A method and apparatus for device identification

Abstract

The application discloses a device identification method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the following steps: constructing a device relationship network graph according to device basic data and user basic data of each device; dividing the device relationship network graph into multiple subgraphs by using a community discovery algorithm; determining the similarity between each device in the subgraph, and identifying whether there is an abnormal device in the subgraph according to the similarity between each device in the subgraph. According to the embodiment, the similarity between each device in the subgraph is determined by constructing and dividing the device relationship network graph, and whether there is an abnormal device in the subgraph is identified, so that the method can effectively identify whether there is an abnormal device, can improve the accuracy and efficiency of abnormal device identification, and can provide effective device risk strategies for risk control businesses.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for device identification. Background Technology

[0002] With the development of internet technology, the use of terminal devices is becoming increasingly widespread. However, these devices may be used for improper purposes, such as tampering with device information to enable the use of the same device for a series of abnormal operations.

[0003] In existing technologies, the method of identifying abnormal devices by identifying tampered software and emulators is limited in its mode, has poor identification effect, and low identification efficiency; the method of identification based on device information database cannot identify abnormal devices in a timely manner due to the delay in updating the information database, and the number of devices that can be identified is limited. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method and apparatus for device identification, which can effectively identify whether there are abnormal devices and improve the accuracy and efficiency of abnormal device identification, thereby providing an effective device risk strategy for risk control business.

[0005] To achieve the above objectives, according to one aspect of the present invention, a method for device identification is provided, comprising:

[0006] Construct a device relationship network diagram based on the device's basic data and the user's basic data for each device;

[0007] The community detection algorithm is used to divide the device relationship network graph into multiple subgraphs;

[0008] Determine the similarity between each device in the subgraph, and identify whether there are abnormal devices in the subgraph based on the similarity between each device in the subgraph.

[0009] Optionally, before constructing the device relationship network diagram based on the device basic data and user basic data of each device, the following steps are included:

[0010] The device basic data and the user basic data are preprocessed to remove default values ​​or outliers from the device basic data and the user basic data.

[0011] Optionally, the device basic data includes one or more of the following characteristics: device name, device identifier, MAC address, battery level, screen size, and root attribute; and / or

[0012] The user basic data includes one or more features of the user's order data and / or user login data.

[0013] Optionally, a device relationship network diagram is constructed based on the device basic data and the user basic data, including:

[0014] Each device is treated as a node, and edge relationships are established between two devices that have the same device basic data or user basic data to determine the edge relationships between each node.

[0015] The device relationship network graph is obtained based on each node and the edge relationships between each node.

[0016] Optionally, determining the similarity between devices in the subgraph includes:

[0017] For any feature in the device basic data and user basic data of each device, calculate the similarity of any feature between any two devices in the subgraph to obtain the various similarities corresponding to any feature.

[0018] Optionally, identifying whether there are abnormal devices in the subgraph based on the similarity between devices in the subgraph includes:

[0019] For any given feature, determine a first number of similarities corresponding to each given feature, determine a second number of similarities among the various similarities corresponding to each given feature that are greater than a preset similarity threshold, determine the percentage of the second number to the first number, and if the percentage is greater than a preset proportion threshold, then mark the given feature as a similar feature;

[0020] If multiple similar features exist in the subgraph, it is determined that there is an abnormal device in the subgraph.

[0021] Optionally, the community detection algorithm is one or more of the Infomap algorithm, Louvain algorithm, or LPA algorithm.

[0022] According to another aspect of the present invention, a device identification apparatus is provided, comprising:

[0023] The module constructs a device relationship network diagram based on the device's basic data and the user's basic data for each device.

[0024] The determination module uses a community detection algorithm to divide the device relationship network graph into multiple subgraphs;

[0025] The identification module determines the similarity between devices in the sub-graph and identifies whether there are abnormal devices in the sub-graph based on the similarity between devices in the sub-graph.

[0026] According to another aspect of the present invention, an electronic device is provided, comprising:

[0027] One or more processors;

[0028] Storage device for storing one or more programs.

[0029] When the one or more programs are executed by the one or more processors, the one or more processors implement the device identification method provided by the present invention.

[0030] According to another aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the device identification method provided by the present invention.

