Device detection method and apparatus, electronic device, and storage medium

Abstract

The present disclosure provides a device detection method and device, electronic equipment and storage medium, relates to the field of artificial intelligence technology, especially to the fields of traffic data processing, network ecological security and deep learning, and can be applied to search, social, shopping, travel, question and answer, local life, video and other scenes. The specific implementation scheme is: obtaining activation behavior data of an application program in a first device; performing feature calculation on each behavior data slice in the activation behavior data to obtain first features of each behavior data slice; performing feature correction on the first features of each behavior data slice based on the time distance between each behavior data slice to obtain second features of each behavior data slice; and determining whether the first device is an application program activation cheating device based on the second features of each behavior data slice.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, particularly to areas such as traffic data processing, network ecosystem security, and deep learning, and can be applied to various business scenarios based on mobile terminal devices, including search, social networking, shopping, travel, question answering, local services, and video. Specifically, this disclosure relates to a device detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] In the internet world, some businesses promote new apps, such as search, social, shopping, travel, Q&A, local services, and video apps. They also track app activation growth across various channels and adjust subsequent promotional strategies based on this data. However, some black market operators use cheating devices to manipulate app activation rates, which can disrupt promotional strategies and damage the app's mobile ecosystem. Summary of the Invention

[0003] This disclosure provides a device testing method, apparatus, electronic device, and storage medium.

[0004] According to one aspect of this disclosure, a device testing method is provided, comprising:

[0005] Obtain activation behavior data of applications in the first device;

[0006] Feature calculation is performed on each behavior data segment in the activation behavior data to obtain the first feature of each behavior data segment;

[0007] Based on the time distance between each behavior data segment, the first feature of each behavior data segment is modified to obtain the second feature of each behavior data segment;

[0008] Based on the second characteristics of each of the behavioral data segments, it is determined whether the first device is an application-activated cheating device.

[0009] According to another aspect of this disclosure, a device testing apparatus is provided, comprising:

[0010] The data acquisition module is used to acquire activation behavior data of applications in the first device;

[0011] The feature calculation module is used to perform feature calculation on each behavior data segment in the activation behavior data to obtain the first feature of each behavior data segment;

[0012] The feature correction module is used to correct the first feature of each behavior data segment based on the time distance between each behavior data segment to obtain the second feature of each behavior data segment.

[0013] The cheating detection module is used to determine whether the first device is an application-activated cheating device based on the second features of each of the behavioral data segments.

[0014] According to another aspect of this disclosure, an electronic device is provided, comprising:

[0015] At least one central processing unit; and

[0016] A memory communicatively connected to the at least one central processing unit; wherein,

[0017] The memory stores instructions that can be executed by the at least one central processing unit (CPU) to enable the at least one CPU to perform any parking method according to the embodiments of this disclosure.

[0018] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause the computer to perform any of the device detection methods in the embodiments of this disclosure.

[0019] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements a device detection method according to any embodiment of this disclosure.

[0020] According to the technology disclosed herein, feature calculations are performed on the activation behavior data of applications in a device to obtain a first feature. Then, the features of each segment are corrected by utilizing the influence of the time distance between each segment of the activation behavior data on the features of each segment, to obtain a second feature for each segment. In this way, the features describing the activation behavior data can be accurately obtained. Furthermore, by identifying these features, it is possible to accurately determine whether the device is an activation cheating device. Thus, the accuracy of identifying activation cheating devices is improved.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0022] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0023] Figure 1This is a flowchart of a device testing method according to an embodiment of the present disclosure;

[0024] Figure 2 This is a flowchart of a feature processing procedure according to an embodiment of the present disclosure;

[0025] Figure 3 This is a flowchart of an anti-cheating processing method according to an embodiment of the present disclosure;

[0026] Figure 4 This is a structural block diagram of a device testing apparatus according to an embodiment of the present disclosure;

[0027] Figure 5 This is a structural block diagram of a device testing apparatus according to another embodiment of the present disclosure;

[0028] Figure 6 This is a block diagram of an electronic device according to an embodiment of the present disclosure. Detailed Implementation

[0029] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0030] To facilitate understanding of the device testing method provided in the embodiments of this disclosure, the relevant technologies of the embodiments of this disclosure are described below. The following relevant technologies are optional solutions and can be combined with the technical solutions of the embodiments of this disclosure in any way, and they all fall within the protection scope of the embodiments of this disclosure.

