Abnormal behavior detection method, apparatus, device, medium, and program product

Abstract

The application discloses an abnormal behavior detection method, device, equipment, medium and program product, and relates to the technical field of blockchains. The abnormal behavior detection method is applied to an electronic device, the electronic device is provided with a target tracking device, the target tracking device comprises a first blockchain node, and the method comprises the following steps: acquiring first current position information of the target tracking device and first current device identifier information corresponding to the target tracking device; acquiring target position information of the target tracking device and target device identifier information of the electronic device from first block records of the first blockchain node; and determining whether the electronic device has abnormal behavior according to the first current position information, the target position information, the first current device identifier information and the target device identifier information. According to the embodiment of the application, the detection cost can be saved.

Description

Technical Field

[0001] This application belongs to the field of blockchain technology, and in particular relates to an abnormal behavior detection method, device, equipment, medium and program product. Background Technology

[0002] With the continuous maturation of IoT technology, IoT-based positioning technology is also widely used in various scenarios for detecting abnormal behavior of mobile electronic devices.

[0003] In related technologies, after the device under inspection enters the communication range of the location-trusted device, the location-trusted device receives the location information reported by the connected device under inspection. The location-trusted device records its own location information and the location information reported by the device under inspection into its location chain database on the blockchain. The location chain databases of each location-trusted device are monitored in real time in the blockchain. If different location chain databases record the location information of the same device under inspection within a preset time period, it is determined whether the distance between the location-trusted devices corresponding to the different location chain databases is greater than the estimated movement distance of the device under inspection within the preset time period. If so, it is determined that the device under inspection has abnormal behavior.

[0004] It is evident that the relevant technologies that use inspection equipment to compare the location information of the equipment under inspection in the location chain database require additional manual operation of the inspection equipment, resulting in high inspection costs. Summary of the Invention

[0005] This application provides an abnormal behavior detection method, apparatus, equipment, medium, and program product that can save detection costs.

[0006] In a first aspect, embodiments of this application provide an abnormal behavior detection method applied to an electronic device, wherein the electronic device is equipped with a target tracking device, the target tracking device including a first blockchain node, and the method includes:

[0007] Obtain the first current location information of the target tracking device, and the first current device identification information corresponding to the target tracking device;

[0008] Obtain the target location information of the target tracking device and the target device identification information of the electronic device from the first block record of the first blockchain node;

[0009] Based on the first current location information, the target location information, the first current device identification information, and the target device identification information, determine whether the electronic device exhibits abnormal behavior.

[0010] In some optional embodiments of the first aspect, determining whether the electronic device exhibits abnormal behavior based on the first current location information, the target location information, the first current device identification information, and the target device identification information includes:

[0011] If the first current location information is consistent with the target location information, and the first current device identification information is consistent with the target device identification information, it is determined that the electronic device does not exhibit any abnormal behavior.

[0012] If the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, it is determined that the electronic device is exhibiting abnormal behavior.

[0013] In some alternative embodiments of the first aspect, the first block record further includes a polling status flag, the initial value of which is a first preset value; the method further includes:

[0014] If the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, the value of the polling status flag will be switched to the second preset value to obtain the updated first block record. The first preset value is different from the second preset value.

[0015] The server synchronizes the updated first block record with the second block record of the second blockchain node in the server, and the server connects to the electronic device.

[0016] In some alternative embodiments of the first aspect, after determining that the electronic device does not exhibit abnormal behavior, the method further includes:

[0017] In response to a user's operation of rebinding the device identifier based on the electronic device, an initialization request is sent to the server, so that the server can send an initialization instruction to the electronic device upon receiving the initialization request;

[0018] In response to the initialization command sent by the server, the target tracking device is initialized.

[0019] In some alternative embodiments of the first aspect, before obtaining the target location information of the target tracking device and the target device identification information corresponding to the target tracking device from the first block record of the first blockchain node, the method further includes:

[0020] Obtain the second current location information of the target tracking device, and the second current device identification information corresponding to the target tracking device;

[0021] The second current location information is determined as the target location information, and the second current device identification information is determined as the target device identification information;

[0022] Based on the target location information and target device identification information, a first block record is generated and stored in the first blockchain node.

[0023] In some alternative implementations of the first aspect, after storing the first block record to the first blockchain node, the method further includes:

[0024] The first block record is synchronized to the second block record of the second blockchain node in the server, and the server is connected to the electronic device.

[0025] Secondly, embodiments of this application provide an abnormal behavior detection method, applied to a server, the server including a second blockchain node, the method comprising:

[0026] Retrieve the second block record stored in the second blockchain node;

[0027] The second block record whose polling status flag value is the second preset value is determined as the target block record;

[0028] Based on the first device identification information and the first location information in the target block record, determine the type of abnormal behavior of the electronic device.

[0029] In some optional implementations of the second aspect, the type of abnormal behavior of the electronic device is determined based on the first device identification information and the first location information in the target block record, including:

[0030] If the first device identification information in the target block record is inconsistent with the target device identification information, but the first location information is consistent with the target location information, the abnormal behavior type of the electronic device is determined to be device location forgery abnormal behavior.

[0031] If the first device identification information in the target block record is inconsistent with the target device identification information, and the first location information is inconsistent with the target location information, the abnormal behavior type of the electronic device is determined to be abnormal device removal behavior.

[0032] In some alternative embodiments of the second aspect, after determining that the abnormal behavior type of the electronic device is a device location spoofing abnormal behavior, the method further includes:

[0033] Output a device location spoofing exception message. The device location spoofing exception message is used to indicate that the electronic device has a device location spoofing exception.

[0034] Alternatively, after determining that the abnormal behavior of the electronic device is an abnormal device removal behavior, the method may also include:

[0035] The movement trajectory of the electronic device is determined based on the first location information recorded in the target block.

