Equipment fingerprint detection method, target attribute determination method and related device

Abstract

The embodiment of the invention relates to a device fingerprint detection method, a target attribute determination method and a related device.The method comprises the steps that a target device fingerprint of a target device is obtained, and a target attribute value combination of the target device for a target attribute is analyzed from the target device fingerprint, the target attributes comprise hardware attributes, software attributes and / or network attributes; and detecting whether the target device fingerprint is a tampered device fingerprint or not by comparing the target attribute value combination with a reference attribute value combination in a database, the reference attribute value combination being an attribute value combination for the target attribute analyzed from the non-tampered device fingerprint. According to the embodiment of the invention, whether the device fingerprint is tampered or not can be automatically and accurately identified from the target attribute.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and in particular to a method for detecting a device fingerprint, a method for determining a target attribute, and related devices. Background Art

[0002] Device fingerprinting is a method used to identify and track Internet user devices, usually based on the attributes of the user's device, including operating system version, CPU model, GPU model, etc. Device fingerprinting is often used in the security field. For example, in scenarios such as mobile Internet and online transactions, device fingerprinting is widely used in risk control and anti-fraud strategies.

[0003] However, currently, criminals may try to tamper with the attribute values ​​of certain attributes of user devices, making the user device look like a different user device before and after the attribute values ​​are tampered with, thereby bypassing the device fingerprint recognition system. In other words, the device fingerprint recognition system cannot recognize whether the device fingerprint is a tampered device fingerprint. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present disclosure provide a method for detecting a device fingerprint, a method for determining a target attribute, and related devices.

[0005] A first aspect of an embodiment of the present disclosure provides a method for detecting a device fingerprint, the method comprising:

[0006] Acquire a target device fingerprint of a target device, and parse a target attribute value combination of the target device for a target attribute from the target device fingerprint, wherein the target attribute includes hardware attributes, software attributes and / or network attributes;

[0007] By comparing the target attribute value combination with a reference attribute value combination in a database, it is detected whether the target device fingerprint is a tampered device fingerprint, wherein the reference attribute value combination is an attribute value combination for the target attribute parsed from an untampered device fingerprint.

[0008] A second aspect of an embodiment of the present disclosure provides a method for determining a target attribute, including:

[0009] Acquire multiple samples, wherein the samples are attribute values ​​for multiple attributes parsed from an untampered device fingerprint, and each of the samples is marked with a real device ID of the corresponding device;

[0010] Dividing the multiple samples into a training set and a test set;

[0011] Inputting the training set and the real device ID corresponding to the training set into a linear model, and obtaining weight values ​​of the multiple attributes output by the linear model;

[0012] Inputting the test set into the linear model, so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes;

[0013] Calculate the mean square error based on the predicted device ID and the real device ID corresponding to the test set;

[0014] If the mean square error is greater than a preset error threshold, the weight values ​​of the multiple attributes are adjusted using a preset optimization algorithm, and the step of inputting the test set into the linear model is returned to so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes, until the mean square error is less than or equal to the preset error threshold, wherein the preset optimization algorithm includes a gradient descent method or a coordinate descent method;

[0015] The attribute corresponding to the attribute value whose weight value is greater than the preset weight threshold is used as the target attribute.

[0016] A third aspect of the embodiments of the present disclosure provides a device fingerprint detection apparatus, the apparatus comprising:

[0017] A first acquisition module is used to acquire a target device fingerprint of a target device, and parse a target attribute value combination of the target device for a target attribute from the target device fingerprint, wherein the target attribute includes a hardware attribute, a software attribute and / or a network attribute;

[0018] The first detection module is used to detect whether the target device fingerprint is a tampered device fingerprint by comparing the target attribute value combination with a reference attribute value combination in a database, wherein the reference attribute value combination is an attribute value combination for the target attribute parsed from the untampered device fingerprint.