[0031] Figure 1 This is a flowchart of a device detection method according to an embodiment of the present disclosure. The method can be applied to electronic devices. These electronic devices may be terminals, servers, or other processing devices. The terminal may be a desktop computer, mobile device, PDA (Personal Digital Assistant), handheld device, computing device, in-vehicle device, wearable device, or other user equipment (UE). In some implementations, the electronic device can implement the device detection method of the present disclosure by having a central processing unit call computer-readable instructions stored in its memory.

[0032] like Figure 1 As shown, the method may include the following steps:

[0033] S110, Obtain activation behavior data of the application in the first device;

[0034] S120, Perform feature calculation on each behavior data segment in the activation behavior data to obtain the first feature of each behavior data segment;

[0035] S130, based on the time distance between each behavior data segment, the first feature of each behavior data segment is modified to obtain the second feature of each behavior data segment;

[0036] S140, based on the second features of each behavioral data segment, determine whether the first device is an application-activated cheating device.

[0037] Understandably, a data acquisition module is built into the application. When the first device downloads and activates the application, the data acquisition module takes the activation behavior data at this time and uploads it to the cloud. The cloud can store this activation behavior data and perform the steps S110 to S140 described above.

[0038] For example, activation behavior data could be activation information and device information triggered by the user within a short period of time after the application is downloaded and opened on the first device.

[0039] For example, activation behavior data can be time-series data or streaming data.

[0040] For example, activation behavior data may include multiple behavior data slices, which are arranged or connected to each other in chronological order.

[0041] For example, the first feature may include the frequency of occurrence of each dimension object in each dimension category within the behavioral data slice.

[0042] For example, the second feature may include the frequency of occurrence of each dimension object in each dimension category within the behavioral data slice.

[0043] For example, feature calculation for a slice includes: calculating the features of the slice according to the feature calculation formula corresponding to each dimension category in multiple dimension categories, thereby obtaining the features of the slice under each dimension category. For example, each dimension category may have multiple dimension objects. By statistically analyzing the frequency of occurrence of all dimension objects under that category in the slice, the features of the slice under that dimension category can be obtained. Examples include concentration features, percentage features, and deduplication count features.

[0044] Understandably, the first and second features may include the concentration feature, proportion feature, and deduplication feature mentioned above.

[0045] Understandably, concentration features can include features obtained by statistically analyzing the concentration of occurrence frequencies of multiple dimensions of objects within a certain category. Alternatively, they can include these features across multiple categories.

[0046] Understandably, the proportion feature can be a feature obtained by statistically analyzing the proportion of the occurrence frequency of targets that meet preset conditions relative to the total occurrence frequency among the occurrence frequencies of multiple dimensions of objects under a certain category. Alternatively, it can include these features under multiple categories.

[0047] Understandably, deduplication features can include the frequency of occurrence of objects across various dimensions within a specific category. Alternatively, they can include these features across multiple categories.

[0048] For example, in step S130 above, based on the impact of the time distance between each behavior data segment on the first feature of each behavior data segment, the first feature of each behavior data segment is modified to obtain the second feature of each behavior data segment.

[0049] For example, by utilizing the influence of the distance between each second row data slice and the first row data slice on the first feature of the first row data slice, feature correction is performed on the first feature of the first row data slice to obtain the second feature of the first row data slice.

[0050] Understandably, both the first row data shard and the second row data shard are shards of the aforementioned activation behavior data.

[0051] Understandably, the first feature after feature correction is the second feature mentioned above.

