Device security level identification method and device, electronic device, and readable medium

Abstract

The present disclosure relates to a device security level identification method and device, comprising: determining the disconnection probability of each user device by processing each user device data through a first model trained based on feature data of a plurality of historical user devices, then determining the sample disconnection probability of each historical user device through the feature data of the historical user device according to the first model, binning the value interval of the sample disconnection probability to obtain a plurality of binning intervals, and training a second model according to the feature data of the plurality of historical user devices, the sample disconnection probability and the plurality of binning intervals. According to the second model, the security identification score of each user device is determined through the disconnection probability of each user device, and the security level of each user device is determined according to the security identification score of each user device. In this way, the security level of the user device determined in this way is more accurate, so as to realize the protection of the data security of the Internet service platform.

Description

Technical Field

[0001] This disclosure relates to the field of equipment data processing, and more specifically, to a method, apparatus, electronic device, and computer-readable medium for identifying equipment security levels. Background Technology

[0002] With the rapid development of the internet, the amount of user device data on internet service platforms is increasing. Therefore, secure identification of user devices is particularly important for internet service platforms. Currently, logistic regression models are used to identify user device data to determine device security, which can, to a certain extent, ensure the security of device data on internet service platforms.

[0003] However, the inventors of this invention discovered, in realizing the inventive concept of this invention, that there are at least the following technical problems in the related technology: the user equipment data processed by the above-mentioned logistic regression model is a score, which is not a real result. Therefore, the device security level determined based on the score is not accurate enough, and there is a risk of data leakage in the Internet service platform.

[0004] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] In view of this, the present disclosure provides a method, apparatus, electronic device and computer-readable medium for identifying device security levels, which can enhance the protection of data security in Internet service platforms through a logistic regression model.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a method for identifying the security level of a device is proposed, comprising: acquiring data from multiple user devices; processing the data of each user device using a first model trained based on feature data from multiple historical user devices to determine the probability of disconnection for each user device; determining the sample disconnection probability of each historical user device using the first model based on the feature data of the historical user devices, and binning the range of the sample disconnection probability to obtain multiple binning intervals; training a second model based on the feature data of the multiple historical user devices, the sample disconnection probability, and the multiple binning intervals; determining the security identification score of each user device using the disconnection probability of each user device using the second model; and determining the security level of each user device based on the security identification score of each user device.

[0008] Optionally, by using the first model to determine the sample disconnection probability of each historical user equipment based on the feature data of the historical user equipment, and binning the value range of the sample disconnection probability to obtain multiple binning intervals, the process includes: acquiring the feature data of the multiple historical user equipment; training the first model based on the feature data of the multiple historical user equipment; inputting the feature data of the multiple historical user equipment into the first model to obtain the sample disconnection probability of the multiple historical user equipment; and binning the value range of the sample disconnection probability using an equidistant binning method to obtain the multiple binning intervals.

[0009] Optionally, the second model is trained based on the feature data of multiple historical user equipments, the sample disconnection probability, and multiple bin intervals, including: determining the historical user equipment contained in each bin interval based on the sample disconnection probability of the multiple historical user equipments and the multiple bin intervals; determining the tag data of each historical user equipment in each bin interval based on the feature data of the historical user equipments, and determining the number of disconnected user equipments and the number of normal user equipments in each bin interval based on the tag data; and training the second model based on the number of disconnected user equipments and the number of normal user equipments in each bin interval, as well as the user equipment disconnection probability at a preset location in each bin interval.

[0010] Optionally, a second model is trained based on the number of lost user equipment and the number of normal user equipment in each container compartment, as well as the probability of user equipment loss at a preset location in each container compartment. This includes: for each container compartment, obtaining a security identification score corresponding to each container compartment based on the number of lost user equipment and the number of normal user equipment in each container compartment; and performing data fitting based on the probability of user equipment loss at a preset location in each container compartment and the security identification score corresponding to each container compartment to obtain a corresponding curve as the second model.

[0011] Optionally, determining the security level of each user device based on its security identification score includes: determining the preset threshold range to which the security identification score of each user device belongs; and determining the security level of the user device based on the security level corresponding to the preset threshold range.

[0012] According to one aspect of this disclosure, a device security level identification apparatus is proposed, comprising: an acquisition module for acquiring multiple user equipment data; a processing module for processing the user equipment data using a first model trained based on feature data of multiple historical user equipments to determine the disconnection probability of each user equipment; a binning module for determining the sample disconnection probability of each historical user equipment using the first model and feature data of historical user equipments, and binning the range of the sample disconnection probability to obtain multiple binning intervals; a training module for training a second model based on the feature data of multiple historical user equipments, the sample disconnection probability, and the multiple binning intervals; a security identification score determination module for determining the security identification score of each user equipment based on the second model and the disconnection probability of each user equipment; and a security level determination module for determining the security level of each user equipment based on the security identification score of each user equipment.