[0036] In some alternative implementations of the second aspect, the method further includes:

[0037] Upon receiving an initialization request, an initialization command is sent to the electronic device so that the electronic device responds to the initialization command sent by the server and initializes the target tracking device.

[0038] Thirdly, embodiments of this application provide an abnormal behavior detection device applied to an electronic device. The electronic device includes a target tracking device, which includes a first blockchain node. The abnormal behavior detection device includes:

[0039] The first acquisition module is used to acquire the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device;

[0040] The second acquisition module is used to acquire the target location information of the target tracking device and the target device identification information of the electronic device from the first block record of the first blockchain node;

[0041] The first determining module is used to determine whether the electronic device exhibits abnormal behavior based on the first current location information, the target location information, the first current device identification information, and the target device identification information.

[0042] Fourthly, embodiments of this application provide an abnormal behavior detection device applied to a server, the server including a second blockchain node, and the abnormal behavior detection device including:

[0043] The third acquisition module is used to acquire the second block record stored in the second blockchain node;

[0044] The second determining module is used to determine the second block record whose polling status flag value is a second preset value as the target block record;

[0045] The third determination module is used to determine the type of abnormal behavior of the electronic device based on the first device identification information and the first location information in the target block record.

[0046] Fifthly, embodiments of this application provide an electronic device, the device comprising:

[0047] Processor and memory storing computer program instructions;

[0048] The processor implements the abnormal behavior detection method as described in the first aspect when executing computer program instructions.

[0049] Sixthly, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the abnormal behavior detection method as described in the first or second aspect.

[0050] In a seventh aspect, embodiments of this application provide a computer program product in which, when the instructions in the computer program product are executed by the processor of an electronic device, the electronic device performs an abnormal behavior detection method as described in the first or second aspect.

[0051] According to the abnormal behavior detection method, apparatus, device, medium, and program product provided in the embodiments of this application, the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device are first obtained; then, the target location information of the target tracking device and the target device identification information of the electronic device are obtained from the first block record of the first blockchain node; and finally, based on the first current location information, target location information, first current device identification information, and target device identification information, it is determined whether the electronic device exhibits abnormal behavior. In other words, the embodiments of this application automatically poll the target tracking device in the electronic device against the target device identification information embedded in the electronic device, eliminating the need for mobile inspections, saving costs, time, and effort, and making the process more automated and convenient. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This paper shows a schematic diagram of an abnormal behavior detection system provided in an embodiment of this application.

[0054] Figure 2 This illustration shows a schematic diagram of an electronic device in the abnormal behavior detection method provided in an embodiment of this application;

[0055] Figure 3 This illustration shows a schematic diagram of an electronic device in the abnormal behavior detection method provided in an embodiment of this application;

[0056] Figure 4 This paper illustrates a flowchart of an abnormal behavior detection method provided in an embodiment of this application.

[0057] Figure 5 This paper illustrates another flowchart of the abnormal behavior detection method provided in an embodiment of this application;

[0058] Figure 6This paper shows a schematic diagram of an abnormal behavior detection device provided in an embodiment of this application.

[0059] Figure 7 This paper shows another structural schematic diagram of the abnormal behavior detection device provided in an embodiment of this application;

[0060] Figure 8 A schematic diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0061] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0062] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0063] Before describing the technical solutions provided in the embodiments of this application, in order to facilitate the understanding of the embodiments of this application, this application will first give a detailed description of the system architecture involved in this application.

[0064] like Figure 1 As shown, the abnormal behavior detection system may include at least one electronic device 10 and a server 20. For example... Figure 1 and Figure 2As shown, the electronic device 10 may be equipped with a target tracking device 11, which may include at least one first blockchain node 111, and the server 20 may include a second blockchain node 21. In some examples, the first blockchain node 111 may communicate with the second blockchain node 21 through a blockchain network to achieve anti-counterfeiting and anti-tampering functions. Exemplarily, the server 20 may include a cloud server.

[0065] For example, the target tracking device 11 can be powered by an independent battery or by drawing power from an electronic device, and can be installed in a concealed location on the electronic device.

[0066] For example, the first blockchain node 111 can be used to generate, store and report the first block record, which includes data such as abnormal position movement record of electronic device 10, device identification information failure record and device identification information replacement record.

[0067] For example, the second blockchain node 21 can be used to provide a data source for front-end functions such as location tracking and anomaly alarms of the electronic device 10.

[0068] For example, the blockchain network can be a logical blockchain node network composed of at least one first blockchain node 111 and at least one second blockchain node 21 in at least one target tracking device 11 through a P2P protocol. After the target tracking device 11 is recorded on the blockchain by at least one first blockchain node 111, the entire network is synchronized through the blockchain network.

[0069] In some examples, such as Figure 2 As shown, the electronic device 10 may also include target device identification information 10a. For example, the target device identification information may include a Near Field Communication (NFC) identifier. The target device identification information may be integrated into a non-removable component of the electronic device, serving as a unique identifier throughout the entire lifecycle of the electronic device. It possesses a unique, indelible, anti-counterfeiting serial number and uniquely binds the target tracking device 11 to the electronic device.

[0070] Understandably, the NFC reading sensor of the near-field communication module in the target tracking device 11 maintains a readable distance from the location of the target device identification information of the electronic device.

[0071] In some examples, such as Figure 3 As shown, the target tracking device 11 may include a central control module 11a, a blockchain module 11b, a mobile data communication module 11c, a near-field communication module 11d, and a positioning module 11e. Wherein:

[0072] The central control module 11a can be connected to the blockchain module 11b, the mobile data communication module 11c, the near-field communication module 11d, and the positioning module 11e, and can be used for data scheduling and function control of each module.