[0019] A fourth aspect of an embodiment of the present disclosure provides a device for determining a target attribute, the device comprising:

[0020] A second acquisition module is used to acquire multiple samples, wherein the samples are attribute values ​​for multiple attributes parsed from a device fingerprint that has not been tampered with, and each of the samples is marked with a real device ID of the corresponding device;

[0021] A first division module, used for dividing the multiple samples into a training set and a test set;

[0022] A third acquisition module, used for inputting the training set and the real device ID corresponding to the training set into a linear model, and acquiring weight values ​​of the multiple attributes output by the linear model;

[0023] A first prediction module, configured to input the test set into the linear model, so that the linear model predicts a predicted device ID of a device corresponding to the test set according to weight values ​​of the multiple attributes;

[0024] A first determination module, configured to calculate a mean square error according to a predicted device ID and a real device ID corresponding to the test set;

[0025] A first adjustment module, if the mean square error is greater than a preset error threshold, uses a preset optimization algorithm to adjust the weight values ​​of the multiple attributes, and returns to the step of inputting the test set into the linear model so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes, until the mean square error is less than or equal to the preset error threshold, wherein the preset optimization algorithm includes a gradient descent method or a coordinate descent method;

[0026] The second determining module is used to take the attribute corresponding to the attribute value whose weight value is greater than the preset weight threshold as the target attribute.

[0027] A fifth aspect of an embodiment of the present disclosure provides an electronic device, which includes: a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor executes the method of the first aspect above.

[0028] A sixth aspect of an embodiment of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method of the first aspect described above can be implemented.

[0029] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0030] The disclosed embodiments can obtain the target device fingerprint of the target device, and parse out the target attribute value combination of the target device for the target attribute from the target device fingerprint, wherein the target attribute includes hardware attribute, software attribute and / or network attribute; by comparing the target attribute value combination with the reference attribute value combination in the database, it is detected whether the target device fingerprint is a tampered device fingerprint, wherein the reference attribute value combination is the attribute value combination for the target attribute parsed from the untampered device fingerprint. It can be seen that by adopting the above technical solution, it is possible to obtain the target attribute value combination for the target attribute of the target device starting from the target attribute, thereby detecting whether the target device fingerprint is a tampered device fingerprint by comparing the target attribute value combination with the reference attribute value combination, so that it is possible to automatically and accurately identify whether the device fingerprint has been tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0033] Figure 1 is a flow chart of a device fingerprint detection method provided by an embodiment of the present disclosure;

[0034] Figure 2 is a flow chart of a method for determining target attributes provided by an embodiment of the present disclosure;

[0035] Figure 3 It is a structural schematic diagram of a device fingerprint detection apparatus provided by an embodiment of the present disclosure;

[0036] Figure 4 is a structural schematic diagram of a device for determining target attributes provided by an embodiment of the present disclosure;

[0037] Figure 5 It is a structural schematic diagram of an electronic device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0039] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0040] Figure 1 1 is a flow chart of a device fingerprint detection method provided by an embodiment of the present disclosure, and the method can be performed by an electronic device. The electronic device can be exemplarily understood as a device such as a server, a tablet computer, a laptop computer, a desktop computer, etc. Figure 1 As shown, the method provided in this embodiment includes the following steps:

[0041] S110: Obtain a target device fingerprint of the target device, and parse a target attribute value combination of the target device for a target attribute from the target device fingerprint, wherein the target attribute includes hardware attributes, software attributes and / or network attributes.

[0042] Specifically, the target device may be any user device, for example, a mobile phone, a tablet computer, a notebook computer, a desktop computer, and / or a wearable device.

[0043] Specifically, the target device fingerprint is a device fingerprint of the target device, wherein the device fingerprint is generated according to attribute values ​​of multiple attributes of the device.

[0044] It should be noted that there are many specific ways to generate device fingerprints, which are not limited in this disclosure. For example, different attributes have different importance for user device identification. Some attributes have high uniqueness, while other attributes may be the same on multiple user devices. Therefore, when generating device fingerprints, the attribute values ​​of the attributes can be weighted to reflect their importance in distinguishing user devices. The weighted attribute values ​​are aggregated through an algorithm (such as a hash function, etc.) to generate a fixed-length string, namely the device fingerprint, wherein the hash function needs to meet certain security and randomness requirements to ensure that even slight changes in the input can produce significantly different outputs, thereby ensuring the uniqueness of the device fingerprint. But it is not limited to this.

[0045] Specifically, the target attribute is an attribute that has a significant impact on the device fingerprint. In other words, after the attribute value of the target attribute changes, the probability of the device fingerprint changing is high, that is, the target attribute is a high-weight attribute.