[0013] Optionally, the binning module is configured to: acquire feature data of the plurality of historical user equipment; train the first model based on the feature data of the plurality of historical user equipment; input the feature data of the plurality of historical user equipment into the first model to obtain the sample disconnection probability of the plurality of historical user equipment; and bin the range of sample disconnection probability by means of equal-distance binning to obtain the plurality of binning intervals.

[0014] Optionally, the second model is trained based on the feature data of multiple historical user equipments, the sample disconnection probability, and multiple bin intervals, including: determining the historical user equipment contained in each bin interval based on the sample disconnection probability of the multiple historical user equipments and the multiple bin intervals; determining the tag data of each historical user equipment in each bin interval based on the feature data of the historical user equipments, and determining the number of disconnected user equipments and the number of normal user equipments in each bin interval based on the tag data; and training the second model based on the number of disconnected user equipments and the number of normal user equipments in each bin interval, as well as the user equipment disconnection probability at a preset location in each bin interval.

[0015] Optionally, a second model is trained based on the number of lost user equipment and the number of normal user equipment in each container compartment, as well as the probability of user equipment loss at a preset location in each container compartment. This includes: for each container compartment, obtaining a security identification score corresponding to each container compartment based on the number of lost user equipment and the number of normal user equipment in each container compartment; and performing data fitting based on the probability of user equipment loss at a preset location in each container compartment and the security identification score corresponding to each container compartment to obtain a corresponding curve as the second model.

[0016] Optionally, the security level determination module is configured to: determine the preset threshold range to which the security identification score of each user device belongs; and determine the security level of the user device according to the security level corresponding to the preset threshold range.

[0017] According to one aspect of this disclosure, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method as described above.

[0018] According to one aspect of this disclosure, a computer-readable medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described above.

[0019] According to the device security level identification method, apparatus, electronic device, and computer-readable medium disclosed herein, multiple user equipment data are acquired. A first model, trained based on feature data from multiple historical user equipments, is used to process the data of each user equipment to determine the probability of each user equipment becoming unreachable. Then, based on the first model, the sample probability of each historical user equipment is determined using its feature data. The range of sample probability of becoming unreachable is binned to obtain multiple binning intervals. A second model is trained based on the feature data of multiple historical user equipments, the sample probability of becoming unreachable, and the multiple binning intervals. Then, based on the second model, the security identification score of each user equipment is determined using its probability of becoming unreachable. Based on the security identification score, the security level of each user equipment is determined. This method of determining the security level of user equipment is more accurate, thus strengthening the protection of data security in internet service platforms and effectively preventing data leakage caused by inaccurate determination of user equipment security levels in related technologies.

[0020] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this disclosure. Attached Figure Description

[0021] The above and other objects, features, and advantages of this disclosure will become more apparent from the detailed description of exemplary embodiments with reference to the accompanying drawings. The drawings described below are merely some embodiments of this disclosure, and those skilled in the art will be able to obtain other drawings based on these drawings without any inventive effort.

[0022] Figure 1 This is a system block diagram illustrating a device security level identification method and apparatus according to an exemplary embodiment.

[0023] Figure 2This is a flowchart illustrating a device security level identification method according to an exemplary embodiment.

[0024] Figure 3 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0025] Figure 4 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0026] Figure 5 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0027] Figure 6 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0028] Figure 7 This is a block diagram illustrating a device security level identification device according to an exemplary embodiment.

[0029] Figure 8 This is a block diagram illustrating an electronic device according to an exemplary embodiment. Detailed Implementation

[0030] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0031] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0032] It should be understood that while the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this disclosure. As used herein, the term "and / or" includes all combinations of any and more of the associated listed items.

[0033] Figure 1 This is a system block diagram illustrating a device security level identification method and apparatus according to an exemplary embodiment.

[0034] like Figure 1 As shown, system architecture 100 may include one or more of user terminals 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between user terminals 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0035] It should be understood that Figure 1 The number of user terminals, networks, and servers shown is merely illustrative. Depending on implementation needs, there can be any number of user terminals, networks, and servers. For example, server 105 could be a server cluster composed of multiple servers.

[0036] Users can use user terminals 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. User terminals 101, 102, and 103 can be various electronic devices with displays, including but not limited to smartphones, tablets, laptops, and desktop computers, etc.

[0037] In some embodiments, the device security level identification method provided in this invention is generally executed by server 105, and correspondingly, the device security level identification device is generally disposed in server 105. In other embodiments, some terminals may have functions similar to those of the server to execute this method. Therefore, the device security level identification method provided in this invention is not limited to execution on the server side.

[0038] Figure 2 This is a flowchart illustrating a device security level identification method according to an exemplary embodiment.

