A device identification method, apparatus, electronic device, and readable storage medium

Abstract

This application provides a device identification method, apparatus, electronic device, and readable storage medium, belonging to the field of device identification technology. This application involves: acquiring sample device data corresponding to each sample device in a sample device set; for each sample device, inputting the sample device data corresponding to that sample device into a pre-trained device fingerprint scoring model, so that the device fingerprint scoring model outputs a corresponding device score; based on the device score, determining a set of devices to be analyzed from the sample device set; based on the sample device data corresponding to each device to be analyzed in the set of devices to be analyzed, determining corresponding device features; and identifying the target device among the devices to be detected based on the device features. This improves the accuracy of identifying black market devices.

Description

Technical Field

[0001] This application relates to the field of device identification technology, and in particular to a device identification method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] The term "black market" refers to illegal activities that use the internet as a medium and network technology as the primary means to pose potential threats (significant security risks) to the security of computer information systems and the order of cyberspace management. Examples include "hacking attacks" and "account theft." Black market devices refer to electronic devices used to carry out black market activities. Identifying these devices can facilitate the maintenance of network security.

[0003] Current solutions for identifying malicious devices typically involve: pre-deploying an offline device fingerprint scoring model to score each historically accessed device. The higher the score, the greater the probability of the device being a malicious device. This identifies the device ID of the malicious device. Then, the device ID is used to identify the device to be detected in real time. When the device accesses the site again with the same device ID, some blocking and interception risk control measures are implemented.

[0004] However, when using the above methods to identify illicit devices in real time, if the illicit users use emulators, device modification tools, or other technical means to forge new device fingerprints, the identification of illicit devices will fail, resulting in a low accuracy rate for identifying such devices. Summary of the Invention

[0005] To address the technical problem of low accuracy in identifying black market devices through device fingerprint scoring, this application provides a device identification method, apparatus, electronic device, and readable storage medium.

[0006] In a first aspect, embodiments of this application provide a device identification method, including:

[0007] Obtain the sample device data corresponding to each sample device in the sample device set;

[0008] For each sample device, the sample device data corresponding to the sample device is input into a pre-trained device fingerprint scoring model so that the device fingerprint scoring model outputs the corresponding device score;

[0009] Based on the device scores, a set of devices to be analyzed is determined from the sample device set.

[0010] Based on the sample device data corresponding to each device in the set of devices to be analyzed, the corresponding device characteristics are determined.

[0011] The target device is identified among the devices to be tested based on the device characteristics described.

[0012] In one possible implementation, determining the set of devices to be analyzed from the sample device set based on the device score includes:

[0013] The sample devices in the sample device set whose corresponding device scores meet the preset conditions are identified as devices to be analyzed, and the set of devices to be analyzed is constructed based on all the devices to be analyzed.

[0014] The preset conditions are that the device score is greater than a preset score threshold, and the number of times the device score appears in all device scores exceeds a preset number threshold.

[0015] In one possible implementation, determining the set of devices to be analyzed from the sample device set based on the device score includes:

[0016] The sample devices in the sample device set whose corresponding device scores are greater than a preset score threshold are identified as the devices to be analyzed;

[0017] The set of devices to be analyzed is constructed based on all the devices to be analyzed.

[0018] In one possible implementation, the set of devices to be analyzed includes at least one subset of devices to be analyzed, wherein each device to be analyzed in the subset of devices to be analyzed has the same device score;

[0019] The step of determining the corresponding device characteristics based on the sample device data corresponding to each device in the set of devices to be analyzed includes:

[0020] For each subset of devices to be analyzed, a set of feature values ​​is determined based on the sample device data corresponding to each device to be analyzed in the subset of devices to be analyzed;

[0021] Determine at least one candidate feature value from the feature value set, and the number of times each candidate feature value appears in the feature value set;

[0022] Based on the occurrence frequency of each candidate feature value, a target feature value is determined from at least one of the candidate feature values;

[0023] The device features are determined from the target feature values.