[0073] The blockchain module 11b can be used to receive location information and device identification information obtained by the central control module 11a from the positioning module 11e and the near-field communication module 11d, generate the first block record, and synchronize the first block record in the blockchain node network through the mobile data communication module 11c.

[0074] The mobile data communication module 11c can be used to provide network data connection function for the target tracking device 11, access the server, and synchronize the second block record with the first block record in the server.

[0075] In some examples, the block record may include at least one of the following: tracking device identification information, device identification information, location information, the value of a polling status flag, and a timestamp. The tracking device identification information may be a unique identifier for the tracking device, embedded in unalterable firmware within the tracking device, and cannot be tampered with. The device identification information may be a unique identifier for an electronic device, integrated within the electronic device, and cannot be erased or rewritten. The location information may include the latitude and longitude information of the tracking device. The value of the polling status flag can be used to indicate whether the location information and / or device identification information has changed. For example, if the value of the polling status flag is a first preset value, it indicates that the location information and / or device identification information has changed; if the value of the polling status flag is a second preset value, it indicates that the location information and / or device identification information has changed. The timestamp may be generated when the value of the polling status flag is the second preset value.

[0076] For example, the first block record and / or the second block record may include target tracking device identification information, target device identification information, target location information, a first preset value, and a timestamp. The updated first block record and / or the updated second block record may include target tracking device identification information, a first current device identification information, a first current location information, a second preset value, and an updated timestamp.

[0077] The near-field communication module 11d can be a module that integrates a near-field communication technology reading sensor, maintains a readable distance with the target device identification information integrated on the electronic device 10, and acquires the target device identification information and reports it to the central control module 11a.

[0078] The positioning module 11e may be a module that integrates the Global Positioning System (GPS) or BeiDou and mobile network positioning functions. It can be used to obtain the location information of the target tracking device 11 in the electronic device and report the location information to the central control module 11a.

[0079] To address the issue of high detection costs in related technologies, embodiments of this application provide an abnormal behavior detection method, apparatus, device, medium, and program product. The abnormal behavior detection method provided in this application embodiment will be described first below.

[0080] Figure 4 A flowchart illustrating an abnormal behavior detection method provided in an embodiment of this application is shown.

[0081] The abnormal behavior detection method provided in this application can be applied to electronic devices. The executing entity of this abnormal behavior detection method can be an abnormal behavior detection device or an electronic device, etc. This application embodiment will be described with an electronic device as the executing entity. For example... Figure 4 As shown, the abnormal behavior detection method may include the following S410 to S430.

[0082] S410. Obtain the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device.

[0083] S420: Obtain the target location information of the target tracking device and the target device identification information of the electronic device from the first block record of the first blockchain node.

[0084] S430. Based on the first current location information, the target location information, the first current device identification information, and the target device identification information, determine whether the electronic device exhibits abnormal behavior.

[0085] According to the abnormal behavior detection method provided in this application embodiment, the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device are first obtained; then, the target location information of the target tracking device and the target device identification information of the electronic device are obtained from the first block record of the first blockchain node; and then, based on the first current location information, target location information, first current device identification information, and target device identification information, it is determined whether the electronic device exhibits abnormal behavior. In other words, this application embodiment automatically polls the target tracking device in the electronic device against the target device identification information embedded in the electronic device, eliminating the need for mobile inspections, saving costs, time, and effort, and making it more automated and convenient.

[0086] The specific implementation methods for each of the above steps are described below.

[0087] In S410, the first current location information may include the current location information of the target tracking device at a first moment. For example, the first current location information may include the first current latitude and longitude.

[0088] The first current device identification information may include the device identification information of the electronic device obtained by the target tracking device through the near-field communication module at the first moment. For example, the first current device identification information may be the serial number of the electronic device obtained by the target tracking device through the near-field communication module at the first moment.

[0089] For example, an electronic device can obtain first current location information and first current device identification information corresponding to the target tracking device through the near-field communication module in the target tracking device.

[0090] In some examples, the first current location information of the target tracking device and the first current device identifier information corresponding to the target tracking device can be obtained at preset intervals. The preset interval can be set according to the actual situation and is not limited here. For example, the preset interval can be 60 seconds, 1 hour, etc.

[0091] In S420, after obtaining the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device, the electronic device can also obtain the target location information of the target tracking device and the target device identification information of the electronic device from the first block record of the first blockchain node.

[0092] The target location information can be the theoretical location of the target tracking device.

[0093] The target device identification information can be the device identification information of an electronic device that is uniquely bound to the target tracking device.

[0094] For example, the first blockchain node stores a first block record, which includes target location information of the target tracking device and target device identification information of the electronic device.

[0095] In some implementations, before obtaining the target location information of the target tracking device and the target device identification information corresponding to the target tracking device from the first block record of the first blockchain node, the method further includes:

[0096] Obtain the second current location information of the target tracking device, and the second current device identification information corresponding to the target tracking device;

[0097] The second current location information is determined as the target location information, and the second current device identification information is determined as the target device identification information;

[0098] Based on the target location information and target device identification information, a first block record is generated and stored in the first blockchain node.

[0099] In this embodiment, a first block record is generated based on the target location information and the target device identification information, and the first block record is stored in the first blockchain node. This provides a foundation for subsequently retrieving the target location information of the target tracking device and the corresponding target device identification information from the first block record. Furthermore, storing the first block record in the first blockchain node prevents the target location information and target device identification information from being tampered with.

[0100] For example, target location information can be obtained through the positioning module of the target tracking device, and target device identification information can be obtained through the near-field communication module of the target tracking device.

[0101] In some examples, before obtaining the second current location information of the target tracking device and the second current device identifier information corresponding to the target tracking device, the method may further include:

[0102] Activate the target tracking device;

[0103] Initialize the target tracking device.