[0039] like Figure 2 As shown, the equipment security level identification method includes steps S210 to S260.

[0040] In step S210, data from multiple user equipments are acquired.

[0041] In this step, the aforementioned user device data can be publicly available data from users using the user device on internet service platforms. This user data may include one or more publicly available information such as user name, user age, user occupation, user income, user place of origin, and the time the user last logged into the system using the user device. However, it is not limited to this; the data processing in this solution can also be performed using user information that cannot identify the user, such as age, education level, and household registration, to protect user privacy. User privacy can be protected by deleting or anonymizing user information. Anonymization can be achieved through encryption.

[0042] In step S220, the data of each user equipment is processed by a first model trained based on feature data of multiple historical user equipments to determine the disconnection probability of each user equipment.

[0043] In this step, a first model for determining the probability of user equipment disconnection is trained using the feature data of historical user equipment. This can be achieved by taking the user equipment data of historical user equipment as input and the disconnection status of historical user equipment as output, and learning the first model using existing neural network learning algorithms or decision tree learning algorithms. The disconnection status includes whether the historical user equipment has logged in within a certain period of time.

[0044] In this step, the probability of each user device losing contact is predicted by the first model, and the current status of the device is predicted based on historical data.

[0045] In step S230, the sample disconnection probability of each historical user equipment is determined based on the characteristic data of the historical user equipment using the first model, and the range of the sample disconnection probability is binned to obtain multiple binning intervals.

[0046] In this step, the feature data of each historical user device is processed using the first model to determine the sample disconnection probability of each historical user device. Since the model output is generally a single numerical value, and the judgment result is determined by the numerical value, this step uses the sample disconnection probability obtained by the first model to bin the range of sample disconnection probability, obtaining multiple bin intervals, instead of directly converting the processing result into a judgment result. This avoids errors in the conversion process. For example, under the condition that the processing result range is 0 to 1, the first model's processing result for the first historical user device is 0.4, and the processing result for the second historical user device is 0.1. Although the values ​​of the two processing results are different, the judgment result obtained is consistent, that is, both historical user devices are disconnected user devices. Therefore, directly converting these processing results into judgment results will produce some errors. However, this solution obtains multiple bin intervals by binning the range of sample disconnection probability, and then processes the sample disconnection probability in subsequent steps, which can effectively avoid the interference of errors.

[0047] In step S240, a second model is trained based on the feature data of multiple historical user equipment, the probability of sample disconnection, and multiple binning intervals.

[0048] In this step, the sample loss probability and corresponding binning interval obtained from the feature data of historical user equipment predicted by the first model, as well as the user equipment feature data of historical users, are trained twice to construct a second model. Through the training process of the second model, the relationship between user feature data and whether a user is a lost user equipment is learned more accurately, thereby improving the identification accuracy of user equipment.

[0049] In this step, for example, historical user equipment can be grouped according to various bin compartments. In the second model, a corresponding convolutional recognition layer is constructed for each bin compartment. For each convolutional recognition layer, the probability of historical user equipment loss is used as input, and the loss status of historical user equipment is used as output. Each convolutional recognition layer is trained separately, ultimately resulting in the second model. Compared to the first model, the second model performs secondary analysis and learning on the historical user equipment in each bin compartment, further optimizing the recognition results and effectively improving recognition accuracy. The convolutional recognition layer in this scheme can also be a decision tree recognition layer or a recognition layer constructed using other machine learning algorithms.

[0050] In step S250, the security identification score of each user equipment is determined based on the second model and the probability of each user equipment losing contact.

[0051] In step S260, the security level of each user equipment is determined based on the security identification score of each user equipment.

[0052] In this step, the probability of user equipment losing contact is identified using the second model, the security identification score of each user equipment is determined, and the security level of the user equipment is further determined. This effectively improves the accuracy of user equipment identification. By classifying user equipment for security, it is possible to ensure that higher-security-level users are provided with better services, while reducing the provision of services to lower-security-level users, thus protecting the security of the system.

[0053] The method provided by the embodiments of the present invention can acquire data from multiple user equipments (UEs). A first model, trained based on feature data from multiple historical UEs, is used to process the data of each UE to determine the probability of each UE being disconnected. Then, based on the first model, the sample disconnection probability of each historical UE is determined using the feature data of the historical UEs. Multiple binning intervals are obtained by binning the range of sample disconnection probabilities. A second model is trained based on the feature data of multiple historical UEs, the sample disconnection probabilities, and the multiple binning intervals. Then, based on the second model, a security identification score is determined for each UE using its disconnection probability. Based on the security identification score, the security level of each UE is determined. The security level determined in this way is more accurate, thus strengthening the protection of data security in the Internet service platform and effectively avoiding data leakage caused by inaccurate determination of the security level of UEs in related technologies.

