Method and device for constructing risk identification model and equipment risk identification

Abstract

The invention relates to a method and a device for constructing a risk identification model and equipment risk identification, and the method comprises the steps: obtaining target equipment feature information corresponding to a target access request, and the target equipment feature information comprises target equipment display related parameters and target equipment access feature data; determining a target distribution probability that the target device display related parameters appear in a plurality of preset types of devices; generating a target feature group corresponding to the target access request according to the target distribution probability and the target device access feature data; and inputting the target feature group into a pre-constructed risk identification model, and outputting a risk identification result of the equipment corresponding to the target access request. The abnormal risk of equipment identity counterfeiting through some tools can be effectively recognized, and the recognition accuracy of the risk equipment is improved. The method can be applied to application forms such as H5 pages, web pages, mobile terminals and applets, and is wide in application range.

Description

Technical Field

[0001] The present disclosure relates to the fields of network security and artificial intelligence technologies, and in particular, to a method and apparatus for constructing a risk identification model and device risk identification. Background Art

[0002] With the development of Internet technology, the forms of various online services have become diverse, such as mobile applications (APPs), web applications, mini-programs, H5 (abbreviation for HTML5) pages, etc. For example, in the marketing and promotion scenario, the H5 pages of many enterprises are obtained by clicking on links from chat tools, and users can participate in marketing activities by clicking on buttons on the H5 pages, providing a good user experience. However, the forms of network attacks on various online services have also become diverse, such as using modification tools to modify device identity information and disguising as new users to avoid detection of illegal devices by service platforms; or maliciously obtaining or hoarding merchant discounts, brushing orders, and performing malicious traffic diversion by taking advantage of business, code, or platform vulnerabilities.

[0003] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following technical problems in the related art: When performing risk control on an online platform, the recognition effect of abnormal situations such as device identity tampering and forgery is poor. Summary of the Invention

[0004] To solve the above technical problems or at least partially solve the above technical problems, embodiments of the present disclosure provide a method and apparatus for constructing a risk identification model and device risk identification.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for device risk identification. The method for device risk identification includes: obtaining target device feature information corresponding to a target access request, where the target device feature information includes: target device display-related parameters and target device access feature data; determining a target distribution probability that the target device display-related parameters appear in multiple preset types of devices; generating a target feature group corresponding to the target access request according to the target distribution probability and the target device access feature data; and inputting the target feature group into a pre-constructed risk identification model to output a risk identification result of the device corresponding to the target access request.

[0006] According to an embodiment of the present disclosure, determining the target distribution probability that the above-mentioned target device display-related parameters appear in multiple preset type devices includes: matching the target device display-related parameters in a pre-constructed device parameter library; the above-mentioned device parameter library contains the distribution probability that the device display-related parameters appear in multiple preset type devices, and the above-mentioned distribution probability is obtained by statistically analyzing the device types corresponding to the device display-related parameters of historical access requests; in the case of matching the target device display-related parameters, querying to obtain the target distribution probability that the above-mentioned target device display-related parameters appear in multiple preset type devices.

[0007] According to an embodiment of the present disclosure, determining the target distribution probability that the above-mentioned target device display-related parameters appear in multiple preset type devices further includes: in the case of not matching the target device display-related parameters, obtaining the monitoring data of the display view window of the device corresponding to the above-mentioned target access request; according to the above-mentioned monitoring data, determining the device screen size corresponding to the above-mentioned target access request; according to the above-mentioned device screen size, allocating the target distribution probability that the above-mentioned target device display-related parameters appear in multiple preset type devices; wherein the maximum occurrence probability allocated matches the device type corresponding to the above-mentioned device screen size.

[0008] According to an embodiment of the present disclosure, the above-mentioned target device access feature data includes: target device access-related parameters and target device access behavior statistical data. According to the above-mentioned target distribution probability and the above-mentioned target device access feature data, generating the target feature group corresponding to the above-mentioned target access request includes: respectively performing encoding processing on the target distribution probability corresponding to the above-mentioned target device display-related parameters, the above-mentioned target device access-related parameters, and the statistical data of the change in the above-mentioned target device access behavior to obtain the corresponding probability encoding feature, parameter encoding feature, and access behavior encoding feature; splicing the above-mentioned probability encoding feature, the above-mentioned parameter encoding feature, and the above-mentioned access behavior encoding feature to obtain the above-mentioned target feature group.