[0024] In one possible implementation, determining the target feature value from at least one of the candidate feature values ​​based on the frequency of occurrence of each candidate feature value includes:

[0025] At least one candidate feature value is sorted in descending order of the frequency of occurrence, and the top-ranked, predetermined number of candidate feature values ​​are determined as the target feature value.

[0026] In one possible implementation, determining the device feature from the target feature values ​​includes:

[0027] For each target feature value, a target test device that matches the target feature value is matched in the test device set, the device tag corresponding to the target test device is determined, and the matching accuracy corresponding to the target feature value is determined based on the device tag;

[0028] The target feature value whose matching accuracy is higher than the preset accuracy threshold is determined as the device feature.

[0029] In one possible implementation, the device features include at least one dimensional feature, and after identifying the target device in the device to be detected based on the device features, the method further includes:

[0030] Among at least one dimension feature, the target dimension feature corresponding to the target device is determined;

[0031] Evaluation information for the target device is generated based on the target dimension features.

[0032] Secondly, embodiments of this application provide a device identification apparatus, including...

[0033] The acquisition module is used to acquire sample device data corresponding to each sample device in the sample device set;

[0034] The input module is used to input the sample device data corresponding to each sample device into the pre-trained device fingerprint scoring model so that the device fingerprint scoring model outputs the corresponding device score.

[0035] The first determining module is used to determine the set of devices to be analyzed from the sample set of devices based on the device scores.

[0036] The second determining module is used to determine the corresponding device characteristics based on the sample device data corresponding to each device to be analyzed in the set of devices to be analyzed;

[0037] The identification module is used to identify the target device among the devices to be detected based on the device characteristics.

[0038] In one possible implementation, the first determining module is specifically used for:

[0039] The sample devices in the sample device set whose corresponding device scores meet the preset conditions are identified as devices to be analyzed, and the set of devices to be analyzed is constructed based on all the devices to be analyzed.

[0040] The preset conditions are that the device score is greater than a preset score threshold, and the number of times the device score appears in all device scores exceeds a preset number threshold.

[0041] In one possible implementation, the first determining module is further configured to:

[0042] The sample devices in the sample device set whose corresponding device scores are greater than a preset score threshold are identified as the devices to be analyzed;

[0043] The set of devices to be analyzed is constructed based on all the devices to be analyzed.

[0044] In one possible implementation, the set of devices to be analyzed includes at least one subset of devices to be analyzed, wherein each device to be analyzed in the subset of devices to be analyzed has the same device score;

[0045] The second determining module is specifically used for:

[0046] For each subset of devices to be analyzed, a set of feature values ​​is determined based on the sample device data corresponding to each device to be analyzed in the subset of devices to be analyzed;

[0047] Determine at least one candidate feature value from the feature value set, and the number of times each candidate feature value appears in the feature value set;

[0048] Based on the occurrence frequency of each candidate feature value, a target feature value is determined from at least one of the candidate feature values;

[0049] The device features are determined from the target feature values.

[0050] In one possible implementation, the second determining module is further configured to:

[0051] At least one candidate feature value is sorted in descending order of the frequency of occurrence, and the top-ranked, predetermined number of candidate feature values ​​are determined as the target feature value.

[0052] In one possible implementation, the second determining module is further configured to:

[0053] For each target feature value, a target test device that matches the target feature value is matched in the test device set, the device tag corresponding to the target test device is determined, and the matching accuracy corresponding to the target feature value is determined based on the device tag;

[0054] The target feature value whose matching accuracy is higher than the preset accuracy threshold is determined as the device feature.

[0055] In one possible implementation, the apparatus further includes a generation module for:

[0056] Among at least one dimension feature, the target dimension feature corresponding to the target device is determined;

[0057] Evaluation information for the target device is generated based on the target dimension features.

[0058] Thirdly, an electronic device is provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0059] Memory, used to store computer programs;

[0060] When a processor executes a program stored in memory, it implements any of the steps described in the first aspect.

