A device behavior identification method and device, electronic device, and storage medium

Abstract

This invention provides a method, apparatus, electronic device, and storage medium for identifying device behavior. The method includes: a server receiving device parameters sent by a client device, the device parameters including a power-on timestamp when the client device is first powered on; querying a data relationship table to see if a timestamp identical to the power-on timestamp exists; when a timestamp identical to the power-on timestamp is found in the data relationship table, counting the number of timestamps identical to the power-on timestamp in the data relationship table to obtain a target number; determining the behavior identification result of the client device based on the relationship between the target number and a preset threshold; wherein the behavior identification result includes: a modified device and an unmodified device; and sending the behavior identification result to the client device. This invention can effectively identify whether a device has been modified.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for identifying device behavior. Background Technology

[0002] Typically, after a new device is manufactured, device parameters such as model and size are generated to identify the device. When a new device is first started, device parameters are also generated to identify the device. For example, if the new device is an Android system, an Android_id (Android device identifier) ​​will be generated when the new device is started for the first time. These device parameters can be used to determine whether the device is new.

[0003] In one application scenario, a merchant's service platform launches a series of user acquisition activities to attract new users. Existing users invite new users to participate in these activities and share in the merchant's rewards. Each device can only participate in these activities once. To obtain more merchant rewards, cybercriminals use device modification software to alter the parameters of devices that have already participated in these activities. This makes the modified devices easily identified as new devices by the merchant's service platform, allowing them to obtain rewards again and resulting in financial losses for the merchant.

[0004] Therefore, how to identify whether a device has been modified has become an urgent technical problem to be solved. Summary of the Invention

[0005] The purpose of this invention is to provide a method, apparatus, electronic device, and storage medium for identifying device behavior, so as to identify whether a device has been tampered with. The specific technical solution is as follows:

[0006] In a first aspect of this invention, a method for identifying device behavior is provided, applied to a server device, the method comprising:

[0007] Receive device parameters sent by the client device, the device parameters including the power-on timestamp of the client device when it is first turned on;

[0008] Check if there is a timestamp in the data relationship table that is the same as the boot timestamp. The data relationship table contains the correspondence between the user identifier of the client device and the boot timestamp when the client device is first turned on.

[0009] When a timestamp identical to the boot timestamp is found in the data relationship table, the number of timestamps identical to the boot timestamp in the data relationship table is counted to obtain the target number;

[0010] Based on the relationship between the number of targets and a preset threshold, the behavior recognition result of the client device is determined; wherein, the behavior recognition result includes: modified device and unmodified device;

[0011] The behavior recognition result is sent to the client device.

[0012] Optionally, the method further includes:

[0013] Add the correspondence between the user identifier of the client device and the boot timestamp to the data relationship table.

[0014] Optionally, the device parameters are obtained by the client device through encryption and encoding of the acquired device parameters. After receiving the device parameters sent by the client device, the method further includes:

[0015] The device parameters are decrypted and decoded to obtain the decrypted device parameters.

[0016] Optionally, the device parameters further include at least one of the following: target user identifier, target device identifier, target physical address information, and target device identification code of the client device; the data relationship table further includes: the user identifier of the client device, and the correspondence between it and the device identifier, physical address information, and device identification code of the client device; the method further includes:

[0017] Check if the data relationship table contains at least one of the following: a user identifier that is the same as the target user identifier, a device identifier that is the same as the target device identifier, a physical address information that is the same as the target physical address information, and a device identifier that is the same as the target device identifier.

[0018] If it exists, then return the behavior identification result indicating that the client device has been modified to the client device;

[0019] If it does not exist, then perform the operation of querying the data relationship table to see if there is a timestamp that is the same as the boot timestamp.

[0020] Optionally, determining the behavior recognition result of the client device based on the relationship between the number of targets and a preset threshold includes:

[0021] If the number of targets is greater than the preset threshold, the behavior identification result of the client device is determined to be a modified device;

[0022] If the number of targets is not greater than the preset threshold, the behavior identification result of the client device is determined to be that the device has not been modified.

[0023] In a second aspect of this invention, a method for identifying device behavior is also provided, applied to a client device, the method comprising:

[0024] Obtain the device parameters when the client device is first turned on, including the boot timestamp of the client device when it is first turned on;

[0025] The device parameters are sent to the server device, so that the server device queries the data relationship table to see if there is a timestamp that is the same as the power-on timestamp. If it does, the server device counts the number of timestamps that are the same as the power-on timestamp in the data relationship table to obtain the target number. The server device then returns the behavior recognition result of the client device to the client device based on the relationship between the target number and a preset threshold.

[0026] Receive the behavior identification results returned by the server device; the behavior identification results include: modified machine and unmodified machine.