[0009] According to an embodiment of the present disclosure, the above-mentioned target device access feature data includes: target device access related parameters and target device access behavior statistical data. The above-mentioned device display related parameters include at least two of the following: type of browser (such as IE, firefox, Chrome), operating system (such as Android, IOS, Linux, etc.), system platform type (platform), user agent information (useragent), system language (system language), screen resolution (screen resolution), plugin list (pluginlist), browser extensions (extensions), color depth (colorDepth), device pixel ratio (device PixelRatio), vendor information of the graphics card (wuv), graphics card information (wur), WebGL version, font list, RGB information of colors. The above-mentioned target device access related parameters include at least one of the following: device IP address, URL address to be accessed by the device, canvas fingerprint. The above-mentioned target device access behavior statistical data includes at least one of the following information of the device or the corresponding change information within a preset statistical period: number of users, IP address, appearance area, number of accessed web pages, access duration, user agent (UA) corresponding to the device identifier.

[0010] According to an embodiment of the present disclosure, the above-mentioned risk identification model is constructed in the following manner: Obtain the device feature information corresponding to multiple historical access requests in the training set, and the above-mentioned device feature information includes: device display related parameters, device access feature data; statistically analyze the distribution probability of the above-mentioned device display related parameters appearing in multiple preset types of devices, obtain the statistical result of the distribution probability and store it in the device parameter library; for each historical access request, generate a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display related parameters and the above-mentioned device access feature data; input the above-mentioned training feature group into the classification prediction model to be trained for training, and the training label is the true result of whether the initiating device of the corresponding historical access request is a risk device, and the output of the above-mentioned classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risk device; use the trained classification prediction model as the risk identification model; alternatively, perform parameter tuning on the trained classification prediction model based on the test set data, and use the classification prediction model with the test effect meeting the set indicators after parameter tuning as the risk identification model.

[0011] According to an embodiment of the present disclosure, the above-mentioned method for device risk identification further includes: performing corresponding response processing on the above-mentioned target access request according to the above-mentioned risk identification result.

[0012] Second aspect, an embodiment of the present disclosure provides a method for constructing a risk identification model. The method for constructing the risk identification model includes: obtaining device feature information corresponding to multiple historical access requests in a training set, where the device feature information includes: device display-related parameters, device access feature data; statistically calculating the distribution probability of the device display-related parameters appearing in multiple preset types of devices to obtain a statistical result of the distribution probability; for each historical access request, generating a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display-related parameters and the device access feature data; inputting the training feature group into a classification prediction model to be trained, where the training label is the true result of whether the initiating device of the corresponding historical access request is a risk device, and the output of the classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risk device; using the trained classification prediction model as the risk identification model; or, performing parameter tuning on the trained classification prediction model based on test set data, and using the classification prediction model with test effects meeting the set indicators after parameter tuning as the risk identification model.

[0013] Third aspect, an embodiment of the present disclosure provides a device risk identification apparatus. The device risk identification apparatus includes: a first device feature acquisition module, a first probability determination module, a first feature generation module, and a risk identification module. The first device feature acquisition module is configured to obtain target device feature information corresponding to a target access request, where the target device feature information includes: target device display-related parameters, target device access feature data. The first probability determination module is configured to determine a target distribution probability of the target device display-related parameters appearing in multiple preset types of devices. The first feature generation module is configured to generate a target feature group corresponding to the target access request according to the target distribution probability and the target device access feature data. The risk identification module is configured to input the target feature group into a pre-constructed risk identification model and output a risk identification result of the device corresponding to the target access request.

[0014] Fourth aspect, an embodiment of the present disclosure provides an apparatus for constructing a risk identification model. The apparatus for constructing the risk identification model includes: a second device feature acquisition module, a second probability determination module, a second feature generation module, a training module, and a model generation module. The second device feature acquisition module is configured to acquire device feature information corresponding to a plurality of historical access requests in a training set, where the device feature information includes: device display related parameters, device access feature data. The second probability determination module is configured to count the distribution probability of the device display related parameters appearing in a plurality of preset type devices to obtain a statistical result of the distribution probability. The second feature generation module is configured to generate a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display related parameters and the device access feature data for each historical access request. The training module is configured to input the training feature group into a classification prediction model to be trained for training, and the training label is the true result of whether the initiating device of the corresponding historical access request is a risk device, and the output of the classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risk device. The model generation module is configured to use the trained classification prediction model as the risk identification model; or, perform parameter tuning on the trained classification prediction model based on test set data, and use the classification prediction model with test effects meeting the set indicators after parameter tuning as the risk identification model.

[0015] Fifth aspect, an embodiment of the present disclosure provides an electronic device. The electronic device includes a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete communication with each other through the communication bus; the memory is used to store a computer program; the processor is configured to, when executing the program stored on the memory, implement the method for device risk identification or the method for constructing a risk identification model as described above.