[0061] Fourthly, a computer-readable storage medium is provided, characterized in that the computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of any of the methods described in the first aspect.

[0062] Fifthly, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to execute any of the device identification methods described above.

[0063] Beneficial effects of the embodiments in this application:

[0064] This application provides a device identification method, apparatus, electronic device, and readable storage medium. The method involves: first, acquiring sample device data for each sample device in a sample device set; then, for each sample device, inputting the sample device data into a pre-trained device fingerprint scoring model, causing the model to output a corresponding device score; next, determining a set of devices to be analyzed from the sample device set based on the device scores; and determining corresponding device features based on the sample device data for each device to be analyzed in the set; finally, identifying the target device among the devices to be detected based on the device features. This application allows for further analysis of black market devices (i.e., devices to be analyzed) selected by the device fingerprint scoring model, thereby identifying their device features. Furthermore, these features are used to identify black market devices among the devices to be detected. Since device features are difficult to alter, even if black market operators forge new device fingerprints, black market devices can still be accurately identified, thus improving the accuracy of black market device identification.

[0065] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0066] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0067] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 A flowchart illustrating a device identification method provided in this application embodiment;

[0069] Figure 2 A flowchart illustrating another device identification method provided in this application embodiment;

[0070] Figure 3 This is a schematic diagram of the structure of a device identification device provided in an embodiment of this application;

[0071] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0073] Current methods for identifying malicious devices typically involve pre-deploying an offline device fingerprint scoring model to score each historically accessed device. A higher score indicates a higher probability of the device being malicious, thus identifying its device ID. This device ID is then used to identify the device to be detected in real time, and blocking measures are implemented when the same device ID re-accesses the site. However, this method is ineffective when malicious actors use emulators, device modification tools, or other techniques to forge new device fingerprints, resulting in low accuracy. Therefore, this application provides a device identification method for identifying malicious devices.

[0074] The device identification method provided in this application will be explained and described below with reference to the accompanying drawings and specific embodiments. The embodiments do not constitute a limitation on the embodiments of this application.

[0075] See Figure 1 This is a flowchart illustrating an embodiment of a device identification method provided in this application. Figure 1 As shown, the process may include the following steps:

[0076] S101, Obtain the sample device data corresponding to each sample device in the sample device set.

[0077] This application provides a device identification method for identifying target devices (such as black market devices) among devices to be detected.

[0078] The aforementioned set of sample devices includes multiple sample devices, such as electronic devices like computers and mobile phones.

[0079] Sample device data refers to the dimensional information of multiple dimensions corresponding to the sample data. Dimensions include device ID, device type, device startup time, device battery level, device memory, and device resolution, etc. Dimension information refers to the specific values ​​of each dimension.

[0080] For example, for device a, the corresponding sample device data is: device ID is a, device type is mobile phone, device startup time is 8:00, device battery level is 80%, device memory is 60%, etc.

[0081] S102, for each sample device, the sample device data corresponding to the sample device is input into the pre-trained device fingerprint scoring model so that the device fingerprint scoring model outputs the corresponding device score.

[0082] The aforementioned device fingerprint scoring model is a model that has been trained to convergence using training data (such as device data marked as whether it is a black market device). It is used to score devices based on device data. The higher the score, the greater the probability of the device being a black market device.

[0083] Based on this, in this embodiment of the application, the sample device data corresponding to each sample device can be input into the device fingerprint scoring model, and the device fingerprint scoring model can output the device score corresponding to each sample device.

[0084] S103, Based on the device score, determine the set of devices to be analyzed from the sample device set.

[0085] The aforementioned set of devices to be analyzed includes all or some of the black market devices predicted by the device fingerprint scoring model.

[0086] In one embodiment, the specific implementation of determining the set of devices to be analyzed in the sample device set based on the device score may include: determining the sample devices in the sample device set whose corresponding device score is greater than a preset score threshold as devices to be analyzed, and constructing the set of devices to be analyzed based on all the devices to be analyzed.