[0027] Optionally, when the device parameters are the boot timestamps of the client device when it is first powered on, obtaining the device parameters of the client device when it is first powered on includes:

[0028] The system interface of the client device is used to read the device parameters when the client device is first turned on.

[0029] Alternatively, the device parameters at the time of the first startup of the client device can be obtained by querying the file modification time in the system directory of the client device.

[0030] Optionally, sending the device parameters to the server device includes:

[0031] The device parameters are encrypted and encoded to obtain encrypted device parameters;

[0032] The encrypted device parameters are sent to the server device.

[0033] Optionally, the method further includes:

[0034] Based on the behavior recognition results, a prompt message is displayed to the user indicating whether they can participate in the target business activity.

[0035] In a third aspect of the invention, a device behavior identification apparatus is also provided, applied to a server device, the apparatus comprising:

[0036] The data receiving module is used to receive device parameters sent by the client device, including the power-on timestamp when the client device is first turned on;

[0037] The first query module is used to query whether there is a timestamp in the data relationship table that is the same as the boot timestamp. The data relationship table contains the correspondence between the user identifier of the client device and the boot timestamp when the client device is first turned on.

[0038] The data statistics module is used to count the number of timestamps in the data relationship table that are the same as the boot timestamp when a timestamp with the same boot timestamp is found in the data relationship table, and obtain the target number.

[0039] The first behavior recognition module is used to determine the behavior recognition result of the client device based on the relationship between the number of targets and a preset threshold; wherein, the behavior recognition result includes: modified device and unmodified device;

[0040] The result feedback module is used to send the behavior recognition result to the client device.

[0041] Optionally, the device further includes:

[0042] The data addition module is used to add the correspondence between the user identifier of the client device and the power-on timestamp to the data relationship table.

[0043] Optionally, the device parameters are obtained by the client device through encryption and encoding of the acquired device parameters, and the device further includes:

[0044] A data decryption model is used to decrypt and decode the device parameters to obtain the decrypted device parameters.

[0045] Optionally, the device parameters further include at least one of the following: target user identifier, target device identifier, target physical address information, and target device identification code of the client device; the data relationship table further includes: the user identifier of the client device, and the correspondence between it and the device identifier, physical address information, and device identification code of the client device; the device further includes:

[0046] The second query module is used to query whether the data relationship table contains at least one of the following: a user identifier that is the same as the target user identifier, a device identifier that is the same as the target device identifier, physical address information that is the same as the target physical address information, and a device identifier that is the same as the target device identifier.

[0047] The second behavior recognition module is used to return a behavior recognition result indicating that the client device has been modified to the client device when the second query module finds at least one of the following in the data relationship table: a user identifier that is the same as the target user identifier, a device identifier that is the same as the target device identifier, physical address information that is the same as the target physical address information, and a device identifier that is the same as the target device identifier.

[0048] The third behavior recognition module is used to trigger the first behavior recognition module to perform an operation to query whether there is a timestamp with the same time stamp as the power-on timestamp in the data relationship table when the second query module finds that at least one of the following does not exist in the data relationship table: user identifier with the same time stamp as the target user identifier, device identifier with the same time stamp as the target device identifier, physical address information with the same time stamp as the target physical address information, and device identifier with the same time stamp as the target device identifier.

[0049] Optionally, the first behavior recognition module is specifically used for:

[0050] If the number of targets is greater than the preset threshold, the behavior identification result of the client device is determined to be a modified device;

[0051] If the number of targets is not greater than the preset threshold, the behavior identification result of the client device is determined to be that the device has not been modified.

[0052] In a fourth aspect of the invention, a device behavior identification apparatus is also provided, applied to a client device, the apparatus comprising:

[0053] The data acquisition module is used to acquire device parameters when the client device is first turned on, including the power-on timestamp when the client device is first turned on.

[0054] The data sending module is used to send the device parameters to the server device, so that the server device queries the data relationship table to see if there is a timestamp that is the same as the power-on timestamp, and if so, counts the number of timestamps that are the same as the power-on timestamp in the data relationship table to obtain the target number, and returns the behavior recognition result of the client device to the client device based on the relationship between the target number and a preset threshold.

[0055] The result receiving module is used to receive the behavior identification results returned by the server device; the behavior identification results include: modified machine and unmodified machine.

[0056] Optionally, when the device parameter is the boot timestamp when the client device is first turned on, the data acquisition module is specifically used for:

[0057] The system interface of the client device is used to read the device parameters when the client device is first turned on.

[0058] Alternatively, the device parameters at the time of the first startup of the client device can be obtained by querying the file modification time in the system directory of the client device.