[0054] In one embodiment, the aforementioned unconnected user equipment may refer to user equipment that has not logged into the system for a period of time.

[0055] In one embodiment, the first model described above can be trained based on feature data from multiple historical user devices. The first model is a tree model, which includes any one of the following: gradient boosting decision tree and extreme gradient boosting decision tree. Tree models have lower requirements for user device data, thus enabling the processing of massive amounts of user device data. This approach can be extended to various application scenarios.

[0056] In one embodiment, the second model is trained based on feature data from multiple historical user devices, sample loss probabilities of multiple historical user devices, and multiple binning intervals. Using this second model to process the loss probability of user devices can quickly and accurately obtain the security identification score of the user device. By further fitting and optimizing the first model, the second model is obtained, thus further improving the identification effect of user devices and providing different professional or data services for user devices with different security levels, strengthening the protection of data security in the Internet service platform. In this embodiment, the multiple binning intervals are obtained by binning the range of sample loss probabilities using an equal-moment binning method.

[0057] It's possible to construct a first model using a logistic regression model, process historical user equipment data, and output the probability of historical user equipment disconnection. However, because the logistic regression model requires accurate representation of the disconnection probability, it also imposes requirements on the samples input to the model. For example, a high volume of user equipment data input to the logistic regression model limits its application scenarios. If this model is used to process massive amounts of user equipment data, the accuracy of the obtained security level will be low. Furthermore, the disconnection probability output by the logistic regression model in related technologies is a score, not a definitive result; that is, the disconnection probability is not a true probability but a predicted value.

[0058] The method provided in this invention processes data from each user device using a tree model to obtain the probability of each user device losing contact. This probability is then input into a second model to obtain a security identification score for each user device. Based on these scores, the security level of each user device is determined. This further improves the identification effectiveness of user devices, allowing for the provision of different professional or data services to user devices with different security levels, thus strengthening data security protection on internet service platforms. Furthermore, this combination of two models can handle massive amounts of user device data, and its relatively low requirements for user device data make it widely applicable. The method also provides more accurate information on lost user devices.

[0059] Figure 3 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0060] like Figure 3 As shown, step S230 can specifically include steps S310 to S330.

[0061] In step S310, the feature data of the multiple historical user equipments are obtained.

[0062] In this step, historical user device data can be publicly available data from users who have used historical user devices on internet service platforms. This user data may include one or more publicly available information such as user name, user age, user occupation, user income, user place of origin, and the time when the user last logged into the system using the user device. However, it is not limited to these. This solution can also process data based solely on user information that cannot identify the user, such as age, education, and household registration, to protect user privacy. User privacy can be protected by deleting or anonymizing user information. Anonymization can be achieved by processing the data using encryption methods.

[0063] In step S320, the first model is trained based on the feature data of the multiple historical user equipments, and the feature data of the multiple historical user equipments is input into the first model to obtain the sample disconnection probability of the multiple historical user equipments.

[0064] In this step, after training the first model using the feature data of historical user equipment, the first model is used to identify the historical user equipment and obtain the corresponding identification results. Since the first model is pre-trained, the results obtained after inputting the feature data of historical user equipment into the first model meet the convergence conditions. Generally, the judgment of each historical user equipment is accurate. For example, in a first model with an identification result of 0 to 1, the identification results for historical user equipment that are out of contact are mostly 0 to 0.5. Only in this way can the first model be considered successfully trained. However, in practical applications, it is found that due to the continuous changes in user behavior and system services, the generalization ability of the model will become worse and worse. Although the model initially trained can obtain values ​​of 0 to 0.5, the error in the range of 0 to 0.5 will still be large in the future. The amount of data in the model training process is huge, and the cost of retraining the model is very high. Therefore, in this solution, the identification results of the feature data of historical user equipment are obtained through the pre-trained first model, and the out-of-contact probability of the identification result samples is used for further processing in subsequent steps to improve the identification accuracy of user equipment.

[0065] In step S330, the range of sample disconnection probability values ​​is divided into multiple bins using an equidistant binning method to obtain the multiple binning intervals.

[0066] This method trains a first model based on the sample loss probabilities of multiple historical user devices. This training method has low requirements for user device data, allowing it to process massive amounts of user device data. This approach can be extended to various application scenarios. The user device loss probability range is divided into multiple bins using equidistant binning. This facilitates the subsequent training of a second model based on the feature data of multiple historical user devices, the sample loss probabilities of multiple historical user devices, and the multiple bins. The second model is obtained by further fitting the first model, resulting in more accurate user device identification.

