A method and device for identifying a black production user

Abstract

The application discloses a black production user identification method and device, and provides a scheme based on the behavior characteristics of a black production user. According to an IP second dialing implementation mechanism, a wideband account number of a second dialing user is identified and locked. Then, according to the wideband account number, a gateway device bound with the wideband account number and a lower-hung device associated with the gateway device are determined. Then, identity identification change records of the gateway device and each lower-hung device are acquired. According to the identity identification change records and the number of the lower-hung devices, whether the wideband account number belongs to a black production user is judged. The technical problem of low identification accuracy existing in the prior art black production identification method based on the IP address and the number of long-time logins in a certain time is solved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method and apparatus for identifying black market users. Background Technology

[0002] The cybercrime industry, also known as the cyber black market, refers to illegal activities conducted through the internet and using network technology as the primary means to seek profits. These activities include, but are not limited to, cyberattacks, information theft, and cyber fraud, as well as the tools, resources, platforms, and channels and links that provide these activities for preparation and illegal monetization.

[0003] To prevent damage from cybercrime, existing methods for identifying cybercrime primarily rely on the business systems under attack. They identify cybercrime by checking if an IP address logs in more than a preset number of times over a certain period. If an IP address is identified as a cybercriminal IP address, all login attempts using that IP address are also considered cybercriminal. However, existing methods often suffer from inaccurate identification, resulting in low accuracy. Summary of the Invention

[0004] This application provides a method and apparatus for identifying black market users, which solves the technical problem that existing black market user identification methods often suffer from inaccurate identification, such as misidentification, and have low identification accuracy.

[0005] To address the aforementioned technical problems, the first aspect of this application provides a method for identifying black market users, comprising:

[0006] Based on the IP instant dialing mechanism, identify and lock the broadband account of the instant dialing user;

[0007] Based on the gateway device bound to the broadband account, determine the downstream devices associated with the gateway device;

[0008] Obtain the identity change records of the gateway device and each of the downstream devices, and based on the number of downstream devices and the identity change records, obtain the black market user identification result corresponding to the broadband account.

[0009] Preferably, obtaining the identity change records of the gateway device and each of the downstream devices, and obtaining the black market user identification result corresponding to the broadband account based on the number of downstream devices and the identity change records specifically includes:

[0010] Obtain the identity change records of the gateway device and the downstream device;

[0011] Based on the identity change records, determine the identity change frequency of the gateway device and the downstream device;

[0012] Based on the number of connected devices and the frequency of identity changes, a comprehensive score is calculated for the broadband account in order to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score.

[0013] Preferably, the determination of the black market user identification result corresponding to the broadband account based on the frequency of identity changes and in conjunction with preset black market user judgment conditions specifically includes:

[0014] Based on the frequency of identity changes of the gateway device, and combined with the preset correspondence between the frequency of identity changes of the gateway device and the black market scoring value, a first scoring value is determined, wherein the first scoring value is the black market scoring value of the gateway device.

[0015] Based on the frequency of identity changes of the plugged device, and combined with the preset correspondence between the frequency of identity changes of the plugged device and the black market scoring value, a second scoring value is determined, wherein the second scoring value is the black market scoring value of the plugged device.

[0016] Based on the number of downstream devices associated with the gateway device, and combined with the preset correspondence between the number of downstream devices and the black market scoring value, a third scoring value is determined.

[0017] Based on the first score, the second score, and the third score, a comprehensive score is calculated for the broadband account in order to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score.

[0018] Preferably, calculating the comprehensive score of the broadband account based on the first score, the second score, and the third score specifically includes:

[0019] Based on the first rating value, the second rating value, and the third rating value, and combined with the rating coefficients corresponding to each rating value, the product of each rating value and the rating coefficient is summed to obtain the comprehensive rating value of the broadband account.

[0020] Preferably, the identity identifiers of the gateway device and the downstream device include: IP address and OAID.

[0021] A second aspect of this application provides a device for identifying black market users, comprising:

[0022] The account locking unit is used to identify and lock the broadband account of the instant dialing user based on the IP instant dialing mechanism.

[0023] The device determination unit is used to determine the downstream devices associated with the gateway device based on the gateway device bound to the broadband account;

[0024] The black market identification unit is used to obtain the identity change records of the gateway device and each of the downstream devices, and to obtain the black market user identification result corresponding to the broadband account based on the number of downstream devices and the identity change records.