[0104] For example, initializing the target tracking device may include: clearing all data in the erasable and rewritable memory of the target tracking device, and resetting the parameters of all sensors of the template tracking device.

[0105] In some implementations, after storing the first block record to the first blockchain node, the method further includes:

[0106] The first block record is synchronized to the second block record of the second blockchain node in the server, and the server is connected to the electronic device.

[0107] In this embodiment, by synchronizing the first block record with the second block record of the second blockchain node in the server, the second block record of the second blockchain node is made identical to the first block record of the first blockchain node. This provides a basis for the server to determine the type of abnormal behavior of the electronic device based on the second block record. Furthermore, by storing the first block record in the first blockchain node and synchronizing the first block record with the second block record of the second blockchain node in the server, tampering with the target location information and target device identification information can be prevented.

[0108] For example, an electronic device can synchronize a first block record with the second block record of all second blockchain nodes in all servers via a blockchain network.

[0109] In S430, after the electronic device obtains the target location information of the target tracking device and the target device identification information of the electronic device from the first block record of the first blockchain node, it can also determine whether the electronic device has abnormal behavior based on the first current location information, the target location information, the first current device identification information and the target device identification information.

[0110] In some implementations, determining whether an electronic device exhibits abnormal behavior based on the first current location information, the target location information, the first current device identification information, and the target device identification information may include:

[0111] If the first current location information is consistent with the target location information, and the first current device identification information is consistent with the target device identification information, it is determined that the electronic device does not exhibit any abnormal behavior.

[0112] If the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, it is determined that the electronic device is exhibiting abnormal behavior.

[0113] In this embodiment, by comparing the first current location information with the target location information and by comparing the first current device identification information with the target device identification information, it is possible to quickly and accurately determine whether the electronic device has abnormal behavior.

[0114] If the first current location information matches the target location information, or if the distance difference between the first current location information and the target location information is within a preset distance difference range, the position of the target tracking device can be considered unchanged. If the first current location information does not match the target location information, or if the distance difference between the first current location information and the target location information is not within the preset distance difference range, the position of the target tracking device can be considered changed. The preset distance difference range can be set according to actual conditions and is not limited here. For example, the preset distance difference range can be 0.01 meters, etc.

[0115] If the first current device identification information is consistent with the target device identification information, it can mean that the first current device identification information and the target device identification information are the same; if the first current device identification information and the target device identification information are inconsistent, it can mean that the first current device identification information and the target device identification information are different.

[0116] In some implementations, the first block record further includes a polling status flag, the initial value of which is a first preset value; the method further includes:

[0117] If the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, the value of the polling status flag will be switched to the second preset value to obtain the updated first block record. The first preset value is different from the second preset value.

[0118] The server synchronizes the updated first block record with the second block record of the second blockchain node in the server, and the server connects to the electronic device.

[0119] In this embodiment, a polling status flag is set, and when the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, the value of the polling status flag is switched to a second preset value. This provides a basis for subsequently determining the target blockchain based on the value of the polling status flag, and thus determining the type of abnormal behavior of the electronic device. Furthermore, by setting the polling status flag, it is possible for the server to output an abnormal prompt message when it determines that the electronic device is exhibiting abnormal behavior based on the polling status flag.

[0120] The first and second preset values ​​can be set according to the actual situation and are not limited here. For example, the first preset value can be 0 and the second preset value can be 1.

[0121] Understandably, the updated first block record has a different value for the polling status flag compared to the first block record.

[0122] In some examples, after obtaining the updated first block record, the timestamp of the generated updated first block record can also be recorded and added to the updated first block record.

[0123] In some examples, after the timestamp is recorded in the updated first block record, S410 to S430 can be repeated every preset time interval.

[0124] In some implementations, after determining that the electronic device does not exhibit abnormal behavior, the method further includes:

[0125] In response to a user's operation of rebinding the device identifier based on the electronic device, an initialization request is sent to the server, so that the server can send an initialization instruction to the electronic device upon receiving the initialization request;

[0126] In response to the initialization command sent by the server, the target tracking device is initialized.

[0127] In this embodiment, in response to the user's operation of rebinding the device identifier based on the electronic device, an initialization request is sent to the server. Upon receiving the initialization request, the server sends an initialization command to the electronic device. Then, in response to the initialization command sent by the server, the target tracking device is initialized so that the target tracking device can be rebinded to the target device identifier information of other electronic devices. This enables the reusability of the target tracking device within the electronic device, thereby reducing the cost of use.

[0128] For example, rebinding a device identity can be done by clicking, swiping, or dragging the rebinding device identity option displayed on the electronic device.

[0129] An initialization request may include a request to instruct an electronic device to send an initialization command.

[0130] Initialization instructions may include instructions for instructing the target tracking device to initialize.

[0131] For example, a user sends an initialization request to the server-side application management program based on the operation of rebinding the device identifier of the target tracking device in the electronic device. Upon receiving the initialization request, the server-side application management program sends an initialization command to the electronic device. In response to the initialization command sent by the server, the electronic device clears all data in the erasable and writable memory of the target tracking device and resets the parameters of all sensors of the template tracking device to complete the initialization of the target tracking device.

[0132] To better understand the abnormal behavior detection method provided in the embodiments of this application, a specific application scenario is described below.

[0133] The abnormal behavior detection method provided in this application embodiment may include:

[0134] S1. The device location tracking device (i.e., the target tracking device) is started and initialized;

[0135] After device A (i.e., electronic device) is powered on, the device position tracking device starts and initializes the device, clears all data in the device's erasable and writable memory, and resets the parameters of all sensors in the device.

[0136] S2. Read the device tag ID (i.e., target device identification information) and locate the current coordinates (i.e., target location information).