[0016] Sixth aspect, an embodiment of the present disclosure provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, it implements the method for device risk identification or the method for constructing a risk identification model as described above.

[0017] The above technical solutions provided by the embodiments of the present disclosure have at least some or all of the following advantages:

[0018] Since the obtained target device feature information covers the target device display-related parameters and the target device access feature data, the target device display-related parameters describe the device features from the dimensions related to device display, and the target device access feature data describes the device features from dimensions such as access behavior and access parameters. By determining the target distribution probability of the above-mentioned target device display-related parameters appearing in multiple preset types of devices, it is possible to determine which preset device type the device probably belongs to. In this way, for some attack forms such as device identity forgery and tampering, the target feature group that combines the target distribution probability and the target device access feature data can achieve cross-verification of multi-dimensional features after being input into the risk recognition model, effectively identify the abnormal risk of device identity forgery through some tools, and improve the recognition accuracy of risk devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into and constitute a part of this specification, showing embodiments consistent with the present disclosure and, together with the specification, are used to explain the principles of the present disclosure.

[0020] To more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the accompanying drawings required for use in the description of the embodiments or the related art. Obviously, for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0021] Figure 1 Schematically shows the system architecture applicable to the method for device risk recognition and the method for constructing a risk recognition model in the embodiments of the present disclosure;

[0022] Figure 2 Schematically shows the flowchart of the method for device risk recognition according to an embodiment of the present disclosure;

[0023] Figure 3 Schematically shows the detailed implementation flowchart of step S220 according to an embodiment of the present disclosure;

[0024] Figure 4 Schematically shows the flowchart of the method for device risk recognition according to another embodiment of the present disclosure;

[0025] Figure 5 Schematically shows the flowchart of the method for constructing a risk recognition model according to an embodiment of the present disclosure;

[0026] Figure 6 Schematically shows the structural block diagram of the device for device risk recognition according to an embodiment of the present disclosure;

[0027] Figure 7A structural block diagram of a device for constructing a risk identification model according to an embodiment of the present disclosure is schematically shown;

[0028] Figure 8 A structural block diagram of an electronic device provided by an embodiment of the present disclosure is schematically shown. Detailed implementation manners

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure. Apparently, the described embodiments are some but not all of the embodiments of the present disclosure. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts shall fall within the scope of protection of the present disclosure.

[0030] Figure 1 A system architecture applicable to the methods of device risk identification and constructing a risk identification model according to the embodiments of the present disclosure is schematically shown.

[0031] Referring to Figure 1 As shown, the system architecture 100 applicable to the methods of device risk identification and constructing a risk identification model according to the embodiments of the present disclosure includes: terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is a medium providing a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0032] Users can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. The terminal devices 101, 102, 103 may be electronic devices with a display screen, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, smart watches, smart bracelets, vehicle-mounted terminals, etc. Various forms of business systems such as web applications, mobile applications (APPs), H5 page applications, and mini programs may be installed on the terminal devices. The above business systems may be shopping applications, web browser applications, video playback applications, search applications, news and information applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0033] The server 105 can be a server that provides various services. For example, it can be a background management server (only an example) that provides service support for the web pages accessed by users using the terminal devices 101, 102, and 103. The background management server can analyze and process the received access requests, and feedback the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The above server can be an application server, a cloud server, the master node in a service cluster, or a processing node in a distributed service cluster, etc.

[0034] It should be noted that the methods for device risk identification and for constructing a risk identification model provided in the embodiments of the present disclosure can generally be executed by the server 105 or a terminal device with certain computing capabilities. Correspondingly, the devices for device risk identification and for constructing a risk identification model provided in the embodiments of the present disclosure can generally be set in the server 105 or the above-mentioned terminal device with certain computing capabilities. The methods for device risk identification and for constructing a risk identification model provided in the embodiments of the present disclosure can also be executed by a server or a service cluster that is different from the server 105 and can communicate with at least one of the terminal devices 101, 102, 103 and the server 105. Correspondingly, the methods for device risk identification and for constructing a risk identification model provided in the embodiments of the present disclosure can also be set in a server or a service cluster that is different from the server 105 and can communicate with at least one of the terminal devices 101, 102, 103 and the server 105.

[0035] It should be understood that Figure 1 the numbers of the terminal devices, the network, and the server in

[0036] The first exemplary embodiment of the present disclosure provides a method for device risk identification.

[0037] Figure 2 Schematically shown is a flowchart of the method for device risk identification according to an embodiment of the present disclosure.