[0087] In this embodiment, a preset scoring threshold is used to determine whether a device is a black market device. That is, devices with a score greater than the threshold are black market devices predicted by the model, while devices with a score less than or equal to the threshold are non-black market devices predicted by the model. In other words, all black market devices predicted by the device fingerprint scoring model in the sample device set are identified as devices to be analyzed.

[0088] In practical applications, due to the characteristics of the black market, black market devices often exhibit clustering, meaning that a large number of black market devices log in at the same time. Furthermore, these devices often share similar device dimensional information (such as device startup time, device memory, and device resolution), which will also lead to a certain degree of score clustering in the scores given by the device scoring model.

[0089] Based on this, in another embodiment, the specific implementation of determining the set of devices to be analyzed in the sample device set based on the device score may include:

[0090] The sample devices in the sample device set whose corresponding device scores meet the preset conditions are identified as devices to be analyzed, and the device set to be analyzed is constructed based on all the devices to be analyzed; wherein, the preset conditions are that the device score is greater than a preset score threshold, and the number of times the device score appears in all device scores exceeds a preset number threshold.

[0091] In this embodiment, devices to be analyzed are filtered by setting two criteria: devices with a score greater than a preset score threshold and devices whose scores exhibit clustering (i.e., appearing more than a preset frequency threshold in all device scores). The preset score threshold and preset frequency threshold can be set by the user according to actual needs.

[0092] For example, condition one is: device score > 0.5, that is, the probability that the device fingerprint scoring model considers the device to be a black market device is greater than 0.5; condition two is: device score clustering > 2000, that is, by scoring each sample device in the sample device set through the device fingerprint scoring model, more than 2000 devices with the same score (such as 0.6) are obtained.

[0093] In other words, among all the illicit devices predicted by the device fingerprinting model, devices exhibiting clustered scores are further identified as the devices to be analyzed. This increases the probability that the device to be analyzed is an illicit device, thereby improving the accuracy of subsequent device feature determination.

[0094] S104, Based on the sample device data corresponding to each device to be analyzed in the set of devices to be analyzed, determine the corresponding device characteristics.

[0095] S105, Identify the target device among the devices to be detected based on the device characteristics.

[0096] The following provides a unified explanation of S104 and S105:

[0097] In this embodiment of the application, after determining all devices to be analyzed (i.e., the set of devices to be analyzed), based on the sample device data corresponding to each device to be analyzed, the device characteristics that can be used to characterize most of the devices to be analyzed in the set of devices to be analyzed are analyzed.

[0098] Furthermore, the device features are used in real time to identify whether the device under test is the target device (i.e., a black market device). The device features include at least one dimensional feature.

[0099] Specifically, the implementation of identifying a target device in a device under test based on the device features may include the following steps: obtaining device data of the device under test, wherein the device data contains dimensional information of at least one dimension; comparing the dimensional features of each dimension contained in the device features with the dimensional information of the corresponding dimension in the device data; and determining the device under test as the target device when any dimensional feature matches the dimensional information.

[0100] For example, device characteristics include: device startup time is 8:00, device battery level is 80%, and device memory is 60%. Device data for the device to be tested includes: device ID is 'a', device type is mobile phone, device startup time is 9:00, device battery level is 80%, and device memory is 90%. The dimensional characteristics and information of the three dimensions—device startup time, device battery level, and device memory—are compared sequentially. The comparison shows that the device battery level is 80% in the device characteristics, and the device battery level in the device data of the device to be tested is also 80%. Since the two are consistent, the device to be tested is determined to be the target device.

[0101] The specific method for determining the corresponding device characteristics based on the sample device data for each device in the set of devices to be analyzed will be explained in detail in the following embodiments, and will not be elaborated here.

[0102] In another embodiment, the device features include at least one dimension feature. After identifying the target device in the device to be detected based on the device features, the step may further include the following steps: determining the target dimension feature corresponding to the target device among the at least one dimension feature, and generating evaluation information for the target device based on the target dimension feature.