[0059] Optionally, the data sending module is specifically used for:

[0060] The device parameters are encrypted and encoded to obtain encrypted device parameters;

[0061] The encrypted device parameters are sent to the server device.

[0062] Optionally, the device further includes:

[0063] The result prompt module is used to display a prompt message to the user, based on the behavior recognition result, indicating whether the user can participate in the target business activity.

[0064] In another aspect of the present invention, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus.

[0065] Memory, used to store computer programs;

[0066] A processor, when executing a program stored in memory, implements the steps of any of the above-described methods for identifying device behavior.

[0067] In another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the device behavior identification method described above.

[0068] In another aspect of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform the steps of the device behavior identification method described above.

[0069] This invention provides a method, apparatus, electronic device, and storage medium for identifying device behavior. A server device receives device parameters sent by a client device, queries a data relationship table to see if a timestamp identical to the client device's initial power-on timestamp included in the device parameters exists. If such a timestamp exists, the server counts the number of timestamps identical to the initial power-on timestamp in the data relationship table. Based on the relationship between this number and a preset threshold, the behavior identification result of the client device is determined. Since the initial power-on timestamp of a device is not easily modified, and typically each device has a different initial power-on timestamp, multiple identical timestamps at the same time point are unlikely to occur. Therefore, the method of determining whether a device has been tampered with by using duplicate initial power-on timestamps can effectively identify such behavior, thereby reducing financial losses for businesses. Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0071] Figure 1 This is a flowchart illustrating a method for identifying device behavior according to an embodiment of the present invention;

[0072] Figure 2 This is a flowchart illustrating another method for identifying device behavior in an embodiment of the present invention;

[0073] Figure 3 This is a flowchart illustrating another method for identifying device behavior in an embodiment of the present invention;

[0074] Figure 4 This is an interactive schematic diagram of a device behavior recognition method according to an embodiment of the present invention;

[0075] Figure 5 This is a schematic diagram of the structure of a device behavior recognition device according to an embodiment of the present invention;

[0076] Figure 6 This is a schematic diagram of the structure of another device behavior recognition device in an embodiment of the present invention;

[0077] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0078] The technical solutions of the present invention will now be described with reference to the accompanying drawings in the embodiments of the present invention.

[0079] Typically, device modification software mainly alters device parameters such as model number, size, disk space, and Android ID, making the modified device easily identified as a new one. If cybercriminals master this modification technology, they can arbitrarily change device parameters, easily creating numerous fake devices. This can then lead to financial losses for merchants when their service platforms require these new devices to participate in certain business activities.

[0080] To identify whether a device has been tampered with, embodiments of the present invention provide a method, apparatus, electronic device, and storage medium for identifying device behavior. The device behavior identification method provided by this embodiment of the present invention is applied to a server device and includes:

[0081] Receive device parameters sent by the client device, the device parameters including the power-on timestamp of the client device when it is first turned on;

[0082] Query the data relationship table to see if there is a timestamp that is the same as the boot timestamp. The data relationship table contains: the user identifier of the client device and the correspondence between the user identifier of the client device and the boot timestamp when the client device is first turned on.

[0083] When a timestamp identical to the boot timestamp is found in the data relationship table, the number of timestamps identical to the boot timestamp in the data relationship table is counted to obtain the target number;

[0084] Based on the relationship between the number of targets and a preset threshold, the behavior recognition result of the client device is determined; wherein, the behavior recognition result includes: modified device and unmodified device;

[0085] The behavior recognition result is sent to the client device.

[0086] The present invention provides a device behavior identification method. Since the power-on timestamp when the device is first turned on is not easily modified, and the first power-on timestamp of each device is usually different, there will be no situation where multiple identical power-on timestamps exist at the same time. Therefore, by determining whether the device has been tampered with by using the determination method of duplicate power-on timestamps when the device is first turned on, the behavior of the device can be effectively identified, thereby reducing the financial losses of merchants.

[0087] The following is a detailed description of a device behavior identification method provided by an embodiment of the present invention:

[0088] The device behavior identification method provided in this embodiment of the invention can be applied to application scenarios such as device type cheating detection and activities that can only be participated in by new devices.

[0089] Cybercriminals typically use device modification software to alter device parameters such as model, size, disk space, and Android ID. They save these modified parameters and, after they take effect, participate in a series of new device-specific activities on a merchant's service platform, repeating this process to gain more merchant rewards. Since device restarts take time, cybercriminals don't waste time restarting the device after modifying the parameters. This ensures that multiple modifications result in new device parameters corresponding to the same boot timestamp. Therefore, this embodiment of the invention utilizes boot timestamps to effectively identify whether a device has been modified.