[0025] Preferably, the black market identification unit specifically includes:

[0026] The identity change record acquisition subunit is used to acquire the identity change records of the gateway device and the downstream device.

[0027] The frequency of change determination subunit is used to determine the frequency of identity change of the gateway device and the downstream device based on the identity change record;

[0028] The comprehensive scoring calculation subunit is used to calculate the comprehensive score value of the broadband account based on the number of the connected devices and the frequency of identity changes, so as to determine the black market user identification result corresponding to the broadband account based on the comprehensive score value.

[0029] Preferably, the comprehensive scoring calculation subunit is specifically used for:

[0030] Based on the frequency of identity changes of the gateway device, and combined with the preset correspondence between the frequency of identity changes of the gateway device and the black market scoring value, a first scoring value is determined, wherein the first scoring value is the black market scoring value of the gateway device.

[0031] Based on the frequency of identity changes of the plugged device, and combined with the preset correspondence between the frequency of identity changes of the plugged device and the black market scoring value, a second scoring value is determined, wherein the second scoring value is the black market scoring value of the plugged device.

[0032] Based on the number of downstream devices associated with the gateway device, and combined with the preset correspondence between the number of downstream devices and the black market scoring value, a third scoring value is determined.

[0033] Based on the first score, the second score, and the third score, a comprehensive score is calculated for the broadband account in order to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score.

[0034] Preferably, calculating the comprehensive score of the broadband account based on the first score, the second score, and the third score specifically includes:

[0035] Based on the first rating value, the second rating value, and the third rating value, and combined with the rating coefficients corresponding to each rating value, the product of each rating value and the rating coefficient is summed to obtain the comprehensive rating value of the broadband account.

[0036] Preferably, the identity identifiers of the gateway device and the downstream device include: IP address and OAID.

[0037] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0038] The solution provided in this application is based on the behavioral characteristics of black market users. By using the IP-based instant dialing mechanism, it identifies and locks the broadband account of the instant dialing user. Then, based on the broadband account, it determines the gateway device bound to the broadband account and the downstream devices associated with the gateway device. Furthermore, by obtaining the identity change records of the gateway device and each downstream device, it determines whether the broadband account belongs to a black market user based on the identity change records and the number of downstream devices. This solves the technical problem of low identification accuracy in existing black market identification methods based on the number of logins over a certain period of time using IP addresses. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating an embodiment of a method for identifying black market users provided in this application.

[0041] Figure 2 This is a flowchart illustrating another embodiment of a method for identifying black market users provided in this application.

[0042] Figure 3 This is a schematic diagram of one embodiment of a black market user identification device provided in this application. Detailed Implementation

[0043] Existing methods for identifying malicious actors primarily rely on the business systems under attack. They identify malicious actors by checking if an IP address logs in more than a preset number of times over a certain period. If an IP address is identified as a malicious one, all login attempts using that IP address are also considered malicious. However, existing methods often suffer from inaccurate identification, resulting in low accuracy.

[0044] To address the technical problems existing in the current technology, the applicant conducted research on the behavioral characteristics of cybercriminal users and discovered that these users frequently change their IP information and other identity identifiers, control a large number of smart terminals, create multiple identities, and forge click rates and access volumes. Therefore, the research shows that the frequency of device identity changes and the number of devices connected to them by cybercriminal users are much higher than those of normal users. This characteristic can be used to more accurately identify cybercriminal users.

[0045] In view of this, the present application provides a method and apparatus for identifying black market users, which solves the technical problem that existing black market user identification methods often have inaccurate identification, such as misidentification, and have low identification accuracy.

[0046] To make the inventive objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] Please see Figure 1 The first embodiment of this application provides a method for identifying black market users, including:

[0048] Step 101: Based on the IP instant dialing mechanism, identify and lock the broadband account of the instant dialing user;

[0049] Step 102: Based on the gateway device bound to the broadband account, determine the downstream devices associated with the gateway device;

[0050] Step 103: Obtain the identity change records of the gateway device and each downstream device. Based on the number of downstream devices and the identity change records, obtain the identification results of black market users corresponding to the broadband account.