[0137] The device location tracking device of device A obtains the serial number of the device-side tag (i.e., target device identification information) through the near-field communication module and obtains the current location information (i.e. target location information) through the positioning module.

[0138] S3. Generate a record (i.e., the first block record) and include it in this block (i.e., the first blockchain node);

[0139] The blockchain module will generate block records and include the obtained module ID (i.e., target tracking device identification information), device side ID, current coordinates (i.e. target location information), polling status (i.e., polling status flag bit) (initial value is 0, i.e., the initial value is the first preset value) and timestamp in the local block.

[0140] S4. Synchronize local blocks to the full node (i.e., the second blockchain node);

[0141] The device location tracking device synchronizes block data with the full node of the blockchain network on the cloud server (i.e., the server) through the mobile data communication module.

[0142] S5. Poll the tag ID (first current device identification information) and current coordinates (i.e., first current location information);

[0143] The central control module drives the near-field communication module and the positioning module to obtain the current location information and the serial number of the device tag at a certain time period (such as 60 seconds).

[0144] S6. Detect abnormal changes in tag ID;

[0145] If the tag ID is the same as the previous polling result, proceed to S7. If the polling result is different, proceed to S3. At this time, the current coordinates in the record use the location data obtained during the previous polling, which proves that the location tracking module has been disassembled or replaced or the device tag has been damaged. At this time, an alarm can be generated on the cloud server.

[0146] S7. Detect abnormal changes in location;

[0147] If the current coordinates are the same as the previous polling result, proceed to S8. If the polling result is different, proceed to S3. At this time, it is proven that the device has moved. The coordinate data of the record with the polling status flag bit set to 1 (i.e. the second preset value) can be extracted from the full node record on the cloud server and reproduced on the GIS to show the movement status of the device.

[0148] S8. Does the device need to be re-attached to the device tag?

[0149] If the device location tracking module performs an operation to rebind the device tag (i.e., rebind the device identifier), the application management program on the cloud server will issue an instruction (i.e., an initialization instruction) to initialize the device location tracking module (S9), and then execute this process again with S1 as the entry point. If no rebinding is performed, the device tag and location coordinates will be polled from S2 for real-time monitoring.

[0150] S9. The device tracking device is reinitialized.

[0151] In this embodiment, S9 is equivalent to S1 in the next cycle.

[0152] Based on the same inventive concept as the abnormal behavior detection method provided in the above embodiments, this application also provides another abnormal behavior detection method. The above abnormal behavior detection method will be described in detail below.

[0153] The abnormal behavior detection method provided in this application can be applied to a server. The executing entity of this method can be an abnormal behavior detection device or a server. The server includes a second blockchain node. This application embodiment describes the method using the server as the executing entity. Figure 5 As shown, the abnormal behavior detection method may include the following S510 to S530.

[0154] S510: Obtain the second block record stored in the second blockchain node.

[0155] S520. The second block record whose polling status flag value is the second preset value is determined as the target block record.

[0156] S530. Determine the type of abnormal behavior of the electronic device based on the first device identification information and the first location information in the target block record.

[0157] According to the abnormal behavior detection method provided in this application embodiment, the second block record stored in the second blockchain node is first obtained. Then, the second block record with a polling status flag value of a second preset value is determined as the target block record. Next, the abnormal behavior type of the electronic device is determined based on the first device identification information and the first location information in the target block record. In other words, this application embodiment automatically polls the target device using a target tracking device in the electronic device and the target device identification information embedded in the electronic device, eliminating the need for mobile inspections, saving costs, time, and effort, and making it more automated and convenient. Furthermore, by comprehensively considering the first device identification information and the first location information in the target block record, the abnormal behavior type of the electronic device can be accurately determined.

[0158] The specific implementation methods for each of the above steps are described below.

[0159] In S510, the second blockchain node on the server stores the second block record, and the server can directly read the second block record from the second blockchain node.

[0160] As an example, the second block record may include the value of the polling status flag, the first current device identification information, and the first current location information.

[0161] As another example, the second block record may include the value of the polling status flag, target device identification information, and target location information.

[0162] For example, the server-side application retrieves a second blockchain record from a second blockchain node.

[0163] In S520, after the server obtains the second block record stored in the second blockchain node, it can also identify the second block record with the value of the polling status flag bit as the target block record.

[0164] When the second block record may include the value of the polling status flag, the first current device identifier information, and the first current location information, after determining the second block record with the value of the polling status flag as the second preset value as the target block record, the first current device identifier information in the second block record with the value of the polling status flag as the second preset value is determined as the first device identifier information, and the first current location information in the second block record with the value of the polling status flag as the second preset value is determined as the first location information.

[0165] In S530, after the server identifies the second block record with the value of the polling status flag bit as the target block record, it can also determine the abnormal behavior type of the electronic device based on the first device identification information and the first location information in the target block record.

[0166] Abnormal behaviors of electronic devices include device location spoofing and device removal.

[0167] In some implementations, determining the type of abnormal behavior of the electronic device based on the first device identification information and the first location information in the target block record may include:

[0168] If the first device identification information in the target block record is inconsistent with the target device identification information, but the first location information is consistent with the target location information, the abnormal behavior type of the electronic device is determined to be device location forgery abnormal behavior.

[0169] If the first device identification information in the target block record is inconsistent with the target device identification information, and the first location information is inconsistent with the target location information, the abnormal behavior type of the electronic device is determined to be abnormal device removal behavior.

[0170] In this embodiment, when the first device identification information in the target block record is inconsistent with the target device identification information, the abnormal behavior type of the electronic device can be quickly and accurately determined by comparing the first location information with the target location information.

[0171] If the identification information of the first device is consistent with the identification information of the target device, it can mean that the identification information of the first device is the same as the identification information of the target device; if the identification information of the first device is inconsistent with the identification information of the target device, it can mean that the identification information of the first device is different from the identification information of the target device.