[0067] In one embodiment, a first model is trained based on feature data from multiple historical user devices. The feature data of the multiple historical user devices is input into the first model to obtain the sample loss probability of each historical user device. The training process of the first model is based on the historical user device data and whether a historical user device is a lost user device. For example, the feature data of multiple historical user devices is input into a tree model, and the initial sample loss probability of each historical user device is output. This training method is repeated until the tree model converges, at which point training stops, and the sample loss probability of multiple historical user devices is output. The sample loss probability of multiple historical user devices is then input into the second model to train the second model.

[0068] In one embodiment, the range of sample loss probability is binned using an equidistant binning method to obtain multiple binning intervals. For example, the range of sample loss probability is binned using an equal-radius binning method to obtain multiple binning intervals. For example, if the range of sample loss probability is set to 1% to 100%, binning 1% to 100% using an equal-radius binning method yields 1% to 10%, 10% to 20%, 20% to 30%, 30% to 40%, 40% to 50%, 50% to 60%, 60% to 70%, 70% to 80%, 80% to 90%, and 90% to 100%.

[0069] In one embodiment, a second model is trained based on feature data of multiple historical user equipment (User Equipment), sample loss probabilities of multiple historical User Equipment, and multiple bin compartments to obtain a security identification score for each historical User Equipment. For example, based on the sample loss probabilities of multiple historical User Equipment, the historical User Equipment falling into each of the aforementioned bin compartments is determined. Furthermore, based on the tag data of each historical User Equipment in each bin compartment, the number of lost User Equipment and the number of normal User Equipment in each bin compartment are calculated.

[0070] In one embodiment, a coordinate system is established with the probability of user equipment (UE) going missing as the x-axis and the security identification score of the missing UE as the y-axis. In this coordinate system, the probability of UE going missing at a preset location within each compartment is used as the x-axis (the preset location can be the middle of the compartment), and the security identification score of each compartment is used as the y-axis to generate a curve. As the sample size increases, the curve of this coordinate system is corrected. Furthermore, one end of the curve can be extended to the y-axis with 0 as the x-axis, and the other end can be extended to the y-axis with 1 as the x-axis. The curve obtained by fitting the data in this way is the second model described above. In this embodiment, a preset algorithm is used to calculate the security identification score of each compartment based on the ratio of the number of missing UEs to the number of normal UEs.

[0071] Figure 4 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0072] like Figure 4 As shown, the above S240 may specifically include steps S410 to S430.

[0073] In step S410, based on the sample disconnection probability of the multiple historical user equipment and the multiple bin intervals, the historical user equipment contained in each bin interval is determined.

[0074] In this step, based on the binning interval to which the sample loss probability belongs, the historical user equipment contained in each binning interval is determined.

[0075] In step S420, the tag data of each historical user equipment in each of the compartments is determined based on the characteristic data of the historical user equipment, and the number of disconnected user equipment and the number of normal user equipment in each compartment are determined based on the tag data.

[0076] In this step, the binning interval represents the range of sample disconnection probability. Based on the historical user equipment characteristic data, we can know the number of normal user equipment and the number of disconnected user equipment in each binning interval, that is, the actual situation of user equipment in each binning interval.

[0077] In step S430, a second model is trained based on the number of disconnected user equipment and the number of normal user equipment in each sub-compartment interval, as well as the probability of user equipment disconnection at the middle position of each sub-compartment interval.

[0078] In this step, based on the first model, the model is further trained using the sample disconnection probability obtained from the first model to obtain the binning interval and the actual situation of historical user equipment in each binning interval. This enables further learning of the historical user equipment feature data and the historical user equipment disconnection situation, thereby achieving accurate identification of user equipment.

[0079] This method can train a second model based on the number of disconnected user equipment and the number of normal user equipment in each compartment, as well as the probability of user equipment disconnection at preset locations in each compartment. The security identification score of each historical user equipment obtained through this second model is more accurate and can reflect the current real status of the historical user equipment.

[0080] In one embodiment, the historical user equipment included in each bin interval is determined based on the sample disconnection probability of the plurality of historical user equipment and the plurality of bin intervals. For example, the sample disconnection probabilities of the plurality of historical user equipment are 5%, 22%, 24%, 32%, and 48%, respectively. The plurality of bin intervals are 1%–10%, 10–20%, 20%–30%, 30%–40%, 40%–50%, 50%–60%, 60%–70%, 70%–80%, 80%–90%, and 90%–100%, respectively. Based on 5%, 22%, 24%, 32%, and 48%, the historical user equipment falling into each of the above bin intervals is determined. For example, historical user equipment with a sample disconnection probability of 5% falls into the 1%–10% bin interval. Historical user equipment with sample disconnection probabilities of 22% and 24% falls into the 20%–30% bin interval. Historical user equipment with a sample disconnection probability of 32% falls into the 30%–40% bin interval. Historical user equipment with a 48% probability of losing contact falls into the 40%–50% binning range.