[0038] Referring to Figure 2 as shown, the method for device risk identification provided in the embodiments of the present disclosure includes the following steps: S210, S220, S230, and S240.

[0039] In step S210, obtain the target device feature information corresponding to the target access request, where the target device feature information includes: target device display-related parameters, target device access feature data.

[0040] The target access request can come from various types of devices, such as PC (personal computer) terminals, Android mobile terminals (mobile terminals based on the Android operating system, which can cover smartphones, tablets, smartwatches, smart bracelets, in-vehicle terminals, etc., and subsequent similar expressions shall be understood accordingly), IOS mobile terminals, HarmonyOS mobile terminals, etc. The presentation form of the access page corresponding to the target access request can be application interface display, web version interface display, mini-program display, H5 page display, etc.

[0041] The target device display related parameters describe the device characteristics from the dimensions related to device display.

[0042] For example, in some embodiments, the above-mentioned device display related parameters include at least two of the following: the type of browser (such as IE, firefox, Chrome), the operating system (such as Android, IOS, Linux, etc.), the system platform type (platform), the user agent information (useragent), the system language (system language), the screen resolution (screen resolution), the plugin list (pluginlist), the browser extensions (extensions), the color depth (colorDepth), the device pixel ratio (device PixelRatio), the vendor information of the graphics card (wuv), the graphics card information (wur), the WebGL (a technology for 3D drawing based on web pages) version, the font list, the RGB (red, green, and blue primary colors) information of the color (sc), etc.

[0043] The target device access feature data describes the device characteristics from dimensions such as access behavior and access parameters.

[0044] In some embodiments, the above-mentioned target device access feature data includes: target device access related parameters and target device access behavior statistical data.

[0045] The above-mentioned target device access related parameters include at least one of the following: the device IP address, the URL address that the device wants to access, the Canvas fingerprint, etc. The Canvas fingerprint is used to distinguish different devices. If there are differences in at least one of the device model, operating system, and browser, the generated Canvas fingerprints can be distinguished. If the device model, operating system, browser, etc. are all the same, the same Canvas fingerprint will be generated. Each browser uses a different image processing engine, different export options, and different compression levels, so the graphics drawn by each electronic device will be slightly different. These patterns can be used to assign a specific number (fingerprint) to the user device, that is, they can be used to identify different users. The fingerprint generated based on this principle is the Canvas fingerprint.

[0046] The aforementioned target device access behavior statistics include at least one of the following information about the device during a preset statistical period, or corresponding changes thereto: number of users, IP addresses, regions of occurrence, number of URLs visited, duration of visits, and user agent corresponding to the device identifier. Examples include: the number of users on the device in the last 24 hours, the number of users on the device in the last 48 hours, the number of IP addresses used by the device in the last 24 hours, the number of provinces in which the device identifier EID appeared in the last hour, the number of user agents corresponding to the device identifier EID, and the number of URLs visited by the device identifier EID.

[0047] In step S220 , the target distribution probability of the target device display-related parameter appearing in multiple preset types of devices is determined.

[0048] Different types of terminal devices, such as PC, Android, and iOS, access H5 web pages on the Internet. JavaScript (a front-end interpreted scripting language) scripts collect terminal browser data items when users initiate access requests. Since the collected data items corresponding to different types of devices are different, by mining these differences, anomalies in the devices used by users can be effectively identified.

[0049] Since different types of devices (such as PC and mobile terminals, or the subcategories of mobile terminals: Android and IOS terminals) differ in at least one aspect of the display hardware and display strategies (software level), this difference can be utilized to obtain statistics on the device types corresponding to the device display-related parameters of a large number of historical access requests, and the distribution probability of each device display parameter belonging to each type of device can be obtained. The device parameter library is thus constructed, which contains the distribution probability of device display-related parameters appearing in multiple preset types of devices.

