Cloud mobile phone identification method and device, equipment and storage medium

Abstract

The invention provides a cloud mobile phone recognition method and device, equipment and a storage medium, and relates to the technical field of computers, and the method comprises the steps: obtaining equipment information, APP operation behavior information and equipment environment information of a to-be-recognized object; performing feature extraction on the equipment information, the APP operation behavior information and the equipment environment information to obtain multi-dimensional feature information; inputting the multi-dimensional feature information into a pre-constructed recognition model to obtain a risk recognition result output by the recognition model; the risk identification result is used for representing the risk degree that the to-be-identified object is the cloud mobile phone; the identification model is obtained by iteratively training a plurality of pre-collected training data samples and equipment labels thereof. According to the method, the APP operation behavior information and the equipment environment information are monitored in real time, so that the recognition reliability is enhanced, and the recognition accuracy of the cloud mobile phone is improved by combining the multi-dimensional equipment information, the APP operation behavior information and the equipment environment information and utilizing the machine learning model for recognition.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a cloud phone identification method, device, equipment and storage medium. Background Art

[0002] With the rapid development of mobile Internet, the scale of the mobile application market is expanding, but it is also accompanied by a series of problems and challenges. Cloud phones are mobile phones that run on cloud servers. They are based on virtualization technology and networks. Users do not need to purchase mobile phone hardware, but can remotely control cloud phones installed on cloud servers in real time through video streaming. Cloud phones can run various mobile applications, which brings convenience to users while also causing new risks and challenges.

[0003] Since there are many cloud phone models, new models emerge in an endless stream, and they have real CPU and other hardware, it is difficult to identify them. At present, the identification of cloud phones mainly relies on traditional methods such as device fingerprint recognition and IP address tracking. These methods are usually based on static features such as device hardware information and network information for identification. However, these static features can be easily disguised or tampered by black and gray industries through virtualization technology, proxy IP, etc., resulting in low identification accuracy. Summary of the invention

[0004] The present invention provides a cloud phone identification method, device, equipment and storage medium, aiming to solve at least one of the above-mentioned technical problems.

[0005] The present invention provides a cloud phone identification method, comprising:

[0006] Obtain device information, APP operation behavior information, and device environment information of the object to be identified;

[0007] Extracting features of the device information, the APP running behavior information, and the device environment information respectively to obtain multi-dimensional feature information;

[0008] Inputting the multi-dimensional feature information into a pre-built recognition model to obtain a risk recognition result output by the recognition model;

[0009] Among them, the risk identification result is used to characterize the risk level of the object to be identified being a cloud phone; the identification model is obtained by iterative training of multiple pre-collected training data samples and their device labels.

[0010] Optionally, according to a cloud phone recognition method provided by the present invention, the recognition model is trained based on the following steps:

[0011] Acquire training data samples of multiple devices, wherein the training data samples include device information samples, APP running behavior information samples, and device environment information samples;

[0012] Extracting features from the device information sample, the APP operation behavior information sample, and the device environment information sample respectively to obtain multi-dimensional feature information to be trained;

[0013] Preprocessing the multi-dimensional feature information to be trained;

[0014] Based on the device label of each device and the pre-processed multi-dimensional feature information to be trained, the recognition model is obtained through iterative training.

[0015] Optionally, according to a cloud phone identification method provided by the present invention, the iterative training based on the device label of each device and the pre-processed multi-dimensional feature information to be trained to obtain the identification model includes:

[0016] For any multi-dimensional feature information to be trained:

[0017] Inputting the multi-dimensional feature information to be trained into the recognition model to obtain a recognition result output by the recognition model;

[0018] Based on the device tag and the recognition result, a model loss value is calculated;

[0019] Based on the model loss value, model parameters of the recognition model are optimized.

[0020] Optionally, according to a cloud phone identification method provided by the present invention, the device information includes hardware information, network information, operating system information and power status information;

[0021] The APP operation behavior information includes application startup frequency, running time and resource consumption information;

[0022] The device environment information includes the geographical location information of the device, WiFi hotspots and Bluetooth devices within a preset distance, and sensor data carried by the device.