[0090] like Figure 1 As shown, the device behavior identification method provided in this embodiment of the invention, applied to server devices, can be implemented through the following steps:

[0091] S101, Receive device parameters sent by the client device.

[0092] The server device receives device parameters sent by the client device, which may include the boot timestamp of the client device when it was first turned on.

[0093] The boot timestamp is the timestamp corresponding to the power-on process. Preferably, the boot timestamp can be a millisecond-level timestamp. In one example, a millisecond-level timestamp refers to the number of milliseconds since January 1, 1970, 00:00:00. For example, 1640612364032 represents December 27, 2021, 21:39:24:32.

[0094] S102, query whether there is a timestamp in the data relationship table that is the same as the boot timestamp.

[0095] The data relationship table contains the correspondence between the user identifier of the client device and the boot timestamp when the client device is first turned on.

[0096] The device parameters sent by the client device may also include the client device's user identifier. After receiving the device parameters, the server device directly queries the data relationship table to determine whether the power-on timestamp already exists in the data relationship table. If no timestamp matching the power-on timestamp is found in the data relationship table, the correspondence between the client device's user identifier and the power-on timestamp is added to the data relationship table. If a timestamp matching the power-on timestamp is found in the data relationship table, step S103 is executed.

[0097] S103, when a timestamp with the same boot timestamp is found in the data relationship table, count the number of timestamps with the same boot timestamp in the data relationship table to obtain the target number.

[0098] If a timestamp with the same boot timestamp is found in the data relationship table, the number of timestamps with the same boot timestamp in the data relationship table is counted to obtain the target number, and the correspondence between the user identifier of the client device and the boot timestamp is added to the data relationship table.

[0099] Regardless of whether a timestamp matching the boot timestamp is found in the data relationship table, the correspondence between the user identifier of the client device and the boot timestamp is added to the data relationship table so that the server device can identify whether the current client device and subsequent client devices are new devices.

[0100] S104, Based on the relationship between the number of targets and the preset threshold, determine the behavior recognition result of the client device.

[0101] The behavior recognition results include: modified devices and unmodified devices.

[0102] In one possible implementation, determining the behavior recognition result of the client device based on the relationship between the number of targets and a preset threshold may include:

[0103] If the number of targets exceeds a preset threshold, the behavior identification result of the client device is determined to be a modified device; if the number of targets does not exceed the preset threshold, the behavior identification result of the client device is determined to be an unmodified device.

[0104] The preset threshold can be set based on experience, such as 3, 5 or 6, etc.

[0105] A day consists of 86.4 million milliseconds. In most cases, the boot timestamps of each client device are different. Duplicates are extremely rare, and under normal circumstances, it is impossible for multiple (e.g., three or more) client devices to have the same boot timestamp. If multiple different client devices have the same boot timestamp within a single day, it can be determined that these client devices were all tampered with by the same client device using modification software.

[0106] S105 sends the behavior recognition results to the client device.

[0107] The present invention provides a device behavior identification method. Since the power-on timestamp when the device is first turned on is not easily modified, and the first power-on timestamp of each device is usually different, there will be no situation where multiple identical power-on timestamps exist at the same time. Therefore, by determining whether the device has been tampered with by using the determination method of duplicate power-on timestamps when the device is first turned on, the behavior of the device can be effectively identified, thereby reducing the financial losses of merchants.

[0108] In one possible implementation, the aforementioned device parameters are obtained by the client device through encryption and encoding of the acquired device parameters. After receiving the device parameters sent by the client device in step S101, the following may also be included:

[0109] The device parameters are decrypted and decoded to obtain the decrypted device parameters.

[0110] To ensure the security of data interaction between the client device and the server device, the client device encrypts and encodes the acquired device parameters before sending them to the server device. In this case, after receiving the device parameters sent by the client device, the server device also needs to decrypt and decode the received device parameters to obtain the decrypted device parameters.

[0111] For example, after obtaining the device parameters, the client device can sequentially perform obfuscation, signature, encryption, and encoding processing on the device parameters before sending them to the server device. The server device then decrypts, decodes, and restores the received device parameters to obtain the actual device parameters. The encoding processing of the device parameters can include compression, etc.

[0112] The client device encrypts and encodes the device parameters, while the server device decrypts and decodes the device parameters, ensuring the security of data interaction between the client device and the server device.

[0113] In one possible implementation, the above-mentioned device parameters may further include at least one of the following: target user identifier, target device identifier, target physical address (Media Access Control, MAC) information, and target device identification code of the client device; the data relationship table may further include: the user identifier of the client device, and the correspondence between it and the device identifier, physical address information, and device identification code of the client device.

[0114] like Figure 2 As shown, another device behavior identification method provided by this embodiment of the invention, applied to server devices, can be implemented through the following steps:

[0115] S201, Receive device parameters sent by the client device.