[0052] For example, in step S140 above, the second features of each behavioral data segment are input into the cheating detection model to obtain the detection result output by the cheating detection model. This detection result is used to characterize whether the first device is an application-activated cheating device. The cheating detection model is a pre-trained model.

[0053] For example, the above method may further include: adjusting the model parameters of the cheating detection model based on the detection result output by the cheating detection model and the annotation result of the first device to obtain a new cheating detection model. The annotation result is used to characterize whether the first device is an application-activated cheating device.

[0054] For example, after processing the second feature in both breadth and depth, it is then input into the cheating detection model to obtain the detection result output by the cheating detection model.

[0055] According to the above implementation method, feature calculation is performed on the activation behavior data of the application in the device to obtain a first feature. Then, the features of each segment are corrected by utilizing the influence of the time distance between each segment of the activation behavior data on the features of each segment, so as to obtain a second feature of each segment. In this way, the features describing the activation behavior data can be accurately obtained. Furthermore, by identifying these features, it is possible to accurately determine whether the device is an activation cheating device. Thus, the accuracy of identifying activation cheating devices is improved.

[0056] In one implementation, based on the time distance between each behavior data segment, a first feature of each behavior data segment is modified to obtain a second feature of each behavior data segment. This includes: based on the time distance between the first behavior data segment and each second behavior data segment, performing feature attenuation on the first feature of each second behavior data segment to obtain the feature influence of each second behavior data segment on the first behavior data segment; and based on the feature influence of each second behavior data segment on the first behavior data segment, performing feature modification on the first feature of the first behavior data segment to obtain the second feature of the first behavior data segment.

[0057] Understandably, the first row of data shards is one shard of the aforementioned activation behavior data. The second row of data shards is also one shard of the aforementioned activation behavior data that is not the first row of data shards.

[0058] Understandably, the first data slice is determined from the activation behavior data, and then all or part of the remaining slices are used as the second data slice. All slices have the same duration.

[0059] For example, the impact of the time distance between the first row data slice and each of the second row data slices on the first feature of the first row data can include: performing feature attenuation on the first feature of each of the second row data slices based on the time distance between the first row data slice and each of the second row data slices, to obtain the feature influence of each of the second row data slices on the first row data slice.

[0060] Understandably, the closer the time interval between two partitions, the greater the influence of their features on each other. Conversely, the farther the time interval between two partitions, the smaller the influence of their features on each other.

[0061] Understandably, the first feature of the first row of data segments is modified by using the sum or weighted sum of the feature influence of each second row of data segments on the first row of data segments, thus obtaining the second feature of the first row of data segments.

[0062] For example, the sum of the influence of the above features is added to the first feature to obtain the second feature of the first row data segment.

[0063] For example, the sum of the influence of the above features can be multiplied by a coefficient and then added to the first feature to obtain the second feature of the first row of data shards.

[0064] According to the above implementation method, the influence of each segment's features on the current segment's features can be determined by utilizing the distance between each segment and the current segment. Therefore, by using the influence of each segment's features on the current segment's features, the features of the current segment can be corrected, resulting in more accurate segment features. Subsequently, when using this feature to identify whether a device is a cheating device, the accuracy of the identification can be further improved.

[0065] In one implementation, based on the time distance between the first row data slice and each second row data slice, feature attenuation is performed on the first feature of each second row data slice to obtain the feature influence of each second row data slice on the first row data slice. This includes: determining the degree of influence attenuation of the second row data slice on the first row data slice based on the time distance between the first row data slice and the second row data slice and a preset attenuation coefficient; and performing feature attenuation on the first feature of the second row data slice based on the degree of influence attenuation to obtain the feature influence of the second row data slice on the first row data slice.

[0066] For example, the behavioral data shards are sorted in chronological order, and the time distance between each shard can be determined based on the sorting position.

[0067] For example, the difference between the timestamps of the earliest data in each shard is used as the time distance between the shards.

[0068] For example, the difference between the timestamps of the last data in each shard is used as the time distance between the shards.