[0046] Optionally, the target attributes include hardware attributes, software attributes and / or network attributes. Further optionally, the hardware attributes include CPU model, GPU model, memory size, hard disk serial number, MAC address, International Mobile Equipment Identity (IMEI), and / or International Mobile Subscriber Identity (IMSI), etc.; software information includes operating system version, browser type and version, installed application list, font, screen resolution, and / or language setting, etc.; network information includes IP address, geographic location, network operator, and / or connection type (Wi-Fi, 4G / 5G), etc., but is not limited thereto.

[0047] Specifically, the target attribute value combination is a combination of attribute values ​​of the target attribute. When there is only one target attribute, the target attribute value combination includes only one attribute value, and when there are multiple target attributes, the target attribute value combination includes multiple attribute values.

[0048] Specifically, since the device fingerprint is generated based on the attribute values ​​of some attributes of the user device, the attribute values ​​of multiple attributes of the user device can be obtained by parsing the device fingerprint, and then the attribute values ​​of the target attributes can be screened out to obtain the target attribute value combination.

[0049] S120. Detect whether the target device fingerprint is a tampered device fingerprint by comparing the target attribute value combination with the reference attribute value combination in the database, wherein the reference attribute value combination is an attribute value combination for the target attribute parsed from the untampered device fingerprint.

[0050] Specifically, an untampered device fingerprint means that the attribute values ​​used to generate the device fingerprint have not been tampered with, and a tampered device fingerprint means that at least one of the attribute values ​​used to generate the device fingerprint has been tampered with. Among them, in some scenarios, the tampering of attribute values ​​is to replace the uniquely pointed attribute value with a non-uniquely pointed attribute value, such as changing the MAC address from the original value to another value. In other scenarios, the tampering of attribute values ​​is to replace the attribute value with an uncommon specification of its corresponding attribute, such as changing the memory size from 512G to 513G. But it is not limited to this.

[0051] In some embodiments, S120 may include: inputting the target attribute value combination and the reference attribute value combination into a trained detection model, and obtaining a detection result output by the detection model regarding "whether the target device fingerprint is a tampered device fingerprint".

[0052] In some other embodiments, S120 may include: S121, searching, from the reference attribute value combinations, K reference attribute value combinations that are closest to the target attribute value combination as neighboring attribute value combinations.

[0053] Specifically, the specific value of K can be set by those skilled in the art according to actual conditions, and is not limited thereto. Exemplarily, the specific value of K can be determined by a cross-validation algorithm, but is not limited thereto.

[0054] Specifically, the specific representation form of the similarity can be set by those skilled in the art according to actual conditions, and is not limited thereto. For example, the specific representation form of the similarity can include cosine similarity, Euclidean distance, or Manhattan distance, but is not limited thereto.

[0055] Specifically, the k-Nearest Neighbors algorithm (k-NN) is used to find K neighboring attribute value combinations from the reference attribute value combination. That is, for each reference attribute value combination, the similarity between the reference attribute value combination and the target attribute value combination is calculated, and the reference attribute value combinations of the K nearest neighbors are selected according to the similarity, thereby obtaining K neighboring attribute value combinations.

[0056] S122: Detect whether the target device fingerprint is a tampered device fingerprint based on K adjacent attribute value combinations.

[0057] In some examples, S122 includes: obtaining similarities between the target attribute value combination and each adjacent attribute value combination to obtain K similarities;

[0058] Counting the total number of similarities among the K similarities that are greater than a first preset similarity threshold;

[0059] If the total number is greater than a preset number threshold, the target device fingerprint is determined to be a device fingerprint that has not been tampered with; otherwise, the target device fingerprint is determined to be a device fingerprint that has been tampered with.

[0060] Specifically, the specific values ​​of the first preset similarity threshold and the preset quantity threshold can be set by those skilled in the art according to actual conditions, and are not limited thereto.

[0061] In some other examples, S122 includes: obtaining similarities between the target attribute value combination and each adjacent attribute value combination to obtain K similarities;

[0062] Calculate the average of K similarities;

[0063] If the average value is greater than the preset average threshold, the target device fingerprint is determined to be a device fingerprint that has not been tampered with; otherwise, the target device fingerprint is determined to be a device fingerprint that has been tampered with.

[0064] Specifically, the specific value of the preset average threshold can be set by those skilled in the art according to actual conditions and is not limited thereto.