[0116] S202, query the data relationship table to see if at least one of the following exists: user identifier that is the same as the target user identifier, device identifier that is the same as the target device identifier, physical address information that is the same as the target physical address information, and device identifier that is the same as the target device identifier.

[0117] The device parameters may also include at least one of the following: the target user identifier, the target device identifier, the target physical address information, and the target device identification code. Accordingly, after receiving the device parameters sent by the client device, the system further queries the data relationship table to check if at least one of the following exists: a user identifier identical to the target user identifier, a device identifier identical to the target device identifier, physical address information identical to the target physical address information, and a device identification code identical to the target device identification code. If it exists, it indicates that the client device has been modified, and step S207 is executed. If it does not exist, step S203 is executed to continue identifying whether the client device has been modified.

[0118] In one possible implementation, the system can also query the data relationship table to check if a preset number of the following items exist: user identifier identical to the target user identifier, device identifier identical to the target device identifier, physical address information identical to the target physical address information, and device identifier identical to the target device identifier. If any of these items exist, it indicates that the client device has been modified, and step S207 is executed. If none of these items exist, step S203 is further executed to continue identifying whether the client device has been modified. The preset number can be set according to requirements.

[0119] The target device identifier mentioned above can be an Android_id, representing the identification data generated when the client device system boots up for the first time. The target device identification code can be an IMEI (International Mobile Equipment Identity), etc. Device parameters may also include the target device model, target device size, and target device disk space.

[0120] S203, query whether there is a timestamp in the data relationship table that is the same as the boot timestamp.

[0121] S204: When a timestamp with the same boot timestamp is found in the data relationship table, count the number of timestamps with the same boot timestamp in the data relationship table to obtain the target number.

[0122] S205, based on the relationship between the number of targets and a preset threshold, determine the behavior recognition result of the client device. The behavior recognition result includes: tampered device and untampered device.

[0123] S206 sends the behavior recognition results to the client device.

[0124] The implementation process of steps S203-S206 can be referred to the implementation process of steps S102-S105 above, and will not be repeated here in this embodiment of the invention.

[0125] S207, return the behavior identification result indicating that the client device has been modified to the client device.

[0126] In this embodiment of the invention, by combining device parameters such as user identifier, device identifier, physical address information, and device identification code with the boot timestamp, it is possible to identify whether the client device has been modified. Since the boot timestamp when the device is first turned on is not easily modified, and the boot timestamp of each device is usually different, there will be no situation where multiple identical boot timestamps exist at the same time. Therefore, the method of determining whether the device has been modified by using the duplicate boot timestamp when the device is first turned on can effectively identify whether the device has been modified, thereby reducing the financial losses of merchants.

[0127] This invention also provides a method for identifying device behavior, applied to client devices, such as... Figure 3 As shown, the method may include:

[0128] S301, obtain the device parameters when the client device is first turned on. The device parameters include the power-on timestamp when the client device is first turned on.

[0129] The client device obtains its own device parameters when it was first powered on. These device parameters may include the boot timestamp, user ID, device ID, physical address information, device identification code, device model, device size, and device disk space, etc.

[0130] S302, the device parameters are sent to the server device so that the server device queries the data relationship table to see if there is a timestamp that is the same as the power-on timestamp. If it exists, the server device counts the number of timestamps that are the same as the power-on timestamp in the data relationship table to obtain the target number. The server device then returns the behavior recognition result of the client device based on the relationship between the target number and a preset threshold to the client device.

[0131] S303, Receive the behavior identification result returned by the server device; the behavior identification result includes: the modified machine and the unmodified machine.

[0132] In this embodiment of the invention, since the power-on timestamp when the device is first turned on is not easily modified, and the first power-on timestamp of each device is usually different, there will be no situation where multiple identical power-on timestamps exist at the same time. Therefore, the method of determining whether the device has been tampered with by using the determination method of duplicate power-on timestamps when the device is first turned on can effectively identify the behavior of the device being tampered with, thereby reducing the financial losses of merchants.

[0133] In one possible implementation, when the device parameters are the boot timestamp of the client device when it is first powered on, obtaining the device parameters at the time of the client device's first power-on may include:

[0134] The device parameters at the time of the first power-on can be read through the system interface of the client device; or, the device parameters at the time of the first power-on can be obtained by querying the file modification time in the system directory of the client device.

[0135] Among them, the system interface of the client device can read the application layer or underlying program of the client device, and thus the boot timestamp when the client device is first turned on can be read.

[0136] The modification time of files in the client device's system directory is usually synchronized with the boot timestamp, or the time difference between them is very small, such as 1 millisecond or 2 milliseconds. Therefore, the modification time of files in the client device's system directory can be queried and used as the boot timestamp when the client device is first turned on.