[0172] If the first location information is consistent with the target location information, it can be assumed that the distance difference between the first location information and the target location information is within the preset distance difference range, and the position of the target tracking device has not changed; if the first location information is inconsistent with the target location information, it can be assumed that the distance difference between the first location information and the target location information is not within the preset distance difference range, and the position of the target tracking device has changed.

[0173] In some implementations, after determining that the abnormal behavior of the electronic device is a device location spoofing abnormal behavior, the method further includes:

[0174] Output a device location spoofing exception message. The device location spoofing exception message is used to indicate that the electronic device has a device location spoofing exception.

[0175] Alternatively, after determining that the abnormal behavior of the electronic device is an abnormal device removal behavior, the method may also include:

[0176] The movement trajectory of the electronic device is determined based on the first location information recorded in the target block.

[0177] In this embodiment, on the one hand, by outputting a device location spoofing anomaly prompt message, the user can be promptly reminded that the electronic device has a device location spoofing anomaly, thereby providing the user with the possibility of timely handling of the device location spoofing anomaly; on the other hand, by using the first location information in the target block record, the movement trajectory of the electronic device can be determined, thereby enabling the tracking of the electronic device's location information.

[0178] For example, the device location spoofing anomaly prompt message may include: "Device location spoofing anomaly, please handle it in time", etc., and the device location spoofing anomaly prompt message can be output through voice broadcast, text display, etc.

[0179] It should be noted that, in this embodiment, the movement trajectory of the target tracking device is equivalent to the movement trajectory of the electronic device.

[0180] Understandably, when there is only one target block record, the movement trajectory of the electronic device can be a trajectory that starts from the target location information and ends at the first location information; when there are at least two target block records, the movement trajectory of the electronic device can be determined based on the target location information and the first location information that corresponds one-to-one with each target block record.

[0181] For example, if the target location information is A1, the number of target block records is two, and the first location information corresponding to each target block record is B1 and C1 respectively, then the movement trajectory of the electronic device can be A1-B1-C1.

[0182] In some implementations, the method further includes:

[0183] Upon receiving an initialization request, an initialization command is sent to the electronic device so that the electronic device responds to the initialization command sent by the server and initializes the target tracking device.

[0184] In this embodiment, when the server receives an initialization request, it sends an initialization command to the electronic device. The electronic device can then respond to the initialization command sent by the server to initialize the target tracking device, so that the target tracking device can be re-bound to the target device identification information of other electronic devices. This enables the reusability of the target tracking device within the electronic device, thereby reducing the cost of use.

[0185] To better understand the abnormal behavior detection method provided in the embodiments of this application, a specific application scenario is described below.

[0186] The abnormal behavior detection method provided in this application includes:

[0187] S11. The cloud server (i.e., the server) checks the position record in the synchronization block record (i.e., the second block record);

[0188] The cloud server application checks the block records in the cloud blockchain node (i.e., the second blockchain node).

[0189] S12. Detect abnormal changes in the tag ID (i.e., device ID) in the detection record.

[0190] When the polling status field (i.e., the value of the polling status flag) in the block record is 1 (i.e., the second preset value) and the tag ID (i.e., the first device identification information) changes abnormally, the location information (i.e., the first location information) in the record is checked to see if it has changed. If the tag ID has not changed, the process proceeds to S1 for the next cycle of detection.

[0191] S13. Detect positional changes in the detection record;

[0192] If the location of the device in the record has not changed, the suspected device has been separated from the equipment, and an alarm for suspected device location spoofing is issued (i.e., an abnormal device location spoofing prompt message is output).

[0193] S14. The device (i.e., the target tracking device) is removed and moved;

[0194] If the location of the device in the record has changed, it proves that the device has been removed and is in a moving state, requiring further processing.

[0195] In this embodiment, location information needs to be further detected and an alarm or processing is required only when the tag ID is abnormal. When the tag ID is not abnormal, the movement trajectory of the device is the same as the movement trajectory of the equipment (i.e., electronic equipment), and can be processed according to other preset rules.

[0196] In this embodiment, on the one hand, a target tracking device polls the device identification information of an electronic device via near-field identification and reports abnormal movement data detected by the target tracking device to the server, storing the relevant movement records in the blockchain network to prevent the movement history from being tampered with. On the other hand, the target tracking device can be reused. When the electronic device is decommissioned or scrapped, the target tracking device can be removed and bound to the device identification information integrated into another electronic device. The server can judge the relevant behavior. If the behavior is approved, the block record generated by rebinding the device identification information in the subsequent block record is considered legitimate, thus realizing the reusability of the target tracking device of the electronic device and reducing the usage cost. Furthermore, this embodiment uses the target tracking device and the fixed identifier of the electronic device for automated polling, eliminating the need for mobile inspection, saving time and effort. At the same time, a polling status flag is added to the blockchain record, which can issue an alarm when the server detects an anomaly, making it more automated and convenient.

[0197] Based on the same inventive concept as the abnormal behavior detection method provided in the above embodiments, this application also provides an abnormal behavior detection device. The abnormal behavior detection device will be described in detail below.

[0198] Figure 6 This is a schematic diagram of an abnormal behavior detection device provided in an embodiment of this application.

[0199] like Figure 6 As shown in the embodiments of this application, the abnormal behavior detection device can be applied to electronic devices. The electronic devices are equipped with a target tracking device, which includes a first blockchain node. The abnormal behavior detection device includes:

[0200] The first acquisition module 610 is used to acquire the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device;

[0201] The second acquisition module 620 is used to acquire the target location information of the target tracking device and the target device identification information of the electronic device from the first block record of the first blockchain node;

[0202] The first determining module 630 is used to determine whether the electronic device has abnormal behavior based on the first current location information, the target location information, the first current device identification information, and the target device identification information.