[0023] Optionally, according to a cloud phone identification method provided by the present invention, the feature extraction of the device information, the APP running behavior information and the device environment information is performed respectively to obtain multi-dimensional feature information, including:

[0024] Extracting features of the device information, the APP running behavior information, and the device environment information respectively to obtain behavior feature information, device feature information, network feature information, and environment feature information;

[0025] Based on the behavior characteristic information, the device characteristic information, the network characteristic information and the environment characteristic information, the multi-dimensional characteristic information is formed;

[0026] The behavior characteristic information includes the type, frequency and time distribution of APP applications installed and used by users;

[0027] The device feature information includes the hardware configuration information of the device, and the hardware configuration information includes the CPU model, memory size and storage space;

[0028] The network characteristic information includes the frequency of data transmission, data size and IP address, as well as the correlation characteristics between the IP address and user behavior;

[0029] The environmental characteristic information includes a movement pattern and a physical environment of the device, wherein the physical environment includes geographic location information.

[0030] Optionally, according to a cloud phone identification method provided by the present invention, after inputting the multi-dimensional feature information into a pre-built identification model and obtaining the risk identification result output by the identification model, the method further includes:

[0031] If the risk identification result exceeds the preset risk threshold, it is determined that the object to be identified is a cloud phone with risks;

[0032] Access to the cloud phone is limited or blocked.

[0033] Optionally, according to a cloud phone identification method provided by the present invention, before inputting the multi-dimensional feature information into a pre-built identification model to obtain a risk identification result output by the identification model, the method further includes:

[0034] The multi-dimensional feature information is normalized and standardized.

[0035] The present invention also provides a cloud phone identification device, comprising:

[0036] The acquisition module is used to obtain the device information, APP operation behavior information and device environment information of the object to be identified;

[0037] A feature extraction module is used to extract features from the device information, the APP running behavior information and the device environment information to obtain multi-dimensional feature information;

[0038] An identification module, used to input the multi-dimensional feature information into a pre-built identification model to obtain a risk identification result output by the identification model;

[0039] Among them, the risk identification result is used to characterize the risk level of the object to be identified being a cloud phone; the identification model is obtained by iterative training of multiple pre-collected training data samples and their device labels.

[0040] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the cloud phone identification method as described above is implemented.

[0041] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the cloud phone identification methods described above.

[0042] The cloud phone identification method, device, equipment and storage medium provided by the present invention include: obtaining the device information, APP operation behavior information and device environment information of the object to be identified; extracting features of the device information, the APP operation behavior information and the device environment information respectively to obtain multi-dimensional feature information; inputting the multi-dimensional feature information into a pre-constructed recognition model to obtain a risk identification result output by the recognition model; wherein the risk identification result is used to characterize the risk level of the object to be identified as a cloud phone; the recognition model is obtained by iterative training of multiple pre-collected training data samples and their device labels. By real-time monitoring of APP operation behavior information and device environment information, the reliability of identification is enhanced, and then combined with multi-dimensional device information, APP operation behavior information and device environment information, a machine learning model is used for identification, the accuracy of cloud phone identification is improved, and the anti-deception ability of the platform is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 It is a flowchart of the cloud phone identification method provided by the present invention;

[0045] Figure 2 It is a structural schematic diagram of the cloud phone identification device provided by the present invention;

[0046] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The terms used in one or more embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of the present invention. The singular forms of "a", "said" and "the" used in one or more embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of the present invention refers to and includes any or all possible combinations of one or more associated listed items.

[0049] It should be understood that, although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present invention, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of the present invention, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "when..." or "when...".

[0050] With the rapid development of mobile Internet, the scale of the mobile application market is expanding, but it is also accompanied by a series of problems and challenges. Cloud phones are mobile phones that run on cloud servers. They are based on virtualization technology and networks. Users do not need to purchase mobile phone hardware, but can remotely control cloud phones installed on cloud servers in real time through video streaming. Cloud phones can run various mobile applications, which brings convenience to users while also causing new risks and challenges.

[0051] Since there are many cloud phone models, new models emerge in an endless stream, and they have real CPU and other hardware, it is difficult to identify them. At present, the identification of cloud phones mainly relies on traditional methods such as device fingerprint recognition and IP address tracking. These methods are usually based on static features such as device hardware information and network information for identification. However, these static features can be easily disguised or tampered by black and gray industries through virtualization technology, proxy IP, etc., resulting in low identification accuracy.