[0051] It should be noted that since most home gateways currently restart every 48 hours, changing their IP addresses during restart, the system first identifies and locks the broadband accounts of users using the IP instant dialing mechanism. Each broadband account can be considered a home user. Based on the broadband account, the gateway device bound to that account is determined. Then, based on the gateway device, the downstream devices of that gateway device are identified. Next, the system obtains the identity change records of the gateway device and each downstream device under that gateway device. Based on the identity change of the gateway device and its downstream devices, as well as the number of devices connected to the gateway device, it is determined whether the broadband account matches the characteristics of a black market user. If it does, the broadband account and its associated devices can be marked as a black market user and black market devices. The identification results can then be synchronized to the black market user database to update the black market user data. The identity identifiers of the aforementioned gateway device and downstream devices include, but are not limited to, IP and OAID.

[0052] The solution provided in this embodiment is based on the behavioral characteristics of black market users who frequently change their IP information and other identity identifiers, control a large number of smart terminals, create multiple identities, and forge click rates and access volumes. By using the IP-based instant dialing mechanism, it identifies and locks the broadband account of the instant dialing user. Then, based on the broadband account, it determines the gateway device bound to the broadband account and the downstream devices associated with the gateway device. Furthermore, by obtaining the identity identifier change records of the gateway device and each downstream device, it determines whether the broadband account belongs to a black market user based on the identity identifier change records and the number of downstream devices. This solves the technical problem of low identification accuracy in existing black market identification methods based on the number of logins over a certain period of time using IP addresses.

[0053] The above content is a detailed description of a basic embodiment of the black market user identification method provided by this application. The following is a detailed description of a more specific embodiment of the black market user identification method provided by this application.

[0054] Please see Figure 2 This embodiment, based on the previous embodiment, provides a more specific method for identifying black market users, including:

[0055] Furthermore, the steps in step 103 of the previous embodiment, which involve obtaining the identity change records of the gateway device and each downstream device, and obtaining the identification result of the black market user corresponding to the broadband account based on the number of downstream devices and the identity change records, are specifically broken down as follows:

[0056] Step 1031: Obtain the identity change records of the gateway device and its downstream devices;

[0057] Step 1032: Determine the frequency of identity changes for the gateway device and its downstream devices based on the identity change records;

[0058] Step 1033: Calculate the comprehensive score of the broadband account based on the number of connected devices and the frequency of identity changes, so as to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score.

[0059] Furthermore, step 1033, which calculates a comprehensive score for the broadband account based on the number of connected devices and the frequency of identity changes, in order to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score, is further subdivided into the following steps:

[0060] Based on the frequency of changes in the gateway device's identity identifier, and combined with the preset correspondence between the frequency of changes in the gateway device's identity identifier and the black market scoring value, a first scoring value is determined, wherein the first scoring value is the black market scoring value of the gateway device.

[0061] It should be noted that the aforementioned first score is a black market score derived from the frequency of changes in the gateway device's identity identifier. Generally, the higher the score, the more likely the account user is a black market user. Furthermore, for gateway devices, the preferred identity identifier for black market identification is IP information. Specifically, this can be achieved by recording the IP addresses and IP change times of gateways in the entire network's fixed-line routing mode, and statistically analyzing the number of IP changes within a preset time period. For example, within a week, 0-14 IP changes result in a score of 0; 15-20 IP changes result in a score of 1; 20-30 IP changes result in a score of 2; and more than 30 IP changes result in a score of 3.

[0062] In addition, if the gateway in bridge mode cannot report IP changes in real time, you can also send parameters (IP + port + timestamp) to the service platform through the advertising landing page to query the broadband account.

[0063] Based on the frequency of changes in the identity identifier of the plugged device, and combined with the preset correspondence between the frequency of changes in the identity identifier of the plugged device and the black market scoring value, a second scoring value is determined, wherein the second scoring value is the black market scoring value of the plugged device.