[0031] One embodiment of the above invention has the following advantages or beneficial effects: A device relationship network diagram is constructed using basic device data and basic user data to facilitate the association of abnormal devices. Then, a community partitioning algorithm is used to divide the device relationship network diagram into multiple sub-graphs, each containing multiple associated devices. Finally, by determining the similarity between devices in each sub-graph, the presence of abnormal devices in the sub-graph is identified. This method, through the association and similarity between devices, mines sub-graphs containing abnormal devices, identifies the risks associated with abnormal devices and abnormal users, achieving high accuracy and efficiency, and providing more timely and effective device risk strategies for risk control operations.

[0032] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0033] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0034] Figure 1 This is a schematic diagram of the main process of a device identification method according to an embodiment of the present invention;

[0035] Figure 2 This is a schematic diagram of the main process of another device identification method according to an embodiment of the present invention;

[0036] Figure 3 This is a schematic diagram of a device relationship network according to an embodiment of the present invention;

[0037] Figure 4 This is a schematic diagram of the main process of another device identification method according to an embodiment of the present invention;

[0038] Figure 5 This is a schematic diagram of the main modules of a device identification apparatus according to an embodiment of the present invention;

[0039] Figure 6 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0040] Figure 7 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0041] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0042] This invention provides a device identification method that can effectively and accurately identify abnormal devices and abnormal users.

[0043] Figure 1 This is a schematic diagram of the main flow of a device identification method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method for device identification includes the following steps:

[0044] Step S101: Construct a device relationship network diagram based on the device basic data and user basic data of each device;

[0045] Step S102: Use a community detection algorithm to divide the device relationship network graph into multiple subgraphs;

[0046] Step S103: Determine the similarity between each device in the subgraph, and identify whether there are abnormal devices in the subgraph based on the similarity between each device in the subgraph.

[0047] It should be noted that the processes of acquiring, collecting, storing, using, and processing information in this disclosed technical solution comply with relevant laws and regulations and do not violate public order and good morals.

[0048] In this embodiment of the invention, the device identification method is used to identify abnormal devices. Abnormal devices are devices whose basic device data and / or user data have been tampered with. In the e-commerce field, such devices can be repeatedly impersonated as other devices to conduct abnormal activities such as bulk registration and advertising traffic diversion to obtain illegal profits.

[0049] In this embodiment of the invention, device basic data may include one or more of the following characteristics: device name, device identifier, MAC address (Media Access Control Address, hardware address), battery level, screen size, and root attribute. User basic data may include one or more of the following characteristics: user order data and / or user login data. The device identifier may be an IMEI (International Mobile Equipment Identity), the battery level is the current battery level, and the root attribute indicates whether the device is rooted. Rooting the device means that it has operating system permissions and can modify or access the device's system layers and system files. Device basic data may also include data such as device model to represent device attributes. User order data may include the recipient's mobile phone number and delivery address from the user's order, and user login data may include the device's login IP address and login time period.

[0050] Before constructing the device relationship network diagram based on the device's basic data and user's basic data for each device, it is determined whether the device has been registered or logged into the platform. Then, the device's basic data and user's basic data for each device that has been registered or logged into the platform are obtained. This allows abnormal devices to be identified before users use abnormal devices to perform abnormal operations, thereby reducing economic losses.

[0051] In this embodiment of the invention, before constructing the device relationship network diagram based on the device basic data and user basic data of each device, the process may include: preprocessing the device basic data and user basic data to remove default values ​​or outliers. That is, before constructing the device relationship network diagram, preprocessing the acquired device basic data and user basic data of each device, i.e., data cleaning, removes invalid data values ​​such as default values ​​or outliers, which enables a more accurate construction of the device relationship network diagram and thus improves the accuracy of identifying abnormal devices. For example, for a MAC address, if it is the default value 0000000000, then this default value is removed; for an IP address like LAN 192.101.011.111, this data is an outlier and needs to be removed.

[0052] In embodiments of the present invention, such as Figure 2 As shown, constructing a device relationship network diagram based on device basic data and user basic data includes the following steps:

[0053] Step S201: Treat each device as a node, and establish edge relationships between two devices with the same device basic data or user basic data to determine the edge relationships between each node;

[0054] Step S202: Obtain the device relationship network diagram based on each node and the edge relationships between each node.

[0055] In this embodiment of the invention, when constructing the relationship network graph, each device is treated as a node. The device's basic data and user's basic data are analyzed and compared. Devices with the same device or user basic data (i.e., those with the same characteristics) are associated, establishing edge relationships between devices, thus connecting two nodes. Each edge relationship represents a shared piece of device or user basic data (i.e., a characteristic). Each device may establish edge relationships with one or more devices. For example, if two devices have the same MAC address, an edge relationship is established; if two devices have the same login IP address, an edge relationship is established.