[0065] It can be understood that judging whether the target attribute value combination is a tampered device fingerprint by k-NN is unbiased, because it only depends on the nearest neighbor attribute value combination and is not affected by the data distribution. In this way, the accuracy of the target attribute value combination judgment can be improved. In addition, compared with judging whether the target attribute value combination is abnormal by black and white lists, judging whether the target attribute value combination is a tampered device fingerprint by k-NN makes it possible to judge whether it is a tampered device fingerprint when the target attribute value combination is an attribute value combination that has not appeared before, which is conducive to improving the generalization of device fingerprint detection. And k-NN can easily perform incremental learning, that is, when receiving a new reference attribute value combination, it can be directly added to the existing multiple reference attribute value combinations without retraining, which is conducive to reducing costs.

[0066] Specifically, if the target attribute value combination includes a tampered attribute value, then it can be determined that the target device is abnormal, and further investigation can be performed on the target device.

[0067] The embodiments of the present disclosure can obtain the target attribute value combination of the target device for the key attributes starting from the key attributes (i.e., the attributes that are different between abnormal devices and normal devices), thereby determining whether the target device is abnormal based on whether the target attribute value combination is abnormal. In this way, it is possible to automatically and accurately identify whether the target device is abnormal.

[0068] Figure 2 1 is a flow chart of a device fingerprint detection method provided by an embodiment of the present disclosure, and the method can be performed by an electronic device. The electronic device can be exemplarily understood as a device such as a server, a tablet computer, a laptop computer, a desktop computer, etc. Figure 2 As shown, the method provided in this embodiment includes the following steps:

[0069] S210: Acquire multiple samples, wherein the samples are attribute values ​​for multiple attributes parsed from an untampered device fingerprint, and each sample is marked with a real device ID of its corresponding device.

[0070] Specifically, the specific method of obtaining multiple samples can be set by those skilled in the art according to actual conditions and is not limited here. Exemplarily, multiple untampered device fingerprints are obtained, and the attribute values ​​of multiple attributes are obtained by parsing them. The parsed attribute values ​​are converted to a unified scale using standard scaling (StandardScaler) or minimum and maximum scaling (MinMaxScaler), which helps the model training of the linear model and avoids the dimensional influence between model features (in the disclosed embodiment, the model features are attribute values). But it is not limited to this.

[0071] Specifically, the real device ID is the real ID of the user device corresponding to the device fingerprint that has not been tampered with, wherein the ID is used to uniquely identify the user device.

[0072] S220, dividing the multiple samples into a training set and a test set.

[0073] Specifically, a part of the samples is divided into a training set, and another part of the samples is divided into a test set.

[0074] S230: Input the training set and the real device ID corresponding to the training set into the linear model, and obtain the weight values ​​of multiple attributes output by the linear model.

[0075] Specifically, the linear model described here is the generalized linear model (GLM). GLM is a statistical modeling method that extends the traditional linear regression model, allowing the response variable to obey various distributions (such as normal distribution, Poisson distribution, binomial distribution, etc.), and can link the linear predictor to the expected value of the response variable through a link function. GLM is very suitable for processing non-continuous or categorical data.

[0076] The linear model used in the disclosed embodiment may include a Lasso regression (i.e., Least Absolute Shrinkage and Selection Operator) model, wherein the Lasso regression model penalizes larger regression coefficients by adding regularization strength to the loss function, thereby compressing the coefficients (i.e., weights) of some unimportant model features. This means that in the final Lasso regression model, only the most important model features will be retained, and other model features will be compressed to smaller values ​​(e.g., 0) due to their coefficients (i.e., weights), wherein the regularization strength value determines the magnitude of the penalty. However, it is not limited to this.

[0077] Specifically, the training set can form a training feature matrix A (two-dimensional array), in which each row represents a sample. For example, the training set includes 80,000 samples, each sample includes 100 attribute values, and the shape of the training feature matrix A is 80,000×100.

[0078] Specifically, the real device IDs corresponding to multiple samples in the training set form a one-dimensional array, which is recorded as a training target vector B. For example, if the training set includes 20,000 samples, the training target vector B includes 80,000 elements.

[0079] Specifically, the training feature matrix A and the training target vector B are input into the linear model, and the linear model attempts to find the optimal weight values ​​of multiple attributes to minimize the error between the predicted device ID and the actual device ID, and outputs the weight values ​​of multiple attributes.

[0080] S240 , input the test set into the linear model, so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of multiple attributes.

[0081] Specifically, the predicted device ID is the ID of the user device predicted by the linear model.