[0064] It should be noted that the second scoring value mentioned above is a black market scoring value derived from the frequency of identity changes of the associated downstream devices related to the gateway device. Generally, the higher the scoring value, the higher the likelihood that the account user is a black market user. Since black market users need to tamper with the device's OAID to simulate multiple user identities clicking on advertising pages and artificially increase ad clicks, while normal users generally do not have the need to modify OAID information, the identity identifier used for black market identification of downstream devices can preferably be OAID information. Specifically, based on the information collected by the gateway (gateway MAC, downstream device MAC, and corresponding OAID of the downstream device), the changes in the OAID of the downstream device within a preset time period are statistically analyzed and scored. For example, if the downstream device has 1-5 OAIDs within a week, the score is 0; if it has 5-20 OAIDs, the score is 1; and if it has more than 20 OAIDs, the score is 2.

[0065] The OAID change records of the downstream devices can be referenced in the form shown in Table 1.

[0066] Table 1. Example of OAID Change Records for Connected Devices

[0067]

[0068] The third score is determined based on the number of downstream devices associated with the gateway device and the preset correspondence between the number of downstream devices and the black market score.

[0069] It should be noted that malicious users may connect multiple devices to the gateway to manually click on advertisements, or use a SIM pool to simultaneously control multiple devices through the platform for unified management. Based on this malicious behavior, the number of devices connected to the gateway can be recorded and scored. For example, if the gateway has 0-30 devices connected, the score is 0; 30-70 devices, the score is 1; and more than 70 devices, the score is 2.

[0070] Based on the first, second, and third scores, a comprehensive score is calculated for the broadband account in order to determine the identification result of the black market user corresponding to the broadband account.

[0071] More specifically, the steps involved in calculating the comprehensive score of a broadband account based on the first, second, and third score values, as mentioned above, may include:

[0072] Based on the first, second, and third rating values, and combined with the corresponding rating coefficients, the product of each rating value and its coefficient is summed to obtain the comprehensive rating value of the broadband account. That is, Z = X1·ω1 + X2·ω2 + X3·ω3;

[0073] In the formula, Z represents the overall score, X1, X2, and X3 represent the first, second, and third scores, respectively, and ω1, ω2, and ω3 represent the scoring coefficients corresponding to the first, second, and third scores, respectively. Preferably, ω1 = 1, ω2 = 0.5, and ω3 = 1.

[0074] The above content is a detailed description of a specific embodiment of a black market user identification method provided by this application. The following is a detailed description of an embodiment of a black market user identification device provided by this application.

[0075] Please see Figure 3 The second aspect of this application provides a device for identifying black market users, comprising:

[0076] Account locking unit 201 is used to identify and lock the broadband account of the instant dialing user according to the IP instant dialing implementation mechanism;

[0077] The device determination unit 202 is used to determine the downstream devices associated with the gateway device based on the gateway device bound to the broadband account.

[0078] The black market identification unit 203 is used to obtain the identity change records of the gateway device and each downstream device, and obtain the black market user identification result corresponding to the broadband account based on the number of downstream devices and the identity change records.

[0079] Furthermore, the black market identification unit 203 specifically includes:

[0080] The identity change record acquisition subunit 2031 is used to acquire the identity change records of the gateway device and its downstream devices.

[0081] The frequency change determination subunit 2032 is used to determine the frequency of identity change of the gateway device and the downstream device based on the identity change records;

[0082] The comprehensive scoring calculation subunit 2033 is used to calculate the comprehensive score value of the broadband account based on the number of connected devices and the frequency of identity changes, so as to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score value.

[0083] Furthermore, the comprehensive scoring calculation subunit is specifically used for:

[0084] Based on the frequency of changes in the identity identifier of the gateway device, and combined with the preset correspondence between the frequency of changes in the identity identifier of the gateway device and the black market scoring value, a first scoring value is determined, wherein the first scoring value is the black market scoring value of the gateway device.

[0085] Based on the frequency of changes in the identity identifier of the plugged device, and combined with the preset correspondence between the frequency of changes in the identity identifier of the plugged device and the black market scoring value, a second scoring value is determined, wherein the second scoring value is the black market scoring value of the plugged device.

[0086] The third score is determined based on the number of downstream devices associated with the gateway device and the preset correspondence between the number of downstream devices and the black market score.

[0087] Based on the first, second, and third scores, a comprehensive score is calculated for the broadband account in order to determine the identification result of the black market user corresponding to the broadband account.

[0088] Furthermore, the comprehensive score for the broadband account is calculated based on the first, second, and third score values, specifically including:

[0089] Based on the first, second, and third rating values, and combined with the rating coefficients corresponding to each rating value, the product of each rating value and the rating coefficient is summed to obtain the comprehensive rating value of the broadband account.