[0050] The specific process may include: filtering out the devices of risky users based on the user level and business risk, taking the devices of normal users as the reference objects, dividing the device terminals into three categories: PC terminals, Android terminals, and IOS terminals according to the system platform (platform), and calculating the probability values of 9 browser data collection items (the specific number and types of browser data collection items are only for illustration purposes and may be part or all of the relevant parameters displayed by the target device): fontlist, wuv, wur, extensions, colorDepth, extensions, pluginlist, devicepixelratio, sc, on these three types of terminal types, and then distinguishing which device type the browser parameter belongs to to form an effective device parameter library. For example, the device parameter value of the graphics card information Mali-G78 collected appears on 10,000 devices in total, among which the number of devices on the Android side is 9,998, the number of devices on the IOS side is 1, and the number of devices on the PC side is 1. That is, the ratio of this device parameter value Mali-G78 belonging to the Android side reaches 99.98%, the ratio belonging to the IOS side is 0.01%, and the ratio belonging to the PC side is 0.01%. Therefore, when the device parameter value corresponding to a piece of device collection information is Mali-G78, this device is very likely to be an Android terminal. Another example is that the graphics card model Apple GPU belongs to the IOS side, and the graphics card model ANGLE (Intel(R) UHD Graphics620Direct3D11 vs_5_0ps_5_0) belongs to the PC side. Through cross-verification of multiple collection items in the parameter library, it is possible to effectively identify the simulation of the APP side on the PC side and the abnormal conditions of data on different terminals. In addition, by further combining the access feature data of the target device, it is possible to effectively improve the identification of risks such as device identity forgery and tampering.

[0051] Figure 3 Schematically shows a detailed implementation flowchart of step S220 according to an embodiment of the present disclosure.

[0052] According to an embodiment of the present disclosure, with reference to Figure 3 As shown, in the above step S220, determining the target distribution probability that the above-mentioned target device display-related parameters appear on multiple preset type devices includes the following steps: S310 and S321.

[0053] In step S310, match the target device display-related parameters in the pre-constructed device parameter library.

[0054] The above-mentioned device parameter library includes the distribution probability that the device display-related parameters appear on multiple preset type devices, and the above-mentioned distribution probability is obtained by statistically analyzing the device types corresponding to the device display-related parameters of historical access requests.

[0055] The types and quantities of device display-related parameters, preset type devices, etc. in the device parameter library can be continuously enriched according to the continuous evolution of attack and defense.

[0056] In step S321, when the target device display related parameters are matched, the target distribution probability of the target device display related parameters appearing in multiple preset types of devices is obtained by query.

[0057] For example, the target device display-related parameters include multiple parameters a to c. Parameter a corresponds to the target distribution probabilities of 0.4, 0.3, and 0.3 for three preset types of devices (e.g., PC, Android, and IOS), respectively; parameter b corresponds to the target distribution probabilities of 0.6, 0.1, and 0.3 for the above three preset types of devices, respectively; and parameter c corresponds to the target distribution probabilities of 0.8, 0.1, and 0.1 for the above three preset types of devices, respectively. By comprehensively analyzing the target distribution probabilities corresponding to all target device display-related parameters, it can be predicted that the device type is most likely a PC. In order to accurately identify situations where the user identity corresponding to the forged device is identified as a new user identity due to device identity forgery or tampering, a target feature group can be generated based on the target distribution probabilities corresponding to these target device display-related parameters and the target device access feature data. This allows for internal cross-validation based on the correspondence between the device and multiple parameters, and multi-dimensional cross-validation based on device access behavior and parameter features, effectively improving the accuracy of device risk identification.

[0058] Reference Figure 3 As shown in the dotted box, the above step S220 also includes the following negative branch steps: S322, S332 and S342.

[0059] In step S322, when the display-related parameters of the target device cannot be matched, monitoring data of the display view window of the device corresponding to the target access request is obtained.

[0060] In some implementation scenarios, when the target device display-related parameters cannot be matched, the server can send a monitoring request for monitoring the display view window of its own device to the terminal device that initiates the target access request. The monitoring period can be specified or not specified according to actual conditions.

[0061] In step S332, the device screen size corresponding to the target access request is determined based on the monitoring data.

[0062] After receiving the monitoring data fed back by the terminal device, the device screen size is determined according to the change characteristics of the display view window in the monitoring data.

[0063] In step S342, according to the above device screen size, corresponding target distribution probabilities that appear in multiple preset types of devices are assigned to the relevant parameters displayed for the above target device; where the maximum occurrence probability assigned matches the device type corresponding to the above device screen size.

[0064] In some implementation scenarios, there are differences between the device screen sizes of PC devices and mobile devices; there are also differences between some types of mobile devices, such as differences in screen sizes among these mobile types of smart watches, smartphones, and tablets.

[0065] In step S342, for example, if the device screen size indicates that the device corresponding to the target access request is a PC device, then for the preset types: PC device, IOS device, and Android device, the following target distribution probabilities can be correspondingly assigned: 0.8 (a value greater than 0.5), 0.1, 0.1.