[0081] In one embodiment, the number of out-of-connection user equipment (UE) and the number of normal UE in each UE section are calculated based on the tag data of each historical UE in each UE section. For example, the tag data is 1 and 0, where 1 represents a normal UE and 0 represents an out-of-connection UE. The tag data 1 and 0 of each historical UE in each UE section are traversed to calculate the number of tag 1s and tag 0s in each UE section.

[0082] In one embodiment, the preset position of each compartment can be the middle position of each compartment.

[0083] Figure 5 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0084] like Figure 5 As shown, step S430 may specifically include steps S510 to S520.

[0085] In step S510, for each sub-box, the security identification score corresponding to each sub-box interval is obtained based on the number of disconnected user equipment and the number of normal user equipment in each sub-box interval.

[0086] In step S520, based on the probability of user equipment losing contact at a preset location in each sub-compartment interval and the security identification score corresponding to each sub-compartment interval, data fitting is performed to obtain the corresponding curve as the second model.

[0087] This method can fit the probability of user equipment disconnection at preset locations of each sub-box with the security identification score corresponding to each sub-box to obtain a corresponding curve as a second model. This facilitates the rapid and accurate determination of the security identification score of different user equipment based on the curve. In this way, the corresponding security level can be accurately determined based on the security identification score of different user equipment, and then professional services or data services can be accurately provided to users according to the security level of different devices, thereby strengthening the protection of data security for Internet service platforms.

[0088] In one embodiment, a security identification score is obtained for each container compartment based on the number of out-of-connection user equipment (UFOs) and the number of normal UFOs in each compartment. For example, the number of out-of-connection UFOs and the number of normal UFOs in each compartment are calculated based on the tag data of each historical UFO in each compartment. For example, the tag data is 1 and 0, where 1 represents a normal UFO and 0 represents an out-of-connection UFO. The tag data 1 and 0 of each historical UFO in each compartment are traversed to calculate the number of tag 1s and tag 0s in each compartment. The ratio of the number of tag 0s to the number of tag 1s is calculated. This ratio can be used as the security identification score, or a preset algorithm can be used to calculate the security identification score for each compartment based on this ratio.

[0089] In one embodiment, a curve is obtained by fitting data based on the user equipment disconnection probability at a preset location in each compartment and the corresponding security identification score of each compartment, serving as the second model. For example, a coordinate system is established with the user equipment disconnection probability as the abscissa and the security identification score of each compartment as the ordinate. In the specific fitting process, the user equipment disconnection probability at the preset location in each compartment is used as the abscissa, and the security identification score of each compartment is used as the ordinate, thus forming multiple coordinate points. A curve can be generated based on these multiple coordinate points, and this curve can serve as the aforementioned second model. As the sample size increases, the curve of this coordinate system is corrected. In addition, one end of the curve can be extended to the ordinate axis with 0 as the abscissa, and the other end can be extended to the ordinate axis with 1 as the abscissa.

[0090] In one embodiment, the preset position of each compartment can be the middle position of each compartment.

[0091] Figure 6 This is a flowchart illustrating a device security level identification method according to another exemplary embodiment.

[0092] like Figure 6 As shown, step S260 can specifically include S610 and S620.

[0093] In step S610, the preset threshold range to which the security identification score of each user equipment belongs is determined.

[0094] In this step, the system can divide the total security identification score into different preset threshold ranges by setting the number of security levels. Alternatively, staff can divide different preset threshold ranges according to the actual situation. For example, by combining the actual situation of user devices corresponding to different security identification scores, a corresponding change curve can be constructed. By taking the derivative of the change curve, the positions of the maximum and minimum values ​​of the derivative can be determined. These positions are where sudden changes in the situation of user devices are likely to occur. Using these positions as dividing points can effectively improve the accuracy of security level classification for user devices.

[0095] In step S620, the security level of the user equipment is determined according to the security level corresponding to the preset threshold range.

[0096] This method can determine the preset threshold range to which the security identification score of each user device belongs, and determine the security level of the user device according to the security level corresponding to the preset threshold range. This makes it easier to provide users with professional services or data services accurately according to the security level of different user devices, and strengthen the protection of data security in Internet service platforms.

[0097] In one embodiment, the aforementioned preset threshold range can be set according to the actual business situation. Furthermore, corresponding security levels can be set based on different preset threshold ranges, and the specific correspondence between preset threshold ranges and security levels can be set according to the actual situation.

[0098] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the functions defined by the methods provided in this disclosure. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0099] Furthermore, it should be noted that the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0100] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the apparatus embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0101] Figure 7 This is a block diagram illustrating a device security level identification device according to another exemplary embodiment.

[0102] like Figure 7 As shown, the above-mentioned equipment security level identification device 700 includes: an acquisition module 701, a processing module 702, a sorting module 703, a training module 704, a security identification score determination module 705, and a security level determination module 706.