[0052] To solve the above problems, the present invention provides the following embodiments. Specifically, in one embodiment, Figure 1 Schematic diagram of the process of the cloud phone identification method provided by the present invention. Figure 1 As shown, the cloud phone identification method includes:

[0053] Step S11, obtaining device information, APP operation behavior information and device environment information of the object to be identified;

[0054] It should be noted that a lightweight probe is embedded in the APP and runs synchronously with the APP. A lightweight probe usually refers to a small monitoring tool embedded in an application (APP), which can collect the application's operating data or monitor specific behaviors and performance indicators without affecting the normal operation of the APP. The device information includes hardware information, network information, operating system information, and power status information; hardware information includes information such as CPU type, memory size, sensor information, etc., network information includes information such as IP address, MAC address, and wireless network name; operating system information includes information such as system version, running process, and installed application list; power status information includes information such as charging mode and battery consumption speed. The APP running behavior information includes information such as application startup frequency, running time, and resource consumption information; the device environment information includes the geographical location information of the device, WiFi hotspots and Bluetooth devices within a preset distance, and sensor data carried by the device. Sensors include accelerometers, gyroscopes, light sensors, etc. Sensor data can help further understand the actual use environment and status of the device.

[0055] Specifically, after collecting the device information, the APP operation behavior information and the device environment information, the device information, the APP operation behavior information and the device environment information are reported to the server.

[0056] Step S12, extracting features from the device information, the APP running behavior information, and the device environment information to obtain multi-dimensional feature information;

[0057] It should be noted that the multi-dimensional feature information includes behavior feature information, device feature information, network feature information and environment feature information.

[0058] The behavior characteristic information includes information such as the type, frequency and time distribution of APP applications installed and used by users;

[0059] The device feature information includes the hardware configuration information of the device, and the hardware configuration information includes information such as CPU model, memory size and storage space;

[0060] The network characteristic information includes the frequency, data size and IP address of data transmission, and the analysis of the correlation characteristics between IP addresses and user behaviors, and optionally, the analysis of network traffic and usage patterns, such as the frequency, data size and IP address of data transmission, and the analysis of the correlation between IP addresses and user behaviors to identify multiple accounts using the same IP address or the behavior of frequently changing IP addresses.

[0061] The environmental characteristic information includes the device's movement pattern and physical environment, wherein the physical environment includes geographic location information, and the device's geographic location information is analyzed, such as frequent geographic location changes or differences from the region where the IP address is located, etc. The movement pattern refers to information such as the device's up and down movement, left and right movement, etc.

[0062] Specifically, feature extraction is performed on the device information, the APP running behavior information, and the device environment information to obtain feature information such as multi-behavior feature information, device feature information, network feature information, and environment feature information. In addition, in order to improve the accuracy of recognition, pre-processing operations such as normalization and standardization are performed on the extracted feature information.

[0063] Step S13: input the multi-dimensional feature information into a pre-built recognition model to obtain a risk recognition result output by the recognition model.

[0064] It should be noted that the recognition model can be a decision tree, random forest or neural network model. Specifically, the multi-dimensional feature information is input into a pre-built recognition model to use the recognition model to identify the cloud phone, and obtain the risk identification result output by the recognition model; the risk identification result is used to characterize the risk level of the object to be identified as a cloud phone.

[0065] In addition, if the risk identification result exceeds the preset risk threshold, the object to be identified is determined to be a cloud phone with risk, and access to the cloud phone is restricted or blocked. The relevant information of the cloud phone can also be added to the blacklist.

[0066] The embodiment of the present invention, through the above scheme, includes: obtaining the device information, APP operation behavior information and device environment information of the object to be identified; extracting features of the device information, the APP operation behavior information and the device environment information respectively to obtain multi-dimensional feature information; inputting the multi-dimensional feature information into a pre-built recognition model to obtain a risk identification result output by the recognition model; wherein the risk identification result is used to characterize the risk level of the object to be identified as a cloud phone; the recognition model is obtained by iterative training of multiple pre-collected training data samples and their device labels. By real-time monitoring of APP operation behavior information and device environment information, the reliability of identification is enhanced, and then combined with multi-dimensional device information, APP operation behavior information and device environment information, a machine learning model is used for identification, the accuracy of cloud phone identification is improved, and the anti-deception ability of the platform is improved.

[0067] In one embodiment of the present invention, the recognition model is trained based on the following steps:

[0068] Acquire training data samples of multiple devices, wherein the training data samples include device information samples, APP running behavior information samples, and device environment information samples;

[0069] Extracting features from the device information sample, the APP operation behavior information sample, and the device environment information sample respectively to obtain multi-dimensional feature information to be trained;

[0070] Preprocessing the multi-dimensional feature information to be trained;

[0071] Based on the device label of each device and the pre-processed multi-dimensional feature information to be trained, the recognition model is obtained through iterative training.

