, and processor 410 reads the computer instructions from computer-readable storage medium 420, and executes the computer instructions, causing the computer to perform the deep learning-based IP geolocation identification method provided in the various alternative embodiments described above.

[0215] In other words, when implemented using software, it can be implemented entirely or partially in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes of the embodiments of this application are run or the functions of the embodiments of this application are implemented. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0216] Those skilled in the art will recognize that the units and process steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0217] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A deep learning-based method for IP geolocation identification, characterized in that, include: In response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the invocation of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address; Obtain online data for the first IP address, the online data including at least one first data item associated with the first IP address and used to construct real-time IP characteristics, which is obtained in real time from an online database, the at least one first data item being used to characterize the number of times at least one raw data item associated with the first IP address is reported in the target time dimension; The at least one first data item is processed in the time dimension to obtain at least one value, the at least one value being used to characterize the ratio of the number of reports of the at least one original data item to the at least one first data item in the historical time dimension, wherein the duration of the historical time dimension is greater than or equal to the duration of the target time dimension; The feature vector of the first IP address is obtained by concatenating the feature vectors of the at least one numerical value. Using the feature vector of the first IP address as input, the geographic location of the first IP address is identified using the geographic location recognition model; Output the geographical location of the first IP address.

2. The method according to claim 1, characterized in that, The step of performing time-dimensional data processing on the at least one piece of first data to obtain at least one numerical value includes: In each of the at least one time dimension, the at least one first data item is processed in the time dimension to obtain the at least one numerical value, wherein the at least one time dimension includes the target time dimension; Wherein, determining the feature vector of the first IP address by concatenating the feature vectors of the at least one numerical value includes: By concatenating the at least one value under each time dimension, at least one feature vector is obtained; The feature vectors of the first IP address are concatenated to obtain the feature vector of the first IP address.

3. The method according to claim 1, characterized in that, Before performing time-dimensional data processing on the at least one piece of first data to obtain at least one numerical value, the method further includes: Historical data is obtained from an offline database. The historical data includes at least one piece of second data associated with the first IP address. The at least one piece of second data is used to characterize the number of times the at least one piece of original data associated with the first IP address was reported in the historical time dimension. Wherein, the step of performing time-dimensional data processing on the at least one piece of first data to obtain at least one numerical value includes: The ratio of each of the at least one second data point to the at least one first data point is determined as the at least one numerical value.

4. The method according to claim 1, characterized in that, Before retrieving online data for the first IP address from the online database, the method further includes: The raw dataset is obtained through a service request. The raw dataset includes at least one piece of raw data associated with the first IP address. The raw data includes any one of the following: the user using the first IP address, the Wi-Fi using the first IP address, and the geographical location of the Wi-Fi. The Wi-Fi is uniquely identified by a Service Set Identifier (SSID) or a Basic Service Set Identifier (BSSID). The geographical location of the Wi-Fi is information obtained through a map application. The at least one piece of raw data is processed into the at least one piece of first data using feature engineering. The online data is stored in the online database.

5. The method according to claim 4, characterized in that, The original dataset also includes a timestamp corresponding to each of the at least one piece of original data, the timestamp being used to identify the reporting time of the original data; The step of using feature engineering to process the at least one piece of original data into the at least one piece of first data includes: Under the target time dimension, for each piece of raw data, the number of timestamps corresponding to the raw data calculated using the feature engineering is determined as one of the first data in the at least one piece of first data.

6. The method according to claim 1, characterized in that, The method further includes: Output feedback information of the geographical location of the first IP address, wherein the feedback information is used to characterize whether the output geographical location of the first IP address is the actual geographical location of the first IP address.

7. The method according to claim 1, characterized in that, The first IP address is the client's exit IP address.

8. The method according to claim 1, characterized in that, Before retrieving online data for the first IP address from the online database, the method further includes: Training data is obtained from an offline database. The training data includes at least one piece of training data associated with a second IP address. The at least one piece of training data is used to characterize the number of times the at least one piece of raw data associated with the second IP address is reported in the training time dimension. The at least one piece of training data is processed into a feature vector of the second IP address; Obtain the geographical location of the labeled second IP address; The feature vector of the second IP address and the geographical location of the labeled second IP address are used as a training sample in the training set; The geographic location recognition model is trained using the training set as input.

9. The method according to claim 8, characterized in that, The method further includes: The geographic location identification model was evaluated offline using the weighted F1 score metric. If the offline evaluation result of the geographic location recognition model is positive, the files included in the geographic location recognition model are uploaded to the network; if the offline evaluation result of the geographic location recognition model is negative, the geographic location recognition model is retrained until the offline evaluation result of the geographic location recognition model is positive.

10. The method according to claim 9, characterized in that, The method further includes: The geolocation identification model that has been uploaded to the network was evaluated online using A / B testing. If the online evaluation result of the geographic location recognition model is positive, the files included in the geographic location recognition model are fixed; if the online evaluation result of the geographic location recognition model is negative, the geographic location recognition model is retrained, and the retrained and re-uploaded geographic location recognition model is evaluated online until the online evaluation result of the geographic location recognition model is positive.

11. The method according to claim 9 or 10, characterized in that, The retraining of the geolocation recognition model includes: The geolocation recognition model is retrained by adjusting at least one of the training time dimension of the training samples, the drill-down dimension of the training samples, and the parameters of the geolocation recognition model.

12. A deep learning-based IP geolocation identification device, characterized in that, include: Acquisition unit, used for: In response to a geolocation identification request triggered for a first IP address to be identified, a call request instruction is sent to a deep learning-based IP geolocation identification model to request the invocation of the deep learning-based geolocation identification model to perform geolocation identification for the first IP address; Obtain online data for the first IP address, the online data including at least one first data item associated with the first IP address and used to construct real-time IP characteristics, which is obtained in real time from an online database, the at least one first data item being used to characterize the number of times at least one raw data item associated with the first IP address is reported in the target time dimension; The processing unit is configured to perform time-dimensional data processing on the at least one first data item to obtain at least one numerical value, wherein the at least one numerical value is used to characterize the ratio of the number of reports of the at least one original data item to the at least one first data item in the historical time dimension, wherein the duration of the historical time dimension is greater than or equal to the duration of the target time dimension; and to perform feature vector concatenation processing on the at least one numerical value to obtain the feature vector of the first IP address. The identification unit is used to identify the geographical location of the first IP address by taking the feature vector of the first IP address as input and using the geographical location identification model. The output unit is used to output the geographical location of the first IP address.

13. An electronic device, characterized in that, include: A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program that, when executed by the processor, implements the deep learning-based IP geolocation identification method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, Used to store a computer program that causes a computer to perform the deep learning-based IP geolocation identification method as described in any one of claims 1 to 11.

Images