[0203] According to the abnormal behavior detection device provided in this application embodiment, the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device are first obtained; then, the target location information of the target tracking device and the target device identification information of the electronic device are obtained from the first block record of the first blockchain node; and then, based on the first current location information, target location information, first current device identification information, and target device identification information, it is determined whether the electronic device exhibits abnormal behavior. In other words, this application embodiment automatically polls the target tracking device in the electronic device against the target device identification information embedded in the electronic device, eliminating the need for mobile inspections, saving costs, time, and effort, and making it more automated and convenient.

[0204] In some implementations, the first determining module 630 may be specifically used for:

[0205] If the first current location information is consistent with the target location information, and the first current device identification information is consistent with the target device identification information, it is determined that the electronic device does not exhibit any abnormal behavior.

[0206] If the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, it is determined that the electronic device is exhibiting abnormal behavior.

[0207] In some implementations, the first block record also includes a polling status flag, the initial value of which is a first preset value;

[0208] The abnormal behavior detection device may also include:

[0209] The switching module is used to switch the value of the polling status flag to a second preset value when the first current location information is inconsistent with the target location information and / or the first current device identification information is inconsistent with the target device identification information, so as to obtain the updated first block record. The first preset value is different from the second preset value.

[0210] The first synchronization module is used to synchronize the updated first block record to the second block record of the second blockchain node in the server. The server is connected to the electronic device.

[0211] In some embodiments, the abnormal behavior detection device may further include:

[0212] The first sending module is used to send an initialization request to the server in response to the user's operation of rebinding the device identifier based on the electronic device, so that the server can send an initialization command to the electronic device upon receiving the initialization request;

[0213] The first initialization module is used to initialize the target tracking device in response to the initialization command sent by the server.

[0214] In some embodiments, the abnormal behavior detection device may further include:

[0215] The fourth acquisition module is used to acquire the second current location information of the target tracking device and the second current device identification information corresponding to the target tracking device;

[0216] The fourth determining module is used to determine the second current location information as the target location information and to determine the second current device identification information as the target device identification information;

[0217] The generation module is used to generate the first block record based on the target location information and the target device identification information, and store the first block record to the first blockchain node.

[0218] In some embodiments, the abnormal behavior detection device may further include:

[0219] The second synchronization module is used to synchronize the first block record to the second block record of the second blockchain node in the server. The server is connected to the electronic device.

[0220] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation and the beneficial effects have been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0221] Based on the same inventive concept as the abnormal behavior detection method provided in the above embodiments, this application also provides an abnormal behavior detection device. The abnormal behavior detection device will be described in detail below.

[0222] Figure 7 This is a schematic diagram of an abnormal behavior detection device provided in an embodiment of this application.

[0223] like Figure 7 As shown in the embodiments of this application, the abnormal behavior detection device can be applied to a server, which includes a second blockchain node. The abnormal behavior detection device includes:

[0224] The third acquisition module 710 is used to acquire the second block record stored in the second blockchain node;

[0225] The second determining module 720 is used to determine the second block record whose polling status flag value is a second preset value as the target block record;

[0226] The third determination module 730 is used to determine the abnormal behavior type of the electronic device based on the first device identification information and the first location information in the target block record.

[0227] According to the abnormal behavior detection device provided in this application embodiment, the second block record stored in the second blockchain node is first obtained. Then, the second block record with a polling status flag value of a second preset value is determined as the target block record. Next, the abnormal behavior type of the electronic device is determined based on the first device identification information and the first location information in the target block record. In other words, this application embodiment automatically polls the target device using a target tracking device in the electronic device and the target device identification information embedded in the electronic device, eliminating the need for mobile inspections, saving costs, time, and effort, and making it more automated and convenient. Furthermore, by comprehensively considering the first device identification information and the first location information in the target block record, the abnormal behavior type of the electronic device can be accurately determined.

[0228] In some implementations, the third determining module 730 may be specifically used for:

[0229] If the first device identification information in the target block record is inconsistent with the target device identification information, but the first location information is consistent with the target location information, the abnormal behavior type of the electronic device is determined to be device location forgery abnormal behavior.

[0230] If the first device identification information in the target block record is inconsistent with the target device identification information, and the first location information is inconsistent with the target location information, the abnormal behavior type of the electronic device is determined to be abnormal device removal behavior.

[0231] In some embodiments, the abnormal behavior detection device may further include:

[0232] The output module is used to output a device location spoofing anomaly prompt message, which is used to indicate that the electronic device has a device location spoofing anomaly.

[0233] Alternatively, the fifth determining module is used to determine the movement trajectory of the electronic device based on the first location information recorded in the target block.

[0234] In some embodiments, the abnormal behavior detection device may further include:

[0235] The second sending module is used to send an initialization command to the electronic device upon receiving an initialization request, so that the electronic device responds to the initialization command sent by the server and initializes the target tracking device.

[0236] Based on the abnormal behavior detection method and device provided in the above embodiments, this application also provides an electronic device. The electronic device will be described in detail below.

[0237] Figure 8 A schematic diagram illustrating an embodiment of the electronic device provided in this application is shown.

[0238] An electronic device may include a processor 801 and a memory 802 storing computer program instructions.

[0239] Specifically, the processor 801 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0240] Memory 802 may include mass storage for data or instructions. For example, and not limitingly, memory 802 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 802 may include removable or non-removable (or fixed) media. Where appropriate, memory 802 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 802 is non-volatile solid-state memory.

[0241] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the methods according to one aspect of this disclosure.

[0242] The processor 801 reads and executes computer program instructions stored in the memory 802 to implement any of the abnormal behavior detection methods in the above embodiments.