[0103] Specifically, the acquisition module 701 is used to acquire data from multiple user devices.

[0104] The processing module 702 is used to process the data of each user device using a first model trained based on feature data of multiple historical user devices, and to determine the probability of each user device losing contact.

[0105] The binning module 703 is used to determine the sample disconnection probability of each historical user equipment based on the characteristic data of the historical user equipment through the first model, and to bin the value range of the sample disconnection probability to obtain multiple binning intervals.

[0106] Training module 704 is used to train a second model based on the feature data of multiple historical user devices, the probability of sample disconnection, and multiple binning intervals.

[0107] The security identification score determination module 705 is used to determine the security identification score of each user equipment based on the second model and the probability of each user equipment losing contact.

[0108] The security level determination module 706 is used to determine the security level of each user equipment based on the security identification score of each user equipment.

[0109] The security level identification device 700 can acquire data from multiple user devices. It processes the data of each user device using a first model trained on feature data from multiple historical user devices to determine the probability of each user device losing contact. Then, based on the first model, it determines the sample loss probability of each historical user device using feature data. The sample loss probability range is binned into multiple bin intervals. A second model is trained based on the feature data of multiple historical user devices, the sample loss probability, and the multiple bin intervals. Then, based on the second model, it determines the security identification score of each user device using its loss probability, and determines the security level of each user device based on its security identification score. This method of determining the security level of user devices is more accurate, thus strengthening the protection of data security in internet service platforms and effectively preventing data leakage caused by inaccurate determination of user device security levels in related technologies.

[0110] Optionally, the binning module 703 is configured to: acquire feature data of the plurality of historical user equipment; train the first model based on the feature data of the plurality of historical user equipment; input the feature data of the plurality of historical user equipment into the first model to obtain the sample disconnection probability of the plurality of historical user equipment; and perform binning processing on the value range of the sample disconnection probability by means of equal-distance binning to obtain the plurality of binning intervals.

[0111] Optionally, the second model is trained based on the feature data of multiple historical user equipments, the sample disconnection probability, and multiple bin intervals, including: determining the historical user equipment contained in each bin interval based on the sample disconnection probability of the multiple historical user equipments and the multiple bin intervals; determining the tag data of each historical user equipment in each bin interval based on the feature data of the historical user equipments, and determining the number of disconnected user equipments and the number of normal user equipments in each bin interval based on the tag data; and training the second model based on the number of disconnected user equipments and the number of normal user equipments in each bin interval, as well as the user equipment disconnection probability at a preset location in each bin interval.

[0112] Optionally, a second model is trained based on the number of lost user equipment and the number of normal user equipment in each container compartment, as well as the probability of user equipment loss at a preset location in each container compartment. This includes: for each container compartment, obtaining a security identification score corresponding to each container compartment based on the number of lost user equipment and the number of normal user equipment in each container compartment; and performing data fitting based on the probability of user equipment loss at a preset location in each container compartment and the security identification score corresponding to each container compartment to obtain a corresponding curve as the second model.

[0113] Optionally, the security level determination module 706 is configured to: determine the preset threshold range to which the security identification score of each user device belongs; and determine the security level to which the user device belongs based on the security level corresponding to the preset threshold range.

[0114] According to an embodiment of the present invention, the device security level identification 700 can be used to achieve... Figures 2-6 The device security level identification method described in the embodiments.

[0115] Figure 8 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0116] The following reference Figure 8 To describe an electronic device 800 according to such an embodiment of the present disclosure. Figure 8 The electronic device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0117] like Figure 8 As shown, the electronic device 800 is presented in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different system components (including storage unit 820 and processing unit 810), a display unit 840, etc.

[0118] The storage unit stores program code that can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 810 can perform actions such as... Figures 2-5 The steps are shown in the figure.

[0119] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache storage unit 8202, and may further include a read-only memory unit (ROM) 8203.

[0120] The storage unit 820 may also include a program / utility 8204 having a set (at least one) program module 8205, such program module 8205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0121] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0122] Electronic device 800 can also communicate with one or more external devices 870 (e.g., keyboard, pointing device, Bluetooth device, etc.), enabling users to communicate with devices that interact with electronic device 800, and / or any device that allows electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. Network adapter 860 can communicate with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0123] Exemplary embodiments of this disclosure have been specifically shown and described above. It should be understood that this disclosure is not limited to the detailed structures, arrangements, or implementations described herein; rather, this disclosure is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A method for identifying the security level of equipment, characterized in that, include: Acquire data from multiple user devices; The first model, trained based on feature data from multiple historical user devices, is used to process the data of each user device to determine the probability of each user device losing contact. The first model is a tree model. Using the first model, based on the characteristic data of historical user equipment, the sample disconnection probability of each historical user equipment is determined, and the range of the sample disconnection probability is binned to obtain multiple bin intervals. The bin interval represents the range of sample disconnection probability, and each bin interval contains the number of normal user equipment and the number of disconnected user equipment. Secondary training is performed based on the feature data of multiple historical user devices, the probability of sample disconnection, and the corresponding multiple binning intervals to fit the second model on the basis of the first model. The training of the second model includes: grouping the historical user devices according to each binning interval and constructing a convolutional recognition layer for each binning interval in the second model. The probability of sample disconnection is used as the input and the disconnection status of historical user devices is used as the output for each convolutional recognition layer. Each convolutional recognition layer is trained separately. According to the second model, the security identification score of each user equipment is determined by the probability of each user equipment losing contact. The security level of each user device is determined based on its security identification score.