[0056] A device relationship network diagram can be obtained by analyzing the individual nodes and the edge relationships between them. For example... Figure 3 The diagram shown is a schematic diagram of a device relationship network according to an embodiment of the present invention. In this diagram, device 1 and device 2 establish a relationship through the same login IP address, device 1 and device 4 establish a relationship through the same MAC address, device 4 and device 5 establish a relationship through the same login IP address, device 4 and device 6 establish a relationship through the same IMEI, device 6 and device 7 establish a relationship through the same MAC address, device 1 and device 7 establish a relationship through the same IMEI, and device 3 and device 7 establish a relationship through the same login IP address. The device relationship network diagram is formed by the various devices and the relationships between them.

[0057] When constructing a device relationship network diagram based on device basic data and user basic data, two devices with similarity data (i.e., highly similar device or user basic data) with a similarity higher than a preset threshold can be linked by establishing edge relationships. This facilitates subsequent subgraph division and identification of abnormal devices in the subgraph.

[0058] In this embodiment of the invention, after obtaining the device relationship network graph, the graph is input into a model based on a community detection algorithm. The algorithm is used to partition the network graph, resulting in multiple subgraphs, or communities. Each subgraph contains multiple devices, and each device has one or more associated devices. These associations are based on shared characteristics, which can be one or more features from device basic data and / or user basic data. For example, the subgraphs may contain devices with the same battery level, devices with the same login IP address, or devices with the same MAC address. The community detection algorithm can be one or more of the following: Infomap algorithm, Louvain algorithm, or LPA algorithm (Label, Propagation Algorithm). It can also be a faction filtering algorithm (CPM), KL (Kernighan-Lin) algorithm, LFM algorithm, etc. For example, the Infomap algorithm can be used to partition the device network graph, resulting in multiple subgraphs.

[0059] In this embodiment of the invention, determining the similarity between devices in a subgraph includes:

[0060] For any feature in the device basic data and user basic data of each device, calculate the similarity of any feature between any two devices in the subgraph, and obtain the various similarity scores corresponding to any feature.

[0061] In this embodiment of the invention, after obtaining each subgraph, the devices in each subgraph are analyzed to determine the similarity between them. If the devices in a subgraph are highly similar, it indicates the presence of abnormal devices, i.e., tampered devices. The presence of abnormal devices is determined by calculating the similarity between devices in each subgraph. When determining the similarity between devices in a subgraph, for any given feature, the similarity between any two devices is calculated, thus obtaining multiple similarities for any given feature. For example, for the feature IMEI, the similarity between the IMEIs of any two devices is calculated, resulting in multiple similarities. The algorithm for calculating the similarity can be one or more of the following: TF-IDF (Term Frequency-Inverse Document Frequency) model, DSSM (Deep Structured Semantic Model), Word2Vec (a word embedding model), cosine similarity algorithm, Jaccard similarity algorithm, etc.

[0062] In embodiments of the present invention, such as Figure 4As shown, identifying the presence of abnormal devices in a subgraph based on the similarity between devices in the subgraph includes the following steps:

[0063] Step S401: For any feature, determine the first number of similarities corresponding to each feature;

[0064] Step S402: Determine the second number of similarities greater than a preset similarity threshold among all similarities corresponding to any feature;

[0065] Step S403: Determine the percentage of the second quantity to the first quantity;

[0066] Step S404: If the percentage is greater than the preset percentage threshold, then mark any feature as a similar feature;

[0067] Step S405: If multiple similar features exist in the subgraph, determine that there is an abnormal device in the subgraph.

[0068] In other words, after determining the similarities corresponding to any feature, a first number of similarities corresponding to that feature is determined. Then, a second number of similarities among the various similarities is determined, where the similarity is greater than or equal to a preset similarity threshold. By calculating the percentage of the second number to the first number and comparing this percentage with a preset proportion threshold, it can be determined whether the feature is a similar feature. If the percentage is greater than or equal to the preset proportion threshold, it is a similar feature; otherwise, it is not. If multiple similar features exist in a subgraph, it indicates that the devices in the subgraph have high similarity, which means that there are abnormal devices in this subgraph, i.e., tampered devices. For example, if the devices in the subgraph meet two or more of the following conditions: highly similar IMEI, identical device model, 100% battery, all devices are rooted, and identical device names, it indicates that there are abnormal devices in the subgraph.