[0069] For example, by using the time distance between the first row of data shards and the second row of data shards as the exponent and the attenuation coefficient as the base, an exponential function can be performed to calculate the degree of attenuation of the influence of the second row of data shards on the first row of data shards.

[0070] For example, by multiplying the time distance between the first row of data shards and the second row of data shards as the independent variable and the attenuation coefficient as a fixed value, we can obtain the dependent variable, namely the degree of attenuation of the influence of the second row of data shards on the first row of data shards.

[0071] For example, the degree of influence attenuation mentioned above is multiplied by the first feature of the second row data segment to obtain the feature influence of the second row data segment on the first row data segment.

[0072] For example, based on the aforementioned degree of influence attenuation, another mapping value is determined, and this mapping value is multiplied by the first feature of the second row data segment to obtain the feature influence of the second row data segment on the first row data segment.

[0073] According to the above implementation method, the degree of attenuation of the influence of the second row of data segments on the first row of data segments can be determined based on the time distance between the first row of data segments and the second row of data segments, as well as a preset attenuation coefficient. Therefore, based on the degree of attenuation, feature attenuation is applied to the first feature of the second row of data segments to obtain the feature influence of the second row of data segments on the first row of data segments.

[0074] In one implementation, based on the feature influence of each second row data segment on the first row data segment, a feature correction is performed on the first feature of the first row data segment to obtain a second feature of the first row data segment. This includes: summing the feature influence of each second row data segment on the first row data segment to obtain a total feature influence; and summing the total feature influence and the first feature of the first row data segment to obtain a second feature of the first row data segment.

[0075] For example, a corresponding weight value is determined for each second row of data segments. Using the weight values ​​of each second row of data segments, the feature influence of each second row of data segments on the first row of data segments is weighted and summed to obtain the total feature influence.

[0076] For example, based on the ratio between the total feature influence and the first row of data segments, the weight values ​​of each are determined, and then these two weight values ​​are used to sum the feature influence and the first feature of the first row of data segments to obtain the second feature of the first row of data segments.

[0077] According to the above implementation method, the feature influence of each second row data segment on the first row data segment is summed to obtain the total feature influence. Then, the total feature influence and the first feature of the first row data segment are summed to obtain the second feature of the first row data segment.

[0078] In one implementation, the second feature includes the frequency of occurrence of each dimension object under each dimension category in the behavioral data slice. Determining whether the first device is an application-activated cheating device based on the second feature of each behavioral data slice includes: determining the third feature of the third behavioral data slice under each dimension category based on the frequency of occurrence of each dimension object under each dimension category in the third behavioral data slice; inputting the third feature of the third behavioral data slice under each dimension category into the cheating discrimination model to obtain the discrimination result output by the cheating discrimination model, wherein the discrimination result is used to characterize whether the first device is an application-activated cheating device.

[0079] For example, a dimension category can be a category corresponding to a single dimension, or a combined category corresponding to multiple dimensions. Each category can include one or more dimensions. Each dimension can include one or more dimension objects. For example, for the dimension of surname, it can include multiple surnames such as Chen, Wang, and Li. These specific surnames are dimension objects.

[0080] For example, dimensions may include device dimension, geographic dimension, and channel dimension. Figure 2 As shown, it illustrates multiple combinations of dimensions.

[0081] like Figure 2 As shown, several dimensions can be selected and combined. For each dimension combination, feature calculations are performed on the behavioral data, yielding various categories of features, such as aggregated features, bucketed features, and counting features. This behavioral data can be divided according to time windows, with feature calculations performed on behavioral data within a fixed window. The calculated features are then output to the model.

[0082] For example, the third feature may include the percentage feature and the deduplication count feature mentioned above. The percentage feature may include concentration features, etc.

[0083] For example, the third behavior data slice can be one of the slices in the aforementioned activation behavior data. For instance, using the first feature of each behavior data slice, a target slice is determined in the activation behavior data, and this target slice is used as the aforementioned third behavior data slice.