2. The equipment security level identification method as described in claim 1, characterized in that, The first model determines the sample disconnection probability of each historical user equipment based on its characteristic data. The range of values ​​for the sample disconnection probability is then binned to obtain multiple binning intervals, including: Acquire feature data from multiple historical user devices; The first model is trained based on the feature data of multiple historical user devices, and then the feature data of the multiple historical user devices is input into the first model to obtain the sample disconnection probability of the multiple historical user devices. The range of sample disconnection probability values ​​is divided into multiple bin intervals by using an equidistant binning method.

3. The equipment security level identification method as described in claim 2, characterized in that, The second model is obtained by performing secondary training based on the feature data of multiple historical user devices, the sample disconnection probability, and the corresponding multiple binning intervals, including: Based on the sample disconnection probability of multiple historical user equipment and multiple bin intervals, the historical user equipment contained in each bin interval is determined; Based on the characteristic data of historical user equipment, determine the tag data of each historical user equipment in each container compartment, and determine the number of lost user equipment and the number of normal user equipment in each container compartment based on the tag data; The second model is trained based on the number of disconnected user equipment and the number of normal user equipment in each compartment, as well as the probability of user equipment disconnection at preset locations in each compartment.

4. The equipment security level identification method according to claim 3, characterized in that, The second model is trained based on the number of disconnected user equipment and the number of normal user equipment in each container section, as well as the probability of user equipment disconnection at preset locations in each container section, including: For each sub-compartment, the security identification score for each sub-compartment is obtained based on the number of disconnected user devices and the number of normal user devices in each sub-compartment. Based on the probability of user equipment losing contact at the preset location of each container compartment and the security identification score corresponding to each container compartment, the corresponding curve is obtained by data fitting as the second model.

5. The equipment security level identification method as described in any one of claims 1 to 4, characterized in that, The step of determining the security level of each user equipment based on its security identification score includes: Determine the preset threshold range to which the security identification score of each user equipment belongs; The security level of the user equipment is determined based on the security level corresponding to the preset threshold range.

6. A device for identifying the security level of an equipment, characterized in that, include: The acquisition module is used to acquire data from multiple user devices; The processing module is used to process the data of each user device through a first model trained based on feature data of multiple historical user devices, and to determine the disconnection probability of each user device, wherein the first model is a tree model; The binning module is used to determine the sample disconnection probability of each historical user equipment based on the characteristic data of the historical user equipment through the first model, and to bin the range of the sample disconnection probability to obtain multiple binning intervals. The binning interval represents the range of sample disconnection probability, and each binning interval contains the number of normal user equipment and the number of disconnected user equipment. The training module is used to perform secondary training based on the feature data of multiple historical user devices, the probability of sample disconnection, and multiple binning intervals, so as to fit a second model on the basis of the first model. The training of the second model includes: grouping the historical user devices according to each binning interval and constructing a convolutional recognition layer for each binning interval in the second model. For each convolutional recognition layer, the probability of sample disconnection is used as input and the disconnection status of historical user devices is used as output, and each convolutional recognition layer is trained separately. The security identification score determination module is used to determine the security identification score of each user equipment based on the second model and the probability of each user equipment losing contact. The security level determination module is used to determine the security level of each user device based on the security identification score of each user device.

7. The equipment security level identification device as described in claim 6, characterized in that, The binning module is configured as follows: Obtain feature data of the multiple historical user equipment; The first model is trained based on the feature data of the multiple historical user equipments, and the feature data of the multiple historical user equipments is input into the first model to obtain the sample disconnection probability of the multiple historical user equipments. The range of sample disconnection probability values ​​is divided into multiple bin intervals by using an equidistant binning method.

8. The equipment security level identification device as described in any one of claims 6 to 7, characterized in that, The security level determination module is configured as follows: Determine the preset threshold range to which the security identification score of each user equipment belongs; The security level of the user equipment is determined based on the security level corresponding to the preset threshold range.

9. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-5.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-5.

Images