[0082] Specifically, the test set can form a test feature matrix X (two-dimensional array), where each row represents a sample. For example, the test set includes 20,000 samples, each sample includes 100 attribute values, and the shape of the test feature matrix X is 20,000×100.

[0083] Specifically, the real device IDs corresponding to the multiple samples in the test set form a one-dimensional array, which is recorded as the test target vector Y1. For example, if the test set includes 20,000 samples, the test target vector Y1 includes 20,000 elements.

[0084] Specifically, the linear model can predict the predicted device IDs corresponding to multiple samples in the test set based on the input test feature matrix X and the learned weight values ​​of multiple attributes, which are recorded as prediction vector Y2. For example, if the test set includes 20,000 samples, the prediction vector Y2 includes 20,000 elements.

[0085] S250: Calculate the mean square error according to the predicted device ID and the real device ID corresponding to the test set.

[0086] Specifically, for each sample in the test set, the difference between the predicted device ID and the true device ID is calculated to obtain the error value. Then, the error value of each sample is squared, and finally the square errors of all samples are averaged to obtain the mean square error.

[0087] S260. If the mean square error is greater than a preset error threshold, a preset optimization algorithm is used to adjust the weight values ​​of multiple attributes, and the step of inputting the test set into the linear model is returned so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes, until the mean square error is less than or equal to the preset error threshold, wherein the preset optimization algorithm includes a gradient descent method or a coordinate descent method.

[0088] Specifically, when the mean square error is less than or equal to the preset error threshold, the linear model is considered to have converged, iteration is stopped, and model training is completed; when the mean square error is greater than the preset error threshold, optimization algorithms such as gradient descent and coordinate descent are used to iteratively update the weight values ​​of each attribute value to minimize the mean square error of the linear model until the mean square error is less than or equal to the preset error threshold.

[0089] S270: Take the attribute corresponding to the attribute value whose weight value is greater than the preset weight threshold as the target attribute.

[0090] It should be noted that the specific value of the preset weight threshold can be set by those skilled in the art according to actual conditions and is not limited here.

[0091] Optionally, before inputting the training set and the real device ID corresponding to the training set into the linear model and obtaining the weight values ​​of multiple attributes output by the linear model, it also includes: determining the target regularization strength value of the linear model through a cross-validation algorithm; and configuring the regularization strength of the linear model to the target regularization strength value.

[0092] Specifically, GridSearchCV or RandomizedSearchCV etc. may be used to determine the target regularization strength value of the linear model, but the present invention is not limited thereto.

[0093] It is understandable that different regularization strength values ​​will lead to different degrees of regularization. Too large a regularization strength value may lead to underfitting, while too small a regularization strength value may lead to overfitting. By using the cross-validation algorithm to determine the target regularization strength value of the linear model, you can find a suitable regularization strength value to balance the model complexity and the risk of overfitting.

[0094] Optionally, the method further comprises: generating a target attribute combination according to the target attributes by enumeration or genetic algorithm;

[0095] For each sample, the attribute value with a weight value greater than the preset weight threshold is brought into the matching target attribute combination to obtain a reference attribute value combination;

[0096] Alternatively, for each sample, an attribute value combination consisting of attribute values ​​whose weight values ​​are greater than a preset weight threshold is used as a reference attribute value combination.

[0097] Specifically, after obtaining multiple target attributes, target attribute combinations can be generated by enumerating all possible combinations of target attributes or by using a genetic algorithm, wherein the target attribute combination includes at least one target attribute. For example, the target attributes include CPU model, GPU model, memory size, hard disk serial number, MAC address, operating system version, and IP address. By permuting and combining the seven target attributes, "7 factorial" target attribute combinations can be obtained.

[0098] Specifically, for each sample, the attribute value whose weight value is greater than the preset weight threshold is extracted, and the extracted attribute value is brought into the matching target attribute combination to obtain a reference attribute value combination, where the "matching target attribute combination" means that the attribute corresponding to the "extracted attribute value" can cover the attribute included in the "matching target attribute combination". For example, if the "extracted attribute value" includes "A (CPU model), B (GPU model)", and the target attribute combination includes "CPU model", "GPU model", and "CPU model, GPU model", then three reference attribute value combinations of "A", "B", and "A, B" can be obtained.

[0099] In this way, more diverse and representative combinations of target attributes can be generated.