[0084] For example, a cheating detection model can employ a general tree model, such as a gradient boosting tree.

[0085] According to the above implementation method, the frequency of occurrence of objects in each dimension of the activation behavior data within a specified segment is statistically analyzed to obtain a third feature. This third feature is then input into the cheating detection model to obtain the model's output detection result. Thus, a more accurate detection result can be obtained.

[0086] In one implementation, the third feature includes a proportion feature. Based on the frequency of occurrence of each dimension object in the third row data segment under each dimension category, the third feature of the third row data segment under each dimension category is determined. This includes: identifying at least one target occurrence frequency that meets preset conditions from the occurrence frequencies of each dimension object in the third row data segment under the first dimension category; summing the occurrence frequencies of the at least one target to obtain a first value; summing the occurrence frequencies of all dimension objects in the third row data segment under the first dimension category to obtain a second value; and determining the proportion feature of the third row data segment under the first dimension category based on the ratio of the first value to the second value.

[0087] Understandably, for any dimension category, the above implementation method can be used to calculate the proportion of the third row data slices under that dimension category.

[0088] Understandably, the first dimension category is any of the optional dimension categories.

[0089] Understandably, preset conditions can be set as needed. For example, a preset condition could be that the dimension object is a preset object. For instance, the preset object could be traffic from a network access point belonging to a preset operator.

[0090] According to the above implementation method, firstly, the frequency of occurrence of at least one target that meets preset conditions is determined; the frequency of occurrence of the at least one target is summed to obtain a first value, and the frequency of occurrence of all dimension objects under the first dimension category in the third row data slice is summed to obtain a second value. Then, based on the ratio of the first value and the second value, the proportion characteristic of the third row data slice under the first dimension category can be accurately determined.

[0091] In one implementation, the proportion feature includes a concentration feature, with the preset condition being that the target occurrence frequency is ranked among the top N positions of the occurrence frequency of all dimension objects under the first dimension category, where N is a positive integer greater than 1.

[0092] Understandably, the value of N is less than or equal to the total number of all dimension objects under the first dimension category.

[0093] According to the above implementation method, by setting the pre-selection condition as the target occurrence frequency ranking among the top N of the occurrence frequencies of all dimension objects under the first dimension category, and combining it with the above-mentioned proportion feature calculation process, the concentration feature of the third row data sharding under the first dimension category can be obtained.

[0094] Figure 3This is a flowchart of an anti-cheating processing method according to an embodiment of the present disclosure. The method specifically includes three stages. The second stage is applied to an activation cheating device detection system. This system includes a data processing center, a feature calculation module, a preprocessing module, and a cheating prediction / model training module.

[0095] The first stage involves data collection. When the application is downloaded to the device, it includes a data collection module. This module is the data source for the entire system. Its main function is to collect and report user-triggered activation information and device information within a short period after the app is downloaded and opened. This module then standardizes and processes the collected device information before passing it to the fraudulent device detection system for feature calculation.

[0096] The second stage involves training the model or detecting cheating on the data. The feature calculation module in the cheating detection system is activated to perform feature calculations on streaming or offline data transmitted from the data acquisition module within a specified time window. This module performs feature statistics on data with any dimension or combination of multiple dimensions within a specified time window. Feature categories can include concentration, proportion, and deduplication count, etc. After feature accumulation, the data is written to disk and provided to the preprocessing module for data processing.

[0097] The feature calculation module can be performed based on the Themis-MR framework, supporting data warehouse tables and HDFS files as static data sources, or it can be performed based on the Flink streaming framework, supporting real-time calculation of the front window of streaming data.

[0098] The preprocessing module in the system for detecting cheating devices can also be called the sample enhancement module.

[0099] This module is a prerequisite for model training and data prediction, processing the data dumped by the feature calculation module in both breadth and depth. During model training, the dumped data undergoes oversampling, undersampling, and / or the introduction of noisy data at specific ratios to obtain the training dataset. During data prediction, however, these oversampling, undersampling, and noisy data introduction processes are not required.