[0137] In this embodiment of the invention, the boot timestamp of the client device when it is first turned on can be accurately obtained by using the system interface of the client device or by querying the file modification time in the system directory of the client device.

[0138] In one possible implementation, sending the device parameters to the server device includes:

[0139] The device parameters are encrypted and encoded to obtain the encrypted device parameters;

[0140] The encrypted device parameters are sent to the server device.

[0141] To ensure the security of data interaction between client devices and server devices, client devices can encrypt and encode the acquired device parameters to obtain encrypted device parameters, and then send the encrypted device parameters to the server device.

[0142] For example, the client device can sequentially perform obfuscation, signature, encryption, and encoding processing on the acquired device parameters before sending them to the server device. The server device can then decrypt, decode, and restore the received device parameters to obtain the actual device parameters.

[0143] The client device encrypts and encodes the acquired device parameters, while the server device decrypts and decodes the received device parameters, ensuring the security of data interaction between the client device and the server device.

[0144] In one possible implementation, the above method may further include:

[0145] Based on the behavior recognition results, a prompt message is displayed to the user indicating whether they can participate in the target business activity.

[0146] After receiving the behavior recognition result from the server, if the behavior recognition result indicates that the client device has been modified, it means that the client device is not a new device or the user is not a new user. In this case, a message indicating that the user cannot participate in the target business activity is displayed. If the behavior recognition result indicates that the client device has not been modified, it means that the client device is a new device or the user is a new user. In this case, a message indicating that the user can participate in the target business activity is displayed. The target business activity refers to the business activities that the new device can participate in, such as new user acquisition activities, benefit claiming activities, etc.

[0147] Based on the behavior recognition results, the client device displays a prompt message to the user indicating whether they can participate in the target business activity, so that the user can easily know whether they can participate in the target business activity.

[0148] For example, such as Figure 4 As shown, an embodiment of the present invention provides a method for identifying device behavior, which may include:

[0149] The client device obtains the device parameters when it is first powered on. The device parameters may include the power-on timestamp when the client device is first powered on. The client device then sends the device parameters to the server device.

[0150] After receiving the device parameters sent by the client device, the server device queries the data relationship table to see if there is a timestamp that is the same as the power-on timestamp. When a timestamp that is the same as the power-on timestamp is found in the data relationship table, the server device counts the number of timestamps that are the same as the power-on timestamp in the data relationship table to obtain the target number. Based on the relationship between the target number and a preset threshold, the server device determines the behavior recognition result of the client device and sends the behavior recognition result to the client device.

[0151] The client device receives the behavior recognition results returned by the server device, and based on the behavior recognition results, displays a prompt message to the user indicating whether they can participate in the target business activity.

[0152] The device behavior recognition method provided in this embodiment of the invention is effective in identifying whether a device has been tampered with, since the power-on timestamp when the device is first turned on is not easily modified and each device typically has a different first-time power-on timestamp. This prevents the occurrence of multiple identical power-on timestamps at the same time point. By determining whether the power-on timestamp is repeated when the device is first turned on, the method can effectively identify whether the device has been tampered with. Based on the identified behavior recognition results, a prompt message is displayed to the user indicating whether they can participate in the target business activity, thereby reducing the financial losses of merchants when users are unable to participate in the target business activity.

[0153] Corresponding to the above method embodiments, the present invention also provides corresponding device embodiments.

[0154] like Figure 5 As shown, this embodiment of the invention provides a device behavior identification apparatus applied to a server device, the apparatus comprising:

[0155] The data receiving module 501 is used to receive device parameters sent by the client device, including the power-on timestamp when the client device is first turned on;

[0156] The first query module 502 is used to query whether there is a timestamp in the data relationship table that is the same as the power-on timestamp. The data relationship table contains the correspondence between the user identifier of the client device and the power-on timestamp when the client device is first powered on.

[0157] The data statistics module 503 is used to count the number of timestamps with the same boot timestamp in the data relationship table when a timestamp with the same boot timestamp is found in the data relationship table, and obtain the target number.

[0158] The first behavior recognition module 504 is used to determine the behavior recognition result of the client device based on the relationship between the number of targets and a preset threshold; wherein, the behavior recognition result includes: modified device and unmodified device;

[0159] The result feedback module 505 is used to send the behavior recognition results to the client device.

[0160] In this embodiment of the invention, since the power-on timestamp when the device is first turned on is not easily modified, and the first power-on timestamp of each device is usually different, there will be no situation where multiple identical power-on timestamps exist at the same time. Therefore, the method of determining whether the device has been tampered with by using the determination method of duplicate power-on timestamps when the device is first turned on can effectively identify the behavior of the device being tampered with, thereby reducing the financial losses of merchants.