[0066] In the embodiment including steps S310, S321, S322, S332, and S342, by matching the relevant parameters for target device display in a pre-constructed device parameter library, and using the big data information associated with the parameters corresponding to historical access requests and devices to obtain the distribution probabilities of the parameters belonging to each type of device, it has a relatively reliable reference value; at the same time, it also provides a processing logic in the case where the parameters in the device parameter library do not exist. By monitoring the display view window of the device corresponding to the target access request, the device screen size is determined and the target distribution probabilities of multiple preset types of devices are assigned accordingly, so that the maximum occurrence probability assigned matches the device type corresponding to the above device screen size, and the target distribution probability also has a certain reference value, effectively improving the accuracy of subsequent cross-verification based on multiple internal parameters and cross-verification and risk identification based on multiple features (including the parameter-device correspondence, access behavior characteristics, etc.).

[0067] In step S230, according to the above target distribution probability and the above target device access feature data, a target feature group corresponding to the above target access request is generated.

[0068] In some embodiments, the above target device access feature data includes: target device access related parameters and target device access behavior statistical data.

[0069] According to the above target distribution probability and the above target device access feature data, generate a target feature group corresponding to the above target access request, including: respectively encoding the target distribution probability corresponding to the relevant parameters of the above target device display, the above target device access relevant parameters, and the above target device access behavior change statistical data to obtain corresponding probability encoding features, parameter encoding features, and access behavior encoding features; splicing the above probability encoding features, the above parameter encoding features, and the above access behavior encoding features to obtain the above target feature group.

[0070] In step S240, input the above target feature group into a pre-constructed risk identification model, and output the risk identification result of the device corresponding to the above target access request.

[0071] In some embodiments, the above risk identification model may be a classification prediction model trained based on algorithms such as xgboost (gradient boosting decision tree), RF (random forest), or ANN (artificial neural network). In this embodiment, the xgboost algorithm is adopted.

[0072] According to an embodiment of the present disclosure, the above risk identification model is constructed as follows: Obtain device feature information corresponding to multiple historical access requests in the training set, where the above device feature information includes: device display related parameters, device access feature data; statistically calculate the distribution probability of the above device display related parameters appearing in multiple preset types of devices (such as PC terminals, mobile terminals, and mobile terminals can be further divided into Android terminals, IOS terminals, HarmonyOS terminals, etc.), obtain the statistical result of the distribution probability and store it in the device parameter library; for each historical access request, generate a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display related parameters and the above device access feature data; input the above training feature group into a classification prediction model to be trained for training, and the training label is the true result of whether the initiating device of the corresponding historical access request is a risk device, and the output of the above classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risk device; use the trained classification prediction model as the risk identification model; or, perform parameter tuning on the trained classification prediction model based on the test set data, and use the classification prediction model with the test effect meeting the set indicators after parameter tuning as the risk identification model.

[0073] Based on the above steps S210 - S240, since the obtained target device feature information covers the target device display - related parameters and the target device access feature data, the target device display - related parameters describe the device features from the dimensions related to device display, and the target device access feature data describes the device features from dimensions such as access behavior and access parameters. By determining the target distribution probability of the above - mentioned target device display - related parameters appearing in multiple preset types of devices, it is possible to determine which preset device type the device most likely belongs to. In this way, for some attack forms such as device identity forgery and tampering, the target feature group that combines the target distribution probability and the target device access feature data can achieve cross - verification of multi - dimensional features after being input into the risk recognition model, effectively identifying the abnormal risk of device identity forgery using some tools, improving the recognition accuracy of risk devices, being applicable to various application forms (such as H5 pages, web - based applications, mobile applications, applets, etc.), and having a wide range of usage scenarios.

[0074] Figure 4 Schematically shows a flowchart of a method for device risk recognition according to another embodiment of the present disclosure.

[0075] According to an embodiment of the present disclosure, in addition to the above - mentioned steps S210 - S240, the above - mentioned method for device risk recognition further includes the following steps: S410, perform corresponding response processing on the above - mentioned target access request according to the above - mentioned risk recognition result.

[0076] In the case where the above - mentioned risk recognition result indicates that the device corresponding to the above - mentioned target access request has a risk, execute the preset risk device response logic, such as returning an error message, sending a reminder of logging in from a different location and requiring two - factor verification with a verification code, returning a reminder of an unusual device and requiring two - factor verification with a verification code, etc.

[0077] In the case where the above - mentioned risk recognition result indicates that the device corresponding to the above - mentioned target access request has no risk, execute the normal response processing logic. For example, return the corresponding web page, information, or resource, etc.

[0078] The second exemplary embodiment of the present disclosure provides a method for constructing a risk recognition model.

[0079] Figure 5 Schematically shows a flowchart of a method for constructing a risk recognition model according to an embodiment of the present disclosure.