[0100] Feature breadth processing can include:

[0101] 1. In the scenario of identifying channel activation fraud, introduce channel-related features and perform one-hot mapping. For example, channel features can include paid channels, free channels, and channel charging methods. Then, perform one-hot mapping on these features to obtain one-hot mapped features. For example, assuming there are three channel types, including free, paid, and pre-installed, after performing one-hot mapping on these three types, we can obtain: free channel 001, paid channel 010, and pre-installed channel 100. Finally, match the mapped features with specific sample data.

[0102] 2. Extract features from inactive behavior data (if any) within the current app and normalize these features. For example, map each feature to the range of 0-1. This can accelerate the speed and accuracy of model calculations during subsequent model training or prediction.

[0103] 3. Obtain source information for users downloading the app. Source information refers to the channels through which the user downloaded the app.

[0104] Feature depth processing may include:

[0105] 1. Map character-type features to floating-point-type features to facilitate model calculation.

[0106] 2. The calculation time window for filtering features, i.e., the time length of the above-mentioned behavioral data slices.

[0107] 3. Clean or delete outliers or useless values ​​in the features.

[0108] 4. Introducing noise into the features can prevent overfitting during subsequent model training.

[0109] During model training, sample data can also be processed by sampling, specifically by controlling the ratio of positive to negative samples within a reasonable range. Generally, a difference of more than 10 times between the ratio of positive and negative samples can introduce uneven sample distribution. This example controls the undersampling ratio of negative samples to keep the ratio of positive to negative samples within a reasonable range, preventing data distribution deviation and avoiding gradient vanishing.

[0110] The cheating prediction / model training module is the system's final decision-making module. Model training is performed during the testing phase, and cheating data is identified during the practical application phase.

[0111] The third stage is anti-fraud processing. The app's growth campaign model receives fraud detection results and automatically optimizes the model. The app's channel partnership business receives fraud detection results and deducts settlement amounts from fraudulent channels to prevent financial losses. The app's subsequent business processes receive fraud detection results to prevent fraudulent devices from engaging in fraudulent activities in subsequent searches, feeds, and promotional activities.

[0112] The solution provided by the above implementation method can be specifically applied to the identification of fraudulent devices such as bots, bulk purchases, and virtual devices in APP growth campaigns, combating illegal activities by black and gray market operators to illegally obtain APP growth campaign funds and disrupt the APP mobile ecosystem. This technical solution is relatively universal and can be widely applied to the identification of fraudulent devices in the activation and new user invitation scenarios of any APP, such as other business areas based on mobile terminal devices, including search, social, shopping, travel, Q&A, local services, and video.

[0113] Figure 4 This is a structural block diagram of a device testing apparatus according to an embodiment of the present disclosure.

[0114] like Figure 4 As shown, the equipment detection device may include:

[0115] The data acquisition module 410 is used to acquire activation behavior data of the application in the first device;

[0116] Feature calculation module 420 is used to perform feature calculation on each behavior data segment in the activation behavior data to obtain the first feature of each behavior data segment;

[0117] The feature correction module 430 is used to correct the first feature of each behavior data segment based on the time distance between each behavior data segment to obtain the second feature of each behavior data segment.

[0118] The cheating detection module 440 is used to determine whether the first device is an application-activated cheating device based on the second features of each of the behavioral data segments.

[0119] Figure 5 This is a structural block diagram of a device testing apparatus according to another embodiment of the present disclosure.

[0120] like Figure 4 and Figure 5 As shown, Figure 5 The data acquisition module 510, feature calculation module 520, feature correction module 530, and cheating detection module 540 are respectively connected to... Figure 4The data acquisition module 410, feature calculation module 420, feature correction module 430 and cheating detection module 440 have the same structure and function, and will not be described in detail here.

[0121] In one embodiment, the feature correction module 530 includes:

[0122] The feature attenuation unit 531 is used to attenuate the first feature of each second row data segment based on the time distance between the first row data segment and each second row data segment, so as to obtain the feature influence of each second row data segment on the first row data segment.