[0069] In this embodiment of the invention, when identifying whether there are abnormal devices in a subgraph based on the similarity between devices in the subgraph, it can be determined whether the similarity of multiple preset features is greater than a preset similarity threshold. If so, it is determined that there are abnormal devices in the subgraph. The preset features can be custom-defined; for example, the preset features can be at least two of the following: IMEI, root attribute, device model, and login IP address.

[0070] In this embodiment of the invention, the similarity between devices in the sub-graph can be determined by forming a feature set of each device's features, and then calculating the similarity between the feature sets of the two devices. After determining the similarity between the two devices, it is determined whether the similarity is greater than or equal to a preset similarity threshold. If so, it indicates that the two devices are highly similar. The number of similarities in the sub-graph that are greater than or equal to the threshold is determined, and the percentage of the similarity to the total number of similarities is calculated. If the percentage exceeds a preset ratio threshold, it indicates that multiple devices in the sub-graph are highly similar, which indicates that there are abnormal devices in the sub-graph.

[0071] The device identification method of this invention utilizes basic device data and user data to construct a device relationship network graph through multi-dimensional device associations, facilitating the association of tampered devices. Then, a community partitioning algorithm is used to divide the device relationship network graph into multiple subgraphs, each containing multiple associated devices. By determining the similarity between devices in each subgraph, the method identifies whether any abnormal devices exist. This method, through the association and similarity between devices, mines subgraphs containing tampered devices, identifies the risk of abnormal devices and abnormal users, achieving high accuracy and efficiency. It effectively reduces the problem of falsely intercepting normal devices in existing technologies and can provide more timely and effective device risk strategies for risk control operations.

[0072] like Figure 5 As shown, another aspect of the present invention provides a device identification apparatus 500, comprising:

[0073] Module 501 constructs a device relationship network diagram based on the device basic data and user basic data of each device.

[0074] Module 502 determines that the community detection algorithm is used to divide the device relationship network graph into multiple subgraphs;

[0075] The identification module 503 determines the similarity between devices in the sub-graph and identifies whether there are abnormal devices in the sub-graph based on the similarity between devices in the sub-graph.

[0076] In this embodiment of the invention, the construction module 501 is further configured to: preprocess the device basic data and user basic data before constructing the device relationship network diagram based on the device basic data and user basic data of each device, so as to remove default values ​​or abnormal values ​​in the device basic data and user basic data.

[0077] In this embodiment of the invention, the device basic data includes one or more of the following characteristics: device name, device identifier, MAC address, battery level, screen size, and root attribute; and / or

[0078] User base data includes one or more features of user order data and / or user login data.

[0079] In this embodiment of the invention, the construction module 501 is further configured to: treat each device as a node, establish edge relationships between two devices with the same device basic data or user basic data to determine the edge relationships between each node; and obtain a device relationship network graph based on each node and the edge relationships between each node.

[0080] In this embodiment of the invention, the identification module 503 is further configured to: calculate the similarity of any feature between any two devices in the subgraph for any feature in the device basic data and user basic data of each device, and obtain each similarity corresponding to any feature.

[0081] In this embodiment of the invention, the identification module 503 is further configured to: for any feature, determine a first number of similarities corresponding to any feature, determine a second number of similarities among the similarities corresponding to any feature that are greater than a preset similarity threshold, and determine the percentage of the second number to the first number; if the percentage is greater than a preset ratio threshold, then mark any feature as a similar feature; and if there are multiple similar features in the sub-graph, determine that there is an abnormal device in the sub-graph.

[0082] In this embodiment of the invention, the community discovery algorithm in the determination module 502 is one or more of the Infomap algorithm, Louvain algorithm, or LPA algorithm.

[0083] Another aspect of the present invention provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the device identification method of the present invention.

[0084] Another aspect of the present invention provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the device identification method of the present invention.

[0085] Figure 6 An exemplary system architecture 600 is shown, in which the device identification method or device identification apparatus of embodiments of the present invention can be applied.

[0086] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, and 603, a network 604, and a server 605. Network 604 serves as the medium for providing communication links between terminal devices 601, 602, and 603 and server 605. Network 604 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0087] Users can use terminal devices 601, 602, and 603 to interact with server 605 via network 604 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 601, 602, and 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0088] Terminal devices 601, 602, and 603 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0089] Server 605 can be a server that provides various services, such as a backend management server that supports shopping websites browsed by users using terminal devices 601, 602, and 603 (for example only). The backend management server can analyze and process data such as received product information query requests, and feed back the processing results (such as target push information, product information - for example only) to the terminal devices.