[0080] Refer to Figure 5 As shown, the method for constructing a risk recognition model provided by the embodiment of the present disclosure includes the following steps: S510, S520, S530, S540, and S550.

[0081] In step S510, obtain the device feature information corresponding to multiple historical access requests in the training set. The above device feature information includes: device display-related parameters and device access feature data.

[0082] In step S520, count the distribution probability of the above device display-related parameters appearing in multiple preset types of devices to obtain the statistical result of the distribution probability. In some embodiments, the above statistical result is stored in the device parameter library. During the usage phase, query the target distribution probability corresponding to the target access request from the device parameter library.

[0083] In step S530, for each historical access request, generate a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display-related parameters and the above device access feature data.

[0084] In step S540, input the above training feature group into the classification prediction model to be trained for training. The training label is the true result of whether the initiating device of the corresponding historical access request is a risky device. The output of the above classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risky device.

[0085] Steps S510 to S540 of this embodiment can refer to the detailed description of steps S410 to S440 in the first embodiment. The difference is that this embodiment is the training phase, and the first embodiment is the usage phase of the model. The corresponding inputs of the two are the inputs of the training phase and the model usage phase respectively.

[0086] In step S550, use the trained classification prediction model as the risk identification model; or, perform parameter tuning on the trained classification prediction model based on the test set data, and use the classification prediction model with the test effect meeting the set indicators after parameter tuning as the risk identification model.

[0087] In some embodiments, when the number of training times reaches the set number of times or the loss function indicating the gap between the training output and the training label is less than the set threshold, it is regarded as the training being completed.

[0088] In the process of constructing the risk identification model in this embodiment, since the obtained device feature information covers device display-related parameters and device access feature data, the device display-related parameters describe device features from the dimensions related to device display, and the device access feature data describes device features from dimensions such as access behavior and access parameters. By statistically analyzing the distribution probability of the above-mentioned device display-related parameters in a large number of historical access requests in multiple preset types of devices and constructing a device parameter library, for some attack forms such as device identity forgery and tampering, the target feature group that combines the distribution probability and device access feature data is used as the training input of the classification prediction model, which can realize cross-validation of multi-dimensional features. The constructed risk identification model can effectively identify the abnormal risk of device identity forgery through some tools, improve the recognition accuracy of risk devices, and is applicable to various application forms (such as H5 pages, web applications, mobile applications, applets, etc.), with a wide range of usage scenarios.

[0089] The third exemplary embodiment of the present disclosure provides a device for identifying device risks.

[0090] Figure 6 Schematically shows a structural block diagram of a device for identifying device risks according to an embodiment of the present disclosure.

[0091] Refer to Figure 6 As shown, the device 600 for identifying device risks provided by the embodiment of the present disclosure includes: a first device feature acquisition module 601, a first probability determination module 602, a first feature generation module 603, and a risk identification module 604.

[0092] The above-mentioned first device feature acquisition module 601 is used to acquire target device feature information corresponding to a target access request, and the above-mentioned target device feature information includes: target device display-related parameters, target device access feature data.

[0093] The above-mentioned first probability determination module 602 is used to determine the target distribution probability of the above-mentioned target device display-related parameters in multiple preset types of devices.

[0094] The above-mentioned first feature generation module 603 is used to generate a target feature group corresponding to the target access request according to the above-mentioned target distribution probability and the above-mentioned target device access feature data.

[0095] The above-mentioned risk identification module 604 is used to input the above-mentioned target feature group into a pre-constructed risk identification model and output a risk identification result of the device corresponding to the target access request.

[0096] In some embodiments, the above-mentioned device 600 further includes: a request processing module.

[0097] The above request processing module is used to perform corresponding response processing on the above target access request according to the above risk identification result.

[0098] According to an embodiment of the present disclosure, the above risk identification model is constructed in the following manner: obtaining device feature information corresponding to multiple historical access requests in a training set, where the device feature information includes: device display-related parameters, device access feature data; statistically calculating the distribution probability of the above device display-related parameters appearing in multiple preset types of devices, obtaining the statistical result of the distribution probability and storing it in a device parameter library; for each historical access request, generating a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display-related parameters and the above device access feature data; inputting the above training feature group into a classification prediction model to be trained for training, where the training label is the true result of whether the initiating device of the corresponding historical access request is a risky device, and the output of the above classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risky device; using the trained classification prediction model as the risk identification model; or, performing parameter tuning on the trained classification prediction model based on test set data, and using the classification prediction model with test effects meeting the set indicators after parameter tuning as the risk identification model.