[0103] Among them, the target dimension feature corresponding to the target device is the dimension feature that is consistent with the corresponding dimension information in the device data of the target device, such as "the device battery power is 80%" in the example above.

[0104] Evaluation information refers to the information generated from target dimension features that explains why the device under test was identified as the target device. For example, if the target dimension feature is "device battery level is 80%", the corresponding evaluation information could be: the reason for identifying this device as the target device is that its device battery level is 80%.

[0105] In existing technologies that identify illicit devices using device fingerprinting models, the model only provides a score for determining whether a device is illicit, without specifying the exact features used to make that determination. In this embodiment, however, evaluation information is generated based on the dimensional features used to identify the device as a target device. This allows users to easily understand the reasons behind the identification.

[0106] In this embodiment, firstly, sample device data corresponding to each sample device in the sample device set is acquired. Then, for each sample device, the sample device data corresponding to that sample device is input into a pre-trained device fingerprint scoring model, so that the device fingerprint scoring model outputs a corresponding device score. Next, based on the device scores, a set of devices to be analyzed is determined from the sample device set. Then, based on the sample device data corresponding to each device to be analyzed in the set of devices to be analyzed, corresponding device features are determined. Finally, the target device is identified among the devices to be detected based on the device features. Through this application, black market devices (i.e., devices to be analyzed) screened by the device fingerprint scoring model can be further analyzed, thereby analyzing the device features of black market devices. Furthermore, the device features can be used to identify black market devices among the devices to be detected. Since device features are difficult to change, even if black market operators forge new device fingerprints, black market devices can still be accurately identified, thereby improving the accuracy of identifying black market devices.

[0107] See Figure 2 This is a flowchart illustrating an embodiment of another device identification method provided in this application. Figure 2 The process shown above Figure 1 Based on the illustrated process, this section describes how to determine the corresponding device characteristics based on the sample device data corresponding to each device in the set of devices to be analyzed. For example... Figure 2 As shown, the process may include the following steps:

[0108] S201, for each subset of devices to be analyzed, a set of feature values ​​is determined based on the sample device data corresponding to each device to be analyzed in the subset of devices to be analyzed.

[0109] The aforementioned set of devices to be analyzed includes at least one subset of devices to be analyzed, wherein each device in the subset corresponds to the same device score. For example, if the device fingerprint scoring model outputs more than 2,000 data points with a score of 0.6 and more than 2,000 data points with a score of 0.7, then all devices with a score of 0.6 are constructed as one subset of devices to be analyzed, and all devices with a score of 0.7 are constructed as another subset of devices to be analyzed.

[0110] In this embodiment of the application, further feature mining is performed for each subset of devices to be analyzed. Specifically, for each subset of devices to be analyzed, for the sample device data of each device to be analyzed in the subset, each dimension of the sample device data and the corresponding dimension information are taken as a feature value, and a feature value set is constructed from all feature values.

[0111] For example, the sample device data for device 1 is: device ID is a, device type is mobile phone, and device startup time is 8:00; the sample device data for device 2 is: device ID is b, device type is mobile phone, and device startup time is 8:00.

[0112] The feature set includes: device ID a, device ID b, device type mobile phone, device type mobile phone, device startup time 8:00, device startup time 8:00. That is, regardless of whether the dimensional information on the same dimension is the same, there is a corresponding feature value in the feature set.

[0113] S202, at least one candidate feature value is determined from the feature value set, and the number of times each candidate feature value appears in the feature value set.

[0114] In this embodiment of the application, candidate feature value refers to the feature value statistically analyzed from the perspective of content, and the same feature value corresponds to the same candidate feature value.

[0115] The number of times a candidate eigenvalue appears in the eigenvalue set, that is, the number of eigenvalues ​​in the eigenvalue set that are consistent with the candidate eigenvalue.