[0090] It should be noted that the device identification method provided in this embodiment of the invention is generally executed by server 605, and correspondingly, the device identification device is generally set in server 605.

[0091] It should be understood that Figure 6 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0092] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer system 700 suitable for implementing a terminal device of the present invention. Figure 7 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0093] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0094] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0095] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined above in the system of this invention.

[0096] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0097] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0098] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be housed in a processor; for example, a processor can be described as including a construction module, a determination module, and an identification module. The names of these modules do not necessarily limit the module itself; for example, the construction module can also be described as "constructing a device relationship network diagram based on the device basic data and user basic data of each device."

[0099] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to: construct a device relationship network graph based on device basic data and user basic data of each device; divide the device relationship network graph into multiple subgraphs using a community detection algorithm; determine the similarity between devices in each subgraph; and identify whether there are abnormal devices in the subgraph based on the similarity between devices in each subgraph.

[0100] According to the technical solution of this invention, a device relationship network graph is constructed using basic device data and basic user data through multi-dimensional device associations to facilitate the association of tampered devices. Then, a community partitioning algorithm is used to divide the device relationship network graph into multiple subgraphs, each containing multiple associated devices. By determining the similarity between devices in each subgraph, the existence of abnormal devices in the subgraph is identified. This method, through the association and similarity between devices, mines subgraphs containing tampered devices, identifies the risk of abnormal devices and abnormal users, achieving high accuracy and efficiency, effectively reducing the problem of falsely blocking normal devices in existing technologies; and providing more timely and effective device risk strategies for risk control operations.

[0101] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method of device identification, characterized by, include: Construct a device relationship network diagram based on the device's basic data and the user's basic data for each device; In the relationship network diagram, an edge relationship represents the same device basic data or user basic data; The community detection algorithm is used to divide the device relationship network graph into multiple subgraphs; Determine the similarity between each device in the subgraph, and identify whether there are abnormal devices in the subgraph based on the similarity between each device in the subgraph; Identifying the presence of abnormal devices in the sub-graph based on the similarity between devices in the sub-graph includes: For any feature in the user's basic data, determine a first number of similarities corresponding to the feature, determine a second number of similarities greater than a preset similarity threshold among the similarities corresponding to the feature, and determine the percentage of the second number to the first number; if the percentage is greater than a preset proportion threshold, then mark the feature as a similar feature. If multiple similar features exist in the subgraph, it is determined that there is an abnormal device in the subgraph.

2. The method of claim 1, wherein, Before constructing the device relationship network diagram based on the basic device data and user data of each device, the following steps are included: The device basic data and the user basic data are preprocessed to remove default values ​​or outliers from the device basic data and the user basic data.

3. The method of claim 1, wherein, The device basic data includes one or more of the following characteristics: device name, device identifier, MAC address, battery level, screen size, and root attribute; and / or The user basic data includes one or more features of the user's order data and / or user login data.

4. The method of claim 1, wherein, Constructing a device relationship network diagram based on the device basic data and the user basic data includes: Each device is treated as a node, and edge relationships are established between two devices that have the same device basic data or user basic data to determine the edge relationships between each node. The device relationship network graph is obtained based on each node and the edge relationships between each node.

5. The method of claim 1, wherein, Determining the similarity between devices in the subgraph includes: For any feature in the device basic data and user basic data of each device, calculate the similarity of any feature between any two devices in the subgraph to obtain the various similarities corresponding to any feature.

6. The method according to claim 1, characterized in that, The community detection algorithm is one or more of the Infomap algorithm, Louvain algorithm, or LPA algorithm.

7. A device for device identification, characterized in that, include: The module constructs a device relationship network diagram based on the device's basic data and the user's basic data for each device. In the relationship network diagram, an edge relationship represents the same device basic data or user basic data; The determination module uses a community detection algorithm to divide the device relationship network graph into multiple subgraphs; The identification module determines the similarity between devices in the sub-image and identifies whether there are abnormal devices in the sub-image based on the similarity between devices in the sub-image. The identification module is also used for: For any feature in the user's basic data, determine a first number of similarities corresponding to the feature, determine a second number of similarities greater than a preset similarity threshold among the similarities corresponding to the feature, and determine the percentage of the second number to the first number; if the percentage is greater than a preset proportion threshold, then mark the feature as a similar feature. If multiple similar features exist in the subgraph, it is determined that there is an abnormal device in the subgraph.

8. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-6.

9. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-6.

Images