[0072] Specifically, training data samples of multiple devices are obtained, wherein the training data samples include device information samples, APP operation behavior information samples, and device environment information samples; the specific detailed information included in the device information samples, APP operation behavior information samples, and device environment information samples are the same as the device information, APP operation behavior information, and device environment information in the above embodiments, and will not be repeated here. Feature extraction is performed on the device information samples, the APP operation behavior information samples, and the device environment information samples, respectively, to obtain multi-dimensional feature information to be trained, such as behavior feature information, device feature information, network feature information, and environment feature information; and then the multi-dimensional feature information to be trained is preprocessed, for example, normalized and standardized to improve the accuracy of model recognition; further, the preprocessed multi-dimensional feature information to be trained is input into the recognition model to obtain the recognition result, and the model loss value is calculated according to the recognition result and the device label of the device, so as to optimize the model parameters of the recognition model in combination with the model loss value. Thus, the trained recognition model is used to quickly and accurately identify cloud phones and assess their potential risks.

[0073] The embodiment of the present invention, through the above scheme, includes: obtaining training data samples of multiple devices, wherein the training data samples include device information samples, APP operation behavior information samples and device environment information samples; extracting features from the device information samples, the APP operation behavior information samples and the device environment information samples respectively to obtain multi-dimensional feature information to be trained; preprocessing the multi-dimensional feature information to be trained; iteratively training to obtain the recognition model based on the device label of each device and the preprocessed multi-dimensional feature information to be trained. The recognition model is trained by combining the device information, APP operation behavior and environment information of the device, so that the recognition model can learn multi-dimensional feature information, effectively improving the accuracy of the recognition model in recognizing cloud phones.

[0074] The cloud phone identification device provided by the present invention is described below. The cloud phone identification device described below and the cloud phone identification method described above can be referenced to each other.

[0075] Figure 2 : is a schematic diagram of the structure of the cloud phone identification device provided by the present invention, such as Figure 2 As shown, a cloud phone identification device according to an embodiment of the present invention includes:

[0076] Acquisition module 21, used to acquire device information, APP operation behavior information and device environment information of the object to be identified;

[0077] A feature extraction module 22 is used to extract features from the device information, the APP running behavior information and the device environment information to obtain multi-dimensional feature information;

[0078] The identification module 23 is used to input the multi-dimensional feature information into a pre-built identification model to obtain a risk identification result output by the identification model;

[0079] Among them, the risk identification result is used to characterize the risk level of the object to be identified being a cloud phone; the identification model is obtained by iterative training of multiple pre-collected training data samples and their device labels.

[0080] The cloud phone identification device also includes:

[0081] Acquire training data samples of multiple devices, wherein the training data samples include device information samples, APP running behavior information samples, and device environment information samples;

[0082] Extracting features from the device information sample, the APP operation behavior information sample, and the device environment information sample respectively to obtain multi-dimensional feature information to be trained;

[0083] Preprocessing the multi-dimensional feature information to be trained;

[0084] Based on the device label of each device and the pre-processed multi-dimensional feature information to be trained, the recognition model is obtained through iterative training.

[0085] The cloud phone identification device also includes:

[0086] For any multi-dimensional feature information to be trained:

[0087] Inputting the multi-dimensional feature information to be trained into the recognition model to obtain a recognition result output by the recognition model;

[0088] Based on the device tag and the recognition result, a model loss value is calculated;

[0089] Based on the model loss value, model parameters of the recognition model are optimized.

[0090] The cloud phone identification device also includes:

[0091] The device information includes hardware information, network information, operating system information and power status information;

[0092] The APP operation behavior information includes application startup frequency, running time and resource consumption information;

[0093] The device environment information includes the geographical location information of the device, WiFi hotspots and Bluetooth devices within a preset distance, and sensor data carried by the device.

[0094] The feature extraction module 22 is also used for:

[0095] Extracting features of the device information, the APP running behavior information, and the device environment information respectively to obtain behavior feature information, device feature information, network feature information, and environment feature information;

[0096] Based on the behavior characteristic information, the device characteristic information, the network characteristic information and the environment characteristic information, the multi-dimensional characteristic information is formed;

[0097] The behavior characteristic information includes the type, frequency and time distribution of APP applications installed and used by users;

[0098] The device feature information includes the hardware configuration information of the device, and the hardware configuration information includes the CPU model, memory size and storage space;

[0099] The network characteristic information includes the frequency of data transmission, data size and IP address, as well as the correlation characteristics between the IP address and user behavior;

[0100] The environmental characteristic information includes a movement pattern and a physical environment of the device, wherein the physical environment includes geographic location information.

[0101] The cloud phone identification device also includes:

[0102] A determination module, configured to determine that the object to be identified is a cloud phone with risks if the risk identification result exceeds a preset risk threshold;

[0103] A current limiting or intercepting module is used to limit or intercept access to the cloud phone.