[0100] Specifically, for each sample, the attribute values ​​whose weight values ​​are greater than the preset weight threshold are extracted, and the "extracted attribute values" automatically form a reference attribute value combination. For example, if the "extracted attribute values" include "A (CPU model), B (GPU model), 512 (memory size)", then "A, B, 512" is a reference attribute value combination. In this way, the method of obtaining the reference attribute value combination can be simple and convenient.

[0101] In the disclosed embodiment, the linear model has an inherent model feature selection capability, which can compress the weights of some unimportant model features, thereby compressing the weights of attributes that contribute less to distinguishing whether "the device fingerprint is a tampered device fingerprint". In this way, when subsequently judging whether "the device fingerprint is a tampered device fingerprint" based on the target attribute (the weight value is greater than the preset weight threshold), the accuracy and reliability of anomaly detection can be improved.

[0102] Figure 3 is a schematic diagram of the structure of a device fingerprint detection device provided by an embodiment of the present disclosure. The device fingerprint detection device can be understood as the above-mentioned electronic device or a part of the functional modules in the above-mentioned electronic device. Figure 2 As shown, the device fingerprint detection device includes:

[0103] A first acquisition module 310 is used to acquire a target device fingerprint of a target device, and parse a target attribute value combination of the target device for a target attribute from the target device fingerprint, wherein the target attribute includes hardware attributes, software attributes and / or network attributes;

[0104] The first detection module 320 is used to detect whether the target device fingerprint is a tampered device fingerprint by comparing the target attribute value combination with a reference attribute value combination in a database, wherein the reference attribute value combination is an attribute value combination for the target attribute parsed from the untampered device fingerprint.

[0105] Optionally, the first detection module 320 includes:

[0106] A first search submodule is used to search, from the reference attribute value combinations, K reference attribute value combinations that are closest to the target attribute value combination as neighboring attribute value combinations;

[0107] The first detection submodule is used to detect whether the target device fingerprint is a tampered device fingerprint according to the K adjacent attribute value combinations.

[0108] Optionally, the first detection submodule is specifically used to obtain the similarity between the target attribute value combination and each of the adjacent attribute value combinations to obtain K similarities;

[0109] Counting the total number of similarities among the K similarities that are greater than a first preset similarity threshold;

[0110] If the total number is greater than a preset number threshold, it is determined that the target device fingerprint is a device fingerprint that has not been tampered with; otherwise, it is determined that the target device fingerprint is a device fingerprint that has been tampered with.

[0111] Optionally, the first detection submodule is specifically configured to obtain similarities between the target attribute value combination and each of the adjacent attribute value combinations to obtain K similarities;

[0112] Calculate the average value of the K similarities;

[0113] If the average value is greater than a preset average threshold, it is determined that the target device fingerprint is a device fingerprint that has not been tampered with; otherwise, it is determined that the target device fingerprint is a device fingerprint that has been tampered with.

[0114] The device provided in this embodiment can execute the method of any of the above embodiments, and its execution method and beneficial effects are similar, which will not be repeated here.

[0115] Figure 4is a schematic diagram of a structure of a device for determining target attributes provided by an embodiment of the present disclosure. The device for determining target attributes can be understood as the above-mentioned electronic device or a part of the functional modules in the above-mentioned electronic device. Figure 4 As shown, the target attribute determination device includes:

[0116] A second acquisition module 410 is used to acquire multiple samples, wherein the samples are attribute values ​​for multiple attributes parsed from a device fingerprint that has not been tampered with, and each of the samples is marked with a real device ID of the corresponding device;

[0117] A first division module 420, configured to divide the plurality of samples into a training set and a test set;

[0118] A third acquisition module 430 is used to input the training set and the real device ID corresponding to the training set into a linear model, and obtain the weight values ​​of the multiple attributes output by the linear model;

[0119] A first prediction module 440, configured to input the test set into the linear model, so that the linear model predicts a predicted device ID of a device corresponding to the test set according to weight values ​​of the multiple attributes;

[0120] A first determination module 450 is used to calculate a mean square error according to the predicted device ID and the real device ID corresponding to the test set;

[0121] A first adjustment module 460, if the mean square error is greater than a preset error threshold, uses a preset optimization algorithm to adjust the weight values ​​of the multiple attributes, and returns to the step of inputting the test set into the linear model so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes, until the mean square error is less than or equal to the preset error threshold, wherein the preset optimization algorithm includes a gradient descent method or a coordinate descent method;

[0122] The second determination module 470 is configured to take the attribute corresponding to the attribute value having a weight value greater than a preset weight threshold as the target attribute.