[0161] In one possible implementation, the above-described apparatus further includes:

[0162] The data addition module is used to add the mapping relationship between the user identifier of the client device and the boot timestamp to the data relationship table.

[0163] In one possible implementation, the aforementioned device parameters are obtained by the client device encrypting and encoding the acquired device parameters, and the aforementioned apparatus further includes:

[0164] The data decryption model is used to decrypt and decode device parameters to obtain the decrypted device parameters.

[0165] In one possible implementation, the device parameters further include at least one of the following: a target user identifier, a target device identifier, target physical address information, and a target device identification code of the client device; the data relationship table further includes: the user identifier of the client device, and the correspondence between it and the device identifier, the physical address information, and the device identification code of the client device; the device further includes:

[0166] The second query module is used to query whether the data relationship table contains at least one of the following: a user identifier that is the same as the target user identifier, a device identifier that is the same as the target device identifier, a physical address information that is the same as the target physical address information, and a device identifier that is the same as the target device identifier.

[0167] The second behavior recognition module is used to return a behavior recognition result indicating that the client device has been modified when the second query module finds at least one of the following in the data relationship table: a user identifier that is the same as the target user identifier, a device identifier that is the same as the target device identifier, physical address information that is the same as the target physical address information, and a device identifier that is the same as the target device identifier.

[0168] The third behavior identification module is used to trigger the first behavior identification module to perform an operation to query whether there is a timestamp with the same power-on timestamp in the data relationship table when the second query module finds that at least one of the following does not exist in the data relationship table: user identifier with the same target user identifier, device identifier with the same target device identifier, physical address information with the same target physical address information, and device identifier with the same target device identifier.

[0169] In one possible implementation, the first behavior recognition module described above is specifically used for:

[0170] If the number of targets exceeds a preset threshold, the behavior recognition result of the client device is determined to be a modified device;

[0171] If the number of targets is not greater than a preset threshold, the behavior recognition result of the client device is determined to be that the device has not been modified.

[0172] like Figure 6 As shown, this embodiment of the invention provides a device behavior identification apparatus applied to a client device, the apparatus comprising:

[0173] The data acquisition module 601 is used to acquire the device parameters when the client device is first turned on. The device parameters include the power-on timestamp when the client device is first turned on.

[0174] The data sending module 602 is used to send device parameters to the server device so that the server device can query the data relationship table to see if there is a timestamp that is the same as the power-on timestamp. If it exists, the server device counts the number of timestamps that are the same as the power-on timestamp in the data relationship table to obtain the target number. The server device then returns the behavior recognition result of the client device based on the relationship between the target number and a preset threshold to the client device.

[0175] The result receiving module 603 is used to receive the behavior recognition results returned by the server device; the behavior recognition results include: the modified machine and the unmodified machine.

[0176] In this embodiment of the invention, since the power-on timestamp when the device is first turned on is not easily modified, and the first power-on timestamp of each device is usually different, there will be no situation where multiple identical power-on timestamps exist at the same time. Therefore, the method of determining whether the device has been tampered with by using the determination method of duplicate power-on timestamps when the device is first turned on can effectively identify the behavior of the device being tampered with, thereby reducing the financial losses of merchants.

[0177] In one possible implementation, when the device parameter is the boot timestamp when the client device is first powered on, the data acquisition module 601 is specifically used for:

[0178] Read the device parameters when the client device is first turned on through the client device's system interface;

[0179] Alternatively, you can obtain the device parameters when the client device was first turned on by querying the file modification time in the client device's system directory.

[0180] In one possible implementation, the data transmission module 602 described above is specifically used for:

[0181] The device parameters are encrypted and encoded to obtain the encrypted device parameters;

[0182] The encrypted device parameters are sent to the server device.

[0183] In one possible implementation, the above-described apparatus further includes:

[0184] The result notification module is used to display a prompt message to the user, based on the behavior recognition results, indicating whether they can participate in the target business activity.

[0185] This invention also provides an electronic device, such as... Figure 7 As shown, it includes a processor 701, a communication interface 702, a memory 703, and a communication bus 704, wherein the processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704.

[0186] Memory 703 is used to store computer programs;

[0187] When the processor 701 executes the program stored in the memory 703, it implements the steps of any of the above method embodiments to achieve the same technical effect.

[0188] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0189] The communication interface is used for communication between the aforementioned terminal and other devices.

[0190] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0191] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0192] In another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements a device behavior identification method as described in any of the above embodiments to achieve the same technical effect.

[0193] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the device behavior identification methods described in the above embodiments to achieve the same technical effect.