[0123] The feature correction unit 532 is used to perform feature correction on the first feature of the first behavior data segment based on the feature influence of each second behavior data segment on the first behavior data segment, so as to obtain the second feature of the first behavior data segment.

[0124] In one embodiment, the feature attenuation unit 531 is specifically used for:

[0125] Based on the time distance between the first and second behavioral data segments and a preset attenuation coefficient, the degree of attenuation of the influence of the second behavioral data segment on the first behavioral data segment is determined.

[0126] Based on the degree of influence attenuation, feature attenuation is performed on the first feature of the second behavioral data segment to obtain the feature influence of the second behavioral data segment on the first behavioral data segment.

[0127] In one embodiment, the feature correction unit 532 is specifically used for:

[0128] The total feature influence is obtained by summing the feature influence of each second data segment on the first data segment.

[0129] The total feature influence and the first feature of the first behavior data segment are summed to obtain the second feature of the first behavior data segment.

[0130] In one implementation, the second feature includes the frequency of occurrence of objects in each dimension category within the behavior data slice, and the cheating detection module 540 includes:

[0131] The feature statistics unit 541 is used to determine the third feature of the third row data segment under each dimension category based on the frequency of occurrence of each dimension object in the third row data segment under each dimension category.

[0132] The model processing unit 542 is used to input the third feature of the third behavior data slice under each of the three dimension categories into the cheating discrimination model to obtain the cheating discrimination model output discrimination result, wherein the discrimination result is used to characterize whether the first device is an application-activated cheating device.

[0133] In one embodiment, the third feature includes a proportion feature, and the feature statistics unit 541 is specifically used for:

[0134] Among the occurrence frequencies of objects in each dimension under the first dimension category in the third row data slice, determine at least one target occurrence frequency that meets the preset conditions;

[0135] The frequencies of occurrence of the at least one target are summed to obtain a first value;

[0136] The second value is obtained by summing the frequency of occurrence of all dimension objects under the first dimension category in the data slice of the third row;

[0137] Based on the ratio of the first value to the second value, the proportion feature of the third row data slice under the first dimension category is determined.

[0138] In one implementation, the proportion feature includes a concentration feature, and the preset condition is that the frequency of occurrence of the target ranks among the top N positions of the frequency of occurrence of all dimension objects under the first dimension category, where N is a positive integer greater than 1.

[0139] The specific functions and examples of each module and submodule of the apparatus in this disclosure can be found in the relevant descriptions of the corresponding steps in the above method embodiments, and will not be repeated here.

[0140] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0141] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product. The electronic device may be a server, and the server may further include any of the power supply control devices described in the embodiments of this disclosure.

[0142] Figure 6A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0143] like Figure 6 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0144] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0145] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as a device detection method. For example, in some embodiments, a device detection method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of a device detection method described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform a device detection method by any other suitable means (e.g., by means of firmware).

[0146] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0147] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0148] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0149] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0150] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0151] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0152] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0153] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for testing equipment, comprising: Obtain activation behavior data of applications in the first device; Feature calculation is performed on each behavior data segment in the activation behavior data to obtain the first feature of each behavior data segment; Based on the time distance between the first row data slice and the second row data slice, and the preset attenuation coefficient, the degree of attenuation of the influence of the second row data slice on the first row data slice is determined. Based on the degree of influence attenuation, feature attenuation is performed on the first feature of the second behavioral data segment to obtain the feature influence of the second behavioral data segment on the first behavioral data segment; The total feature influence is obtained by summing the feature influence of each second-behavior data segment on the first-behavior data segment. The second feature of the first behavior data segment is obtained by summing the total feature influence and the first feature of the first behavior data segment. Based on the second feature of each of the behavioral data segments, it is determined whether the first device is an application activation cheating device; the second feature includes the frequency of occurrence of each dimension object under each dimension category in the behavioral data segment.