[0123] Optionally, the apparatus further comprises: a first configuration module, configured to determine a target regularization strength value of the linear model by a cross-validation algorithm before inputting the training set and the real device ID corresponding to the training set into the linear model and obtaining the weight values ​​of the multiple attributes output by the linear model;

[0124] The regularization strength of the linear model is configured to be the target regularization strength value.

[0125] Optionally, the device further comprises: a third determination module, configured to generate a target attribute combination according to the target attribute by enumeration or genetic algorithm;

[0126] For each of the samples, the attribute value whose weight value is greater than a preset weight threshold is brought into the matching target attribute combination to obtain a reference attribute value combination;

[0127] Alternatively, for each of the samples, an attribute value combination consisting of attribute values ​​whose weight values ​​are greater than a preset weight threshold is used as the reference attribute value combination.

[0128] The device provided in this embodiment can execute the method of any of the above embodiments, and its execution method and beneficial effects are similar, which will not be repeated here.

[0129] An embodiment of the present disclosure further provides an electronic device, which includes: a memory, in which a computer program is stored; and a processor, for executing the computer program. When the computer program is executed by the processor, the method of any of the above embodiments can be implemented.

[0130] For example, Figure 5 Schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 5 , which shows a schematic diagram of the structure of an electronic device 500 suitable for implementing the embodiment of the present disclosure. The electronic device 500 in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0131] like Figure 5 As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0132] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0133] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0134] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0135] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0136] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0137] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains a target device fingerprint of the target device, and parses a target attribute value combination for a target attribute of the target device from the target device fingerprint, wherein the target attribute includes hardware attributes, software attributes and / or network attributes; detects whether the target device fingerprint is a tampered device fingerprint by comparing the target attribute value combination with a reference attribute value combination in a database, wherein the reference attribute value combination is an attribute value combination for the target attribute parsed from an untampered device fingerprint; or obtains multiple samples, wherein the samples are attribute values ​​for multiple attributes parsed from an untampered device fingerprint, and each of the samples is marked with a real device ID of the corresponding device; divides the multiple samples into a training set and a test set; and separates the training set and the training set. The real device ID corresponding to the set is input into the linear model, and the weight values ​​of the multiple attributes output by the linear model are obtained; the test set is input into the linear model, so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes; the mean square error is calculated according to the predicted device ID and the real device ID corresponding to the test set; if the mean square error is greater than a preset error threshold, the weight values ​​of the multiple attributes are adjusted using a preset optimization algorithm, and the step of inputting the test set into the linear model so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes is returned to, until the mean square error is less than or equal to the preset error threshold, wherein the preset optimization algorithm includes a gradient descent method or a coordinate descent method; the attribute corresponding to the attribute value whose weight value is greater than the preset weight threshold is used as the target attribute.

[0138] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0139] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0140] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0141] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0142] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0143] The embodiments of the present disclosure further provide a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method of any of the above embodiments can be implemented. The execution method and beneficial effects are similar and will not be repeated here.

[0144] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0145] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device fingerprint detection method, characterized in that: include: Acquire a target device fingerprint of a target device, and parse a target attribute value combination of the target device for a target attribute from the target device fingerprint, wherein the target attribute includes hardware attributes, software attributes and / or network attributes; By comparing the target attribute value combination with a reference attribute value combination in a database, it is detected whether the target device fingerprint is a tampered device fingerprint, wherein the reference attribute value combination is an attribute value combination for the target attribute parsed from an untampered device fingerprint.

2. The method according to claim 1, characterized in that: The detecting whether the target device fingerprint is a tampered device fingerprint by comparing the target attribute value combination with a reference attribute value combination in a database includes: From the reference attribute value combinations, searching for K reference attribute value combinations that are closest to the target attribute value combination as neighboring attribute value combinations; According to the K combinations of neighboring attribute values, it is detected whether the target device fingerprint is a tampered device fingerprint.

3. The method according to claim 2, characterized in that The detecting, based on the K combinations of neighboring attribute values, whether the target device fingerprint is a tampered device fingerprint includes: Obtaining the similarity between the target attribute value combination and each of the adjacent attribute value combinations to obtain K similarities; Counting the total number of similarities among the K similarities that are greater than a first preset similarity threshold; If the total number is greater than a preset number threshold, it is determined that the target device fingerprint is a device fingerprint that has not been tampered with; otherwise, it is determined that the target device fingerprint is a device fingerprint that has been tampered with.