[0116] For example, the feature set includes: device ID is a, device ID is b, device type is mobile phone, device type is mobile phone, device startup time is 8:00, device startup time is 8:00.

[0117] Then the candidate feature values ​​corresponding to the feature value set can be determined as follows: device ID is a, device ID is b, device type is mobile phone, and device startup time is 8:00.

[0118] For the candidate feature value "device id is a", there is only one feature value in the feature value set that matches it. Therefore, the occurrence count of this candidate feature value is "1". For the candidate feature value "device type is mobile phone", there are two feature values ​​in the feature value set that match it. Therefore, the occurrence count of this candidate feature value is "2".

[0119] S203, based on the occurrence frequency of each candidate feature value, determine the target feature value among at least one of the candidate feature values.

[0120] In one embodiment, the specific implementation of determining the target feature value from at least one candidate feature value based on the frequency of occurrence of each candidate feature value may include: sorting at least one candidate feature value in descending order of frequency of occurrence, and determining a preset number of candidate feature values ​​that appear at the top of the sort as the target feature value. This allows for the selection of the most frequently occurring candidate feature values ​​as the target feature value, making the selected target feature value more representative of the common characteristics of most devices among all devices to be analyzed, thereby improving the accuracy of subsequent determination of device characteristics.

[0121] In another embodiment, the specific implementation of determining the target feature value from at least one candidate feature value based on the occurrence frequency of each candidate feature value may include: determining the candidate feature value whose occurrence frequency is greater than a preset threshold as the target feature value. This scheme has a simple calculation process, thus allowing for the rapid selection of candidate feature values ​​that meet the conditions as the target feature value.

[0122] S204, determine the device feature from the target feature values.

[0123] In one embodiment, the specific implementation of determining the device feature from the target feature values ​​may include: determining all target feature values ​​as the device feature, wherein each target feature value is a dimensional feature included in the device feature. This achieves the determination of the device feature.

[0124] In another embodiment, the specific implementation of determining the device feature in the target feature value may include: for each target feature value, matching a target test device that matches the target feature value in the test device set, determining the device tag corresponding to the target test device, determining the matching accuracy rate corresponding to the target feature value based on the device tag, and determining the target feature value whose matching accuracy rate is higher than a preset accuracy threshold as the device feature.

[0125] The aforementioned set of testing equipment includes multiple testing devices. Device tags include both illicit and non-illicit devices. These tags can be pre-set manually or obtained through detection using a pre-defined model.

[0126] In this embodiment, after obtaining the target test device using target feature value matching, if the device tag of the target test device is a black market device, it means that the target feature value matching result is correct; otherwise, the matching result is incorrect. The matching accuracy rate is determined by statistically analyzing the number of correct matches and the total number of matches, i.e., matching accuracy rate = number of correct matches / total number of matches. Furthermore, target feature values ​​with a matching accuracy rate higher than a preset accuracy threshold are identified as device features. This improves the accuracy of device features, and consequently, improves the accuracy of subsequent target device identification.

[0127] Based on the same technical concept, embodiments of this application also provide a device identification device, such as... Figure 3 As shown, the device includes:

[0128] The acquisition module 301 is used to acquire sample device data corresponding to each sample device in the sample device set;

[0129] The input module 302 is used to input the sample device data corresponding to each sample device into the pre-trained device fingerprint scoring model so that the device fingerprint scoring model outputs the corresponding device score.

[0130] The first determining module 303 is used to determine the set of devices to be analyzed from the sample device set based on the device score;

[0131] The second determining module 304 is used to determine the corresponding device characteristics based on the sample device data corresponding to each device to be analyzed in the set of devices to be analyzed;

[0132] The identification module 305 is used to identify the target device among the devices to be detected based on the device characteristics.

[0133] In one possible implementation, the first determining module is specifically used for:

[0134] The sample devices in the sample device set whose corresponding device scores meet the preset conditions are identified as devices to be analyzed, and the set of devices to be analyzed is constructed based on all the devices to be analyzed.