[0194] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0195] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0196] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device / electronic device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0197] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A method for identifying device behavior, characterized in that, Applied to server devices, the method includes: Receive device parameters sent by the client device, the device parameters including the power-on timestamp of the client device when it is first turned on; Check if there is a timestamp in the data relationship table that is the same as the boot timestamp. The data relationship table contains the correspondence between the user identifier of the client device and the boot timestamp when the client device is first turned on. When a timestamp identical to the boot timestamp is found in the data relationship table, the number of timestamps identical to the boot timestamp in the data relationship table is counted to obtain the target number; Based on the relationship between the number of targets and a preset threshold, the behavior recognition result of the client device is determined; wherein, the behavior recognition result includes: modified device and unmodified device; The behavior recognition result is sent to the client device.

2. The method according to claim 1, characterized in that, The method further includes: Add the correspondence between the user identifier of the client device and the boot timestamp to the data relationship table.

3. The method according to claim 1, characterized in that, The device parameters are obtained by the client device through encryption and encoding of the acquired device parameters. After receiving the device parameters sent by the client device, the method further includes: The device parameters are decrypted and decoded to obtain the decrypted device parameters.

4. The method according to claim 1, characterized in that, The device parameters further include at least one of the following: target user identifier, target device identifier, target physical address information, and target device identification code of the client device; the data relationship table further includes: the user identifier of the client device, and the correspondence between it and the device identifier, physical address information, and device identification code of the client device; the method further includes: Check if the data relationship table contains at least one of the following: a user identifier that is the same as the target user identifier, a device identifier that is the same as the target device identifier, a physical address information that is the same as the target physical address information, and a device identifier that is the same as the target device identifier. If it exists, then return the behavior identification result indicating that the client device has been modified to the client device; If it does not exist, then perform the operation of querying the data relationship table to see if there is a timestamp that is the same as the boot timestamp.

5. The method according to claim 1, characterized in that, The determination of the behavior recognition result of the client device based on the relationship between the number of targets and a preset threshold includes: If the number of targets is greater than the preset threshold, the behavior identification result of the client device is determined to be a modified device; If the number of targets is not greater than the preset threshold, the behavior identification result of the client device is determined to be that the device has not been modified.

6. A method for identifying device behavior, characterized in that, Applied to a client device, the method includes: Obtain the device parameters when the client device is first turned on, including the boot timestamp of the client device when it is first turned on; The device parameters are sent to the server device, so that the server device queries the data relationship table to see if there is a timestamp that is the same as the power-on timestamp. If it does, the server device counts the number of timestamps that are the same as the power-on timestamp in the data relationship table to obtain the target number. The server device then returns the behavior recognition result of the client device to the client device based on the relationship between the target number and a preset threshold. Receive the behavior identification results returned by the server device; the behavior identification results include: modified machine and unmodified machine.

7. The method according to claim 6, characterized in that, When the device parameters are the boot timestamp of the client device when it is first powered on, obtaining the device parameters when the client device is first powered on includes: The system interface of the client device is used to read the device parameters when the client device is first turned on. Alternatively, the device parameters at the time of the first startup of the client device can be obtained by querying the file modification time in the system directory of the client device.

8. A device for identifying device behavior, characterized in that, Applied to server equipment, the device includes: The data receiving module is used to receive device parameters sent by the client device, including the power-on timestamp when the client device is first turned on; The first query module is used to query whether there is a timestamp in the data relationship table that is the same as the boot timestamp. The data relationship table contains the correspondence between the user identifier of the client device and the boot timestamp when the client device is first turned on. The data statistics module is used to count the number of timestamps in the data relationship table that are the same as the boot timestamp when a timestamp with the same boot timestamp is found in the data relationship table, and obtain the target number. The first behavior recognition module is used to determine the behavior recognition result of the client device based on the relationship between the number of targets and a preset threshold; wherein, the behavior recognition result includes: modified device and unmodified device; The result feedback module is used to send the behavior recognition result to the client device.

9. A device for identifying device behavior, characterized in that, Applied to a client device, the device includes: The data acquisition module is used to acquire device parameters when the client device is first turned on, including the power-on timestamp when the client device is first turned on. The data sending module is used to send the device parameters to the server device, so that the server device queries the data relationship table to see if there is a timestamp that is the same as the power-on timestamp, and if so, counts the number of timestamps that are the same as the power-on timestamp in the data relationship table to obtain the target number, and returns the behavior recognition result of the client device to the client device based on the relationship between the target number and a preset threshold. The result receiving module is used to receive the behavior identification results returned by the server device; the behavior identification results include: modified machine and unmodified machine.

10. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 1-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-7.

Images