4. The method according to claim 2, characterized in that: The detecting, based on the K combinations of neighboring attribute values, whether the target device fingerprint is a tampered device fingerprint includes: Obtaining the similarity between the target attribute value combination and each of the adjacent attribute value combinations to obtain K similarities; Calculate the average value of the K similarities; If the average value is greater than a preset average threshold, it is determined that the target device fingerprint is a device fingerprint that has not been tampered with; otherwise, it is determined that the target device fingerprint is a device fingerprint that has been tampered with.

5. A method for determining target attributes, characterized in that: include: Acquire multiple samples, wherein the samples are attribute values ​​for multiple attributes parsed from an untampered device fingerprint, and each of the samples is marked with a real device ID of the corresponding device; Dividing the multiple samples into a training set and a test set; Inputting the training set and the real device ID corresponding to the training set into a linear model, and obtaining weight values ​​of the multiple attributes output by the linear model; Inputting the test set into the linear model, so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes; Calculate the mean square error based on the predicted device ID and the real device ID corresponding to the test set; If the mean square error is greater than a preset error threshold, the weight values ​​of the multiple attributes are adjusted using a preset optimization algorithm, and the step of inputting the test set into the linear model is returned to so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes, until the mean square error is less than or equal to the preset error threshold, wherein the preset optimization algorithm includes a gradient descent method or a coordinate descent method; The attribute corresponding to the attribute value whose weight value is greater than the preset weight threshold is used as the target attribute.

6. The method according to claim 5, characterized in that Before inputting the training set and the real device ID corresponding to the training set into the linear model and obtaining the weight values ​​of the multiple attributes output by the linear model, the method further includes: Determining a target regularization strength value of the linear model by a cross-validation algorithm; The regularization strength of the linear model is configured to be the target regularization strength value.

7. The method according to claim 5, characterized in that Also includes: Generate a target attribute combination according to the target attributes by enumeration or genetic algorithm; For each of the samples, the attribute value whose weight value is greater than a preset weight threshold is brought into the matching target attribute combination to obtain a reference attribute value combination; Alternatively, for each of the samples, an attribute value combination consisting of attribute values ​​whose weight values ​​are greater than a preset weight threshold is used as the reference attribute value combination.

8. A device fingerprint detection apparatus, characterized in that: include: A first acquisition module is used to acquire a target device fingerprint of a target device, and parse a target attribute value combination of the target device for a target attribute from the target device fingerprint, wherein the target attribute includes a hardware attribute, a software attribute and / or a network attribute; The first detection module is used to detect whether the target device fingerprint is a tampered device fingerprint by comparing the target attribute value combination with a reference attribute value combination in a database, wherein the reference attribute value combination is an attribute value combination for the target attribute parsed from the untampered device fingerprint.

9. A device for determining target attributes, characterized in that: include: A second acquisition module is used to acquire multiple samples, wherein the samples are attribute values ​​for multiple attributes parsed from a device fingerprint that has not been tampered with, and each of the samples is marked with a real device ID of the corresponding device; A first division module, used for dividing the multiple samples into a training set and a test set; A third acquisition module, used for inputting the training set and the real device ID corresponding to the training set into a linear model, and acquiring weight values ​​of the multiple attributes output by the linear model; A first prediction module, configured to input the test set into the linear model, so that the linear model predicts a predicted device ID of a device corresponding to the test set according to weight values ​​of the multiple attributes; A first determination module, configured to calculate a mean square error according to a predicted device ID and a real device ID corresponding to the test set; A first adjustment module, if the mean square error is greater than a preset error threshold, uses a preset optimization algorithm to adjust the weight values ​​of the multiple attributes, and returns to the step of inputting the test set into the linear model so that the linear model predicts the predicted device ID of the device corresponding to the test set according to the weight values ​​of the multiple attributes, until the mean square error is less than or equal to the preset error threshold, wherein the preset optimization algorithm includes a gradient descent method or a coordinate descent method; The second determining module is used to take the attribute corresponding to the attribute value whose weight value is greater than the preset weight threshold as the target attribute.

10. An electronic device, characterized in that: include: A processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor executes the method according to any one of claims 1 to 4 or the method according to any one of claims 5 to 7.

11. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 4 or any one of claims 5 to 7 is implemented.

Images