[0135] The preset conditions are that the device score is greater than a preset score threshold, and the number of times the device score appears in all device scores exceeds a preset number threshold.

[0136] In one possible implementation, the first determining module is further configured to:

[0137] The sample devices in the sample device set whose corresponding device scores are greater than a preset score threshold are identified as the devices to be analyzed;

[0138] The set of devices to be analyzed is constructed based on all the devices to be analyzed.

[0139] In one possible implementation, the set of devices to be analyzed includes at least one subset of devices to be analyzed, wherein each device to be analyzed in the subset of devices to be analyzed has the same device score;

[0140] The second determining module is specifically used for:

[0141] For each subset of devices to be analyzed, a set of feature values ​​is determined based on the sample device data corresponding to each device to be analyzed in the subset of devices to be analyzed;

[0142] Determine at least one candidate feature value from the feature value set, and the number of times each candidate feature value appears in the feature value set;

[0143] Based on the occurrence frequency of each candidate feature value, a target feature value is determined from at least one of the candidate feature values;

[0144] The device features are determined from the target feature values.

[0145] In one possible implementation, the second determining module is further configured to:

[0146] At least one candidate feature value is sorted in descending order of the frequency of occurrence, and the top-ranked, predetermined number of candidate feature values ​​are determined as the target feature value.

[0147] In one possible implementation, the second determining module is further configured to:

[0148] For each target feature value, a target test device that matches the target feature value is matched in the test device set, the device tag corresponding to the target test device is determined, and the matching accuracy corresponding to the target feature value is determined based on the device tag;

[0149] The target feature value whose matching accuracy is higher than the preset accuracy threshold is determined as the device feature.

[0150] In one possible implementation, the apparatus further includes a generation module for:

[0151] Among at least one dimension feature, the target dimension feature corresponding to the target device is determined;

[0152] Evaluation information for the target device is generated based on the target dimension features.

[0153] In this embodiment, firstly, sample device data corresponding to each sample device in the sample device set is acquired. Then, for each sample device, the sample device data corresponding to that sample device is input into a pre-trained device fingerprint scoring model, so that the device fingerprint scoring model outputs a corresponding device score. Next, based on the device scores, a set of devices to be analyzed is determined from the sample device set. Then, based on the sample device data corresponding to each device to be analyzed in the set of devices to be analyzed, corresponding device features are determined. Finally, the target device is identified among the devices to be detected based on the device features. Through this application, black market devices (i.e., devices to be analyzed) screened by the device fingerprint scoring model can be further analyzed, thereby analyzing the device features of black market devices. Furthermore, the device features can be used to identify black market devices among the devices to be detected. Since device features are difficult to change, even if black market operators forge new device fingerprints, black market devices can still be accurately identified, thereby improving the accuracy of identifying black market devices.

[0154] Based on the same technical concept, embodiments of this application also provide an electronic device, such as... Figure 4 As shown, it includes a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0155] Memory 113 is used to store computer programs;

[0156] When processor 111 executes a program stored in memory 113, it performs the following steps:

[0157] Obtain the sample device data corresponding to each sample device in the sample device set;

[0158] For each sample device, the sample device data corresponding to the sample device is input into a pre-trained device fingerprint scoring model so that the device fingerprint scoring model outputs the corresponding device score;

[0159] Based on the device scores, a set of devices to be analyzed is determined from the sample device set.

[0160] Based on the sample device data corresponding to each device in the set of devices to be analyzed, the corresponding device characteristics are determined.

[0161] The target device is identified among the devices to be tested based on the device characteristics described.

[0162] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0163] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0164] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0165] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0166] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described device identification methods.

[0167] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the device identification methods described above.