2. The method according to claim 1, wherein, The determination of whether the first device is an application activation cheating device based on the second feature of each of the behavioral data segments includes: Based on the frequency of occurrence of each dimension object under each dimension category in the third row data segment, the third feature of the third row data segment under each dimension category is determined; The third feature of the third behavior data slice under each of the three dimensions is input into the cheating discrimination model to obtain the discrimination result output by the cheating discrimination model. The discrimination result is used to characterize whether the first device is an application-activated cheating device.

3. The method according to claim 2, wherein, The third feature includes a proportion feature. Determining the third feature of the third row data shard under each dimension category based on the frequency of occurrence of each dimension object in the third row data shard includes: Among the occurrence frequencies of objects in each dimension under the first dimension category in the third row data slice, determine at least one target occurrence frequency that meets the preset conditions; The frequencies of occurrence of the at least one target are summed to obtain a first value; The second value is obtained by summing the frequency of occurrence of all dimension objects under the first dimension category in the data slice of the third row; Based on the ratio of the first value to the second value, the proportion feature of the third row data slice under the first dimension category is determined.

4. The method according to claim 3, wherein, The proportion feature includes a concentration feature, and the preset condition is that the frequency of occurrence of the target ranks among the top N positions of the frequency of occurrence of all dimension objects under the first dimension category, where N is a positive integer greater than 1.

5. An equipment testing device, comprising: The data acquisition module is used to acquire activation behavior data of applications in the first device; The feature calculation module is used to perform feature calculation on each behavior data segment in the activation behavior data to obtain the first feature of each behavior data segment; The feature correction module is used to correct the first feature of each behavior data segment based on the time distance between each behavior data segment to obtain the second feature of each behavior data segment. The cheating detection module is used to determine whether the first device is an application-activated cheating device based on the second feature of each of the behavioral data segments; the second feature includes the frequency of occurrence of each dimension object under each dimension category in the behavioral data segment. The feature correction module includes: The feature attenuation unit is used to determine the degree of attenuation of the influence of the second row data segment on the first row data segment based on the time distance between the first row data segment and the second row data segment and a preset attenuation coefficient; and to perform feature attenuation on the first feature of the second row data segment based on the degree of influence attenuation to obtain the feature influence of the second row data segment on the first row data segment. The feature correction unit is used to sum the feature influence of each second behavior data segment on the first behavior data segment to obtain the total feature influence; and to sum the total feature influence and the first feature of the first behavior data segment to obtain the second feature of the first behavior data segment.

6. The apparatus according to claim 5, wherein, The cheating detection module includes: The feature statistics unit is used to determine the third feature of the third row data segment under each dimension category based on the frequency of occurrence of each dimension object in the third row data segment under each dimension category. The model processing unit is used to input the third feature of the third behavior data slice under each of the three dimensions into the cheating discrimination model to obtain the discrimination result output by the cheating discrimination model, wherein the discrimination result is used to characterize whether the first device is an application-activated cheating device.

7. The apparatus according to claim 6, wherein, The third feature includes a proportion feature, and the feature statistical unit is specifically used for: Among the occurrence frequencies of objects in each dimension under the first dimension category in the third row data slice, determine at least one target occurrence frequency that meets the preset conditions; The frequencies of occurrence of the at least one target are summed to obtain a first value; The second value is obtained by summing the frequency of occurrence of all dimension objects under the first dimension category in the data slice of the third row; Based on the ratio of the first value to the second value, the proportion feature of the third row data slice under the first dimension category is determined.

8. The apparatus according to claim 7, wherein, The proportion feature includes a concentration feature, and the preset condition is that the frequency of occurrence of the target ranks among the top N positions of the frequency of occurrence of all dimension objects under the first dimension category, where N is a positive integer greater than 1.

9. An electronic device, comprising: At least one central processing unit; as well as A memory communicatively connected to the at least one central processing unit; wherein, The memory stores instructions executable by the at least one central processing unit, which, when executed by the at least one central processing unit, enables the at least one central processing unit to perform the method of any one of claims 1-4.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-4.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-4.

Images