[0104] The cloud phone identification device also includes:

[0105] The preprocessing module is used to normalize and standardize the multi-dimensional feature information.

[0106] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0107] Figure 3 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 3As shown, the electronic device may include: a processor 310, a memory 320, a communication interface 330 and a communication bus 340, wherein the processor 310, the memory 320, and the communication interface 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 320 to execute the cloud phone identification method.

[0108] In addition, the logic instructions in the above-mentioned memory 320 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0109] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the cloud phone identification method provided by the above-mentioned methods.

[0110] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0111] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cloud phone identification method, characterized in that: include: Obtain device information, APP operation behavior information, and device environment information of the object to be identified; Extracting features of the device information, the APP running behavior information, and the device environment information respectively to obtain multi-dimensional feature information; Inputting the multi-dimensional feature information into a pre-built recognition model to obtain a risk recognition result output by the recognition model; The risk identification result is used to characterize the risk level of the object to be identified being a cloud phone; The recognition model is obtained by iterative training of multiple training data samples and device labels collected in advance.

2. The cloud phone identification method according to claim 1, characterized in that: The recognition model is trained based on the following steps: Acquire training data samples of multiple devices, wherein the training data samples include device information samples, APP running behavior information samples, and device environment information samples; Extracting features from the device information sample, the APP operation behavior information sample, and the device environment information sample respectively to obtain multi-dimensional feature information to be trained; Preprocessing the multi-dimensional feature information to be trained; Based on the device label of each device and the pre-processed multi-dimensional feature information to be trained, the recognition model is obtained through iterative training.

3. The cloud phone identification method according to claim 2, characterized in that: The iterative training based on the device label of each device and the pre-processed multi-dimensional feature information to be trained to obtain the recognition model includes: For any multi-dimensional feature information to be trained: Inputting the multi-dimensional feature information to be trained into the recognition model to obtain a recognition result output by the recognition model; Based on the device tag and the recognition result, a model loss value is calculated; Based on the model loss value, model parameters of the recognition model are optimized.

4. The cloud phone identification method according to claim 1, characterized in that: The device information includes hardware information, network information, operating system information and power status information; The APP operation behavior information includes application startup frequency, running time and resource consumption information; The device environment information includes the geographical location information of the device, WiFi hotspots and Bluetooth devices within a preset distance, and sensor data carried by the device.

5. The cloud phone identification method according to claim 1, characterized in that: The feature extraction is performed on the device information, the APP operation behavior information and the device environment information respectively to obtain multi-dimensional feature information, including: Extracting features of the device information, the APP running behavior information, and the device environment information respectively to obtain behavior feature information, device feature information, network feature information, and environment feature information; Based on the behavior characteristic information, the device characteristic information, the network characteristic information and the environment characteristic information, the multi-dimensional characteristic information is formed; The behavior characteristic information includes the type, frequency and time distribution of APP applications installed and used by users; The device feature information includes the hardware configuration information of the device, and the hardware configuration information includes the CPU model, memory size and storage space; The network characteristic information includes the frequency of data transmission, data size and IP address, as well as the correlation characteristics between the IP address and user behavior; The environmental characteristic information includes a movement pattern and a physical environment of the device, wherein the physical environment includes geographic location information.

6. The cloud phone identification method according to claim 1, characterized in that: After inputting the multi-dimensional feature information into a pre-built recognition model to obtain the risk recognition result output by the recognition model, the method further includes: If the risk identification result exceeds the preset risk threshold, it is determined that the object to be identified is a cloud phone with risks; Access to the cloud phone is limited or blocked.

7. The cloud phone identification method according to claim 1, characterized in that: Before inputting the multi-dimensional feature information into a pre-built recognition model to obtain the risk recognition result output by the recognition model, the method further includes: The multi-dimensional feature information is normalized and standardized.

8. A cloud phone identification device, characterized in that: include: The acquisition module is used to obtain the device information, APP operation behavior information and device environment information of the object to be identified; A feature extraction module is used to extract features from the device information, the APP running behavior information and the device environment information to obtain multi-dimensional feature information; An identification module, used to input the multi-dimensional feature information into a pre-built identification model to obtain a risk identification result output by the identification model; The risk identification result is used to characterize the risk level of the object to be identified being a cloud phone; The recognition model is obtained by iterative training of multiple training data samples and device labels collected in advance.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the program, it implements the cloud phone identification method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the cloud phone identification method as described in any one of claims 1 to 7 is implemented.

Images