[0168] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0169] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0170] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A device identification method, characterized by, The method comprises: obtaining sample device data corresponding to each sample device in a sample device set; for each sample device, inputting the sample device data corresponding to the sample device into a pre-trained device fingerprint scoring model to enable the device fingerprint scoring model to output a corresponding device score; based on the device score, determining a set of devices to be analyzed in the sample device set; based on sample device data corresponding to each device to be analyzed in the set of devices to be analyzed, determining a corresponding device feature; based on the device feature, identifying a target device in a device to be detected; wherein the set of devices to be analyzed comprises at least one subset of devices to be analyzed, wherein the device score corresponding to each device to be analyzed in the subset of devices to be analyzed is the same; the determination of the device feature based on the sample device data corresponding to each device to be analyzed in the set of devices to be analyzed comprises: for each subset of devices to be analyzed, determining a set of feature values based on the sample device data corresponding to each device to be analyzed in the subset of devices to be analyzed; determining at least one candidate feature value in the set of feature values, and the number of occurrences of each candidate feature value in the set of feature values; based on the number of occurrences corresponding to each candidate feature value, determining a target feature value in at least one of the candidate feature values; determining the device feature in the target feature value.

2. The method of claim 1, wherein, the determination of the set of devices to be analyzed based on the device score in the sample device set comprises: determining sample devices in the sample device set that have a device score meeting a preset condition as devices to be analyzed, and constructing the set of devices to be analyzed based on all the devices to be analyzed; wherein the preset condition is that the device score is greater than a preset score threshold, and the number of occurrences of the device score in all device scores exceeds a preset number threshold.

3. The method of claim 1, wherein, the determination of the set of devices to be analyzed based on the device score in the sample device set comprises: determining sample devices in the sample device set that have a device score greater than a preset score threshold as devices to be analyzed; constructing the set of devices to be analyzed based on all the devices to be analyzed.

4. The method of claim 1, wherein, the determination of the target feature value based on the number of occurrences corresponding to each candidate feature value comprises: sorting at least one of the candidate feature values in descending order of corresponding number of occurrences, and determining a preset number of candidate feature values at the front of the sorting as the target feature value.

5. The method of claim 1, wherein, the determination of the device feature in the target feature value comprises: for each target feature value, matching a target test device meeting the target feature value in a test device set, determining a device label corresponding to the target test device, and determining a matching accuracy corresponding to the target feature value based on the device label; determining a target feature value corresponding to a matching accuracy higher than a preset accuracy threshold as the device feature.

6. The method of claim 1, wherein, the device feature comprises at least one dimension feature in a dimension, and after the identification of the target device in the device to be detected based on the device feature, the method further comprises: In at least one dimension feature, a target dimension feature corresponding to the target device is determined; Based on the target dimension feature, evaluation information of the target device is generated.

7. An apparatus identification device, characterized by The device comprises: An acquisition module configured to acquire sample device data corresponding to each sample device in a sample device set; An input module configured to, for each sample device, input the sample device data corresponding to the sample device into a pre-trained device fingerprint scoring model, so that the device fingerprint scoring model outputs a corresponding device score; A first determination module configured to determine, based on the device score, a set of devices to be analyzed in the sample device set; A second determination module configured to determine, based on sample device data corresponding to each device to be analyzed in the set of devices to be analyzed, a device feature corresponding thereto; An identification module configured to identify, based on the device feature, a target device in a device to be detected; The set of devices to be analyzed comprises at least one set of devices to be analyzed, wherein the device score corresponding to each device to be analyzed in the set of devices to be analyzed is the same; The second determination module is specifically configured to: For each set of devices to be analyzed, determine, based on sample device data corresponding to each device to be analyzed in the set of devices to be analyzed, a set of feature values; Determine, in the set of feature values, at least one candidate feature value and the number of occurrences of each candidate feature value in the set of feature values; Determine, based on the number of occurrences corresponding to each candidate feature value, a target feature value in the at least one candidate feature value; Determine the device feature in the target feature value.

8. An electronic device, comprising: The device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is configured to store a computer program; The processor is configured to execute the program stored in the memory, and implement the method steps of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps of any one of claims 1-6. The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps of any one of claims 1-6.

Images