[0090] Furthermore, the identity identifiers of gateway devices and downstream devices include: IP address and OAID.

[0091] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the terminals, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0092] In the several embodiments provided in this application, it should be understood that the disclosed terminals, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units through some interfaces, and may be electrical, mechanical, or other forms.

[0093] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0094] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0095] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0096] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0097] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for identifying black market users, characterized in that, include: Based on the IP instant dialing mechanism, identify and lock the broadband account of the instant dialing user; Based on the gateway device bound to the broadband account, determine the downstream devices associated with the gateway device; The process involves obtaining identity change records between the gateway device and each of the downstream devices, and based on the number of downstream devices and the identity change records, determining the identification result of the black market user corresponding to the broadband account. Specific steps include: obtaining identity change records between the gateway device and the downstream devices; determining the identity change frequency between the gateway device and the downstream devices based on the identity change records; and calculating a comprehensive score for the broadband account based on the number of downstream devices and the identity change frequency, so as to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score. The step of calculating the comprehensive score of the broadband account based on the number of connected devices and the frequency of identity changes includes: Based on the frequency of identity changes of the gateway device and a preset correspondence between the frequency of identity changes of the gateway device and black market scoring values, a first scoring value is determined, wherein the first scoring value is the black market scoring value of the gateway device; based on the frequency of identity changes of the downstream devices and a preset correspondence between the frequency of identity changes of the downstream devices and black market scoring values, a second scoring value is determined, wherein the second scoring value is the black market scoring value of the downstream devices; based on the number of downstream devices associated with the gateway device and a preset correspondence between the number of downstream devices and black market scoring values, a third scoring value is determined; based on the first scoring value, the second scoring value, and the third scoring value, and combined with the scoring coefficients corresponding to each scoring value, the product of each scoring value and the scoring coefficients is summed to obtain the comprehensive scoring value of the broadband account.

2. The method for identifying black market users according to claim 1, characterized in that, The identity identifiers of the gateway device and the downstream device include: IP address and OAID.

3. A device for identifying black market users, characterized in that, include: The account locking unit is used to identify and lock the broadband account of the instant dialing user based on the IP instant dialing mechanism. The device determination unit is used to determine the downstream devices associated with the gateway device based on the gateway device bound to the broadband account; The black market identification unit is used to obtain the identity change records between the gateway device and each of the downstream devices, and to obtain the black market user identification result corresponding to the broadband account based on the number of downstream devices and the identity change records. The black market identification unit specifically includes: The identity change record acquisition subunit is used to acquire identity change records between the gateway device and the downstream device; The frequency of change determination subunit is used to determine the frequency of identity change between the gateway device and the downstream device based on the identity change record; The comprehensive scoring calculation subunit is used to calculate the comprehensive score value of the broadband account based on the number of the connected devices and the frequency of identity changes, so as to determine the black market user identification result corresponding to the broadband account based on the comprehensive score value. The comprehensive scoring calculation subunit is specifically used for: Based on the frequency of identity changes of the gateway device, and combined with the preset correspondence between the frequency of identity changes of the gateway device and the black market scoring value, a first scoring value is determined, wherein the first scoring value is the black market scoring value of the gateway device. Based on the frequency of identity changes of the plugged device, and combined with the preset correspondence between the frequency of identity changes of the plugged device and the black market scoring value, a second scoring value is determined, wherein the second scoring value is the black market scoring value of the plugged device. Based on the number of downstream devices associated with the gateway device, and combined with the preset correspondence between the number of downstream devices and the black market scoring value, a third scoring value is determined. Based on the first score, the second score, and the third score, a comprehensive score is calculated for the broadband account in order to determine the identification result of the black market user corresponding to the broadband account based on the comprehensive score. The step of calculating the comprehensive score of the broadband account based on the first score, the second score, and the third score specifically includes: Based on the first rating value, the second rating value, and the third rating value, and combined with the rating coefficients corresponding to each rating value, the product of each rating value and the rating coefficient is summed to obtain the comprehensive rating value of the broadband account.

4. The black market user identification device according to claim 3, characterized in that, The identity identifiers of the gateway device and the downstream device include: IP address and OAID.

Images