[0243] In one example, the electronic device may also include a communication interface 803 and a bus 810. For example, Figure 8 As shown, the processor 801, memory 802, and communication interface 803 are connected through bus 810 and complete communication with each other.

[0244] The communication interface 803 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0245] Bus 810 includes hardware, software, or both, that couples components of an anomalous behavior detection device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 810 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0246] Furthermore, in conjunction with the abnormal behavior detection methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the abnormal behavior detection methods in the above embodiments.

[0247] Furthermore, in conjunction with the abnormal behavior detection methods in the above embodiments, this application embodiment can provide a computer program product, in which the instructions in the computer program product are executed by the processor of an electronic device, and the electronic device executes any of the abnormal behavior detection methods in the above embodiments.

[0248] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0249] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0250] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0251] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0252] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting abnormal behavior, characterized in that, Applied to an electronic device, the electronic device being equipped with a target tracking device, the target tracking device including a first blockchain node, the method includes: Obtain the first current location information of the target tracking device, and the first current device identification information corresponding to the target tracking device; The target location information of the target tracking device and the target device identification information of the electronic device are obtained from the first block record of the first blockchain node. Based on the first current location information, the target location information, the first current device identification information, and the target device identification information, it is determined whether the electronic device exhibits abnormal behavior.

2. The method according to claim 1, characterized in that, The step of determining whether the electronic device exhibits abnormal behavior based on the first current location information, the target location information, the first current device identification information, and the target device identification information includes: If the first current location information is consistent with the target location information, and the first current device identification information is consistent with the target device identification information, it is determined that the electronic device does not have abnormal behavior. If the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, it is determined that the electronic device has abnormal behavior.

3. The method according to claim 2, characterized in that, The first block record also includes a polling status flag, the initial value of which is a first preset value; the method further includes: If the first current location information is inconsistent with the target location information, and / or the first current device identification information is inconsistent with the target device identification information, the value of the polling status flag is switched to the second preset value to obtain the updated first block record, wherein the first preset value is different from the second preset value; The updated first block record is synchronized to the second block record of the second blockchain node in the server, and the server is connected to the electronic device.

4. The method according to claim 2, characterized in that, After determining that the electronic device does not exhibit abnormal behavior, the method further includes: In response to a user's operation of rebinding the device identifier based on the electronic device, an initialization request is sent to the server, so that the server, upon receiving the initialization request, sends an initialization instruction to the electronic device; The target tracking device is initialized in response to the initialization command sent by the server.

5. The method according to claim 1, characterized in that, Before obtaining the target location information of the target tracking device and the target device identification information corresponding to the target tracking device from the first block record of the first blockchain node, the method further includes: Obtain the second current location information of the target tracking device, and the second current device identification information corresponding to the target tracking device; The second current location information is determined as the target location information, and the second current device identification information is determined as the target device identification information; Based on the target location information and the target device identification information, a first block record is generated and stored in the first blockchain node.

6. The method according to claim 5, characterized in that, After storing the first block record to the first blockchain node, the method further includes: The first block record is synchronized to the second block record of the second blockchain node in the server, and the server is connected to the electronic device.

7. A method for detecting abnormal behavior, characterized in that, Applied to a server, wherein the server includes a second blockchain node, the method includes: Obtain the second block record stored in the second blockchain node; The second block record whose polling status flag value is the second preset value is determined as the target block record; The abnormal behavior type of the electronic device is determined based on the first device identification information and the first location information in the target block record.

8. The method according to claim 7, characterized in that, Based on the first device identification information and first location information in the target block record, the types of abnormal behaviors of the electronic device are determined, including: If the first device identification information in the target block record is inconsistent with the target device identification information, and the first location information is consistent with the target location information, the abnormal behavior type of the electronic device is determined to be device location forgery abnormal behavior. If the first device identification information in the target block record is inconsistent with the target device identification information, and the first location information is inconsistent with the target location information, the abnormal behavior type of the electronic device is determined to be abnormal device removal behavior.

9. The method according to claim 8, characterized in that, After determining that the abnormal behavior type of the electronic device is device location spoofing abnormal behavior, the method further includes: Output device location spoofing anomaly prompt information, the device location spoofing anomaly prompt information is used to indicate that the electronic device has a device location spoofing anomaly; Alternatively, after determining that the abnormal behavior type of the electronic device is an abnormal device removal behavior, the method further includes: The movement trajectory of the electronic device is determined based on the first location information recorded in the target block.

10. The method according to claim 7, characterized in that, The method further includes: Upon receiving an initialization request, an initialization command is sent to the electronic device so that the electronic device responds to the initialization command sent by the server and initializes the target tracking device.

11. An abnormal behavior detection device, characterized in that, Applied to an electronic device, the electronic device is equipped with a target tracking device, the target tracking device includes a first blockchain node, the device comprising: The first acquisition module is used to acquire the first current location information of the target tracking device and the first current device identification information corresponding to the target tracking device; The second acquisition module is used to acquire the target location information of the target tracking device and the target device identification information of the electronic device from the first block record of the first blockchain node; The first determining module is used to determine whether the electronic device exhibits abnormal behavior based on the first current location information, the target location information, the first current device identification information, and the target device identification information.

12. An abnormal behavior detection device, characterized in that, Applied to the server side, the server side includes a second blockchain node, and the device includes: The third acquisition module is used to acquire the second block record stored in the second blockchain node; The second determining module is used to determine the second block record whose polling status flag value is a second preset value as the target block record; The third determining module is used to determine the type of abnormal behavior of the electronic device based on the first device identification information and the first location information in the target block record.

13. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the abnormal behavior detection method as described in any one of claims 1-10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the abnormal behavior detection method as described in any one of claims 1-10.

15. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the abnormal behavior detection method as described in any one of claims 1-10.

Images