[0099] In some embodiments, the above device 600 can construct a risk identification model by itself; or, the above device 600 stores a pre-constructed risk identification model, and the device can access the pre-constructed risk identification model, and the risk identification model is constructed in another device (different from the device 600).

[0100] For more details of this embodiment, reference can be made to the relevant description of the first embodiment, which will not be elaborated here.

[0101] The fourth exemplary embodiment of the present disclosure provides a device for constructing a risk identification model.

[0102] Figure 7 Schematically shows a structural block diagram of a device for constructing a risk identification model according to an embodiment of the present disclosure.

[0103] Refer to Figure 7 As shown, the device 700 for constructing a risk identification model provided by the embodiment of the present disclosure includes: a second device feature acquisition module 701, a second probability determination module 702, a second feature generation module 703, a training module 704, and a model generation module 705.

[0104] The above second device feature acquisition module 701 is used to obtain device feature information corresponding to multiple historical access requests in a training set, where the device feature information includes: device display-related parameters, device access feature data.

[0105] The above-mentioned second probability determination module 702 is used to statistically calculate the distribution probability of the above-mentioned device display-related parameters appearing in multiple preset types of devices, and obtain the statistical result of the distribution probability.

[0106] The above-mentioned second feature generation module 703 is used to generate a training feature group corresponding to the current historical access request for each historical access request according to the distribution probability corresponding to the device display-related parameters and the above-mentioned device access feature data.

[0107] The above-mentioned training module 704 is used to input the above-mentioned training feature group into the classification prediction model to be trained for training, and the training label is the true result of whether the initiating device of the corresponding historical access request is a risk device, and the output of the above-mentioned classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risk device.

[0108] The above-mentioned model generation module 705 is used to: use the trained classification prediction model as a risk identification model; or, perform parameter tuning on the trained classification prediction model based on the test set data, and use the classification prediction model with the test effect meeting the set indicators after parameter tuning as a risk identification model.

[0109] For more details of this embodiment, reference can be made to the relevant descriptions of the first to third embodiments above, which will not be elaborated here.

[0110] Any of the functional modules included in the above-mentioned device 600 or device 700 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Or, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. At least one of the functional modules included in device 600 or device 700 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by any other reasonable means such as integrating or packaging the circuit and other hardware or firmware, or implemented in any one of the three implementation methods of software, hardware, and firmware or in any appropriate combination of several of them. Or, at least one of the functional modules included in device 600 or device 700 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0111] The fifth exemplary embodiment of the present disclosure provides an electronic device.

[0112] Figure 8 The structural block diagram of the electronic device provided by the embodiment of the present disclosure is schematically shown.

[0113] Referring to Figure 8 As shown, the electronic device 800 provided by an embodiment of the present disclosure includes a processor 801, a communication interface 802, a memory 803, and a communication bus 804. Among them, the processor 801, the communication interface 802, and the memory 803 complete communication with each other through the communication bus 804; the memory 803 is used to store a computer program; when the processor 801 executes the program stored on the memory, it implements the method for device risk identification or the method for constructing a risk identification model as described above.

[0114] The sixth exemplary embodiment of the present disclosure further provides a computer-readable storage medium. A computer program is stored on the above computer-readable storage medium, and when the computer program is executed by a processor, it implements the method for device risk identification or the method for constructing a risk identification model as described above.

[0115] The computer-readable storage medium may be included in the device or apparatus described in the above embodiment; or it may exist alone without being assembled into the device or apparatus. The above computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0116] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: portable computer disks, hard disks, random access memories (RAMs), read-only memories (ROMs), erasable programmable read-only memories (EPROMs or flash memories), portable compact disk read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program, and the program can be used by or combined with an instruction execution system, device, or device.

[0117] It should be noted that in the technical solution provided by the embodiment of the present disclosure, in terms of the collection, acquisition, update, analysis, processing, use, transmission, storage, etc. of the user's personal information, it complies with the provisions of relevant laws and regulations, is used for legal purposes, and does not violate public order and good customs. Necessary measures are taken for the user's personal information to prevent illegal access to the user's personal information data, and to maintain the security of the user's personal information, network security, and national security.

[0118] It should be noted that, in this document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the existence of additional identical elements in the process, method, article or device comprising the said element.

[0119] The above are only specific embodiments of the present disclosure, enabling those skilled in the art to understand or implement the present disclosure. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to these embodiments shown herein, but rather will be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for identifying device risks, characterized in that, Including: Obtain target device feature information corresponding to a target access request, where the target device feature information includes: target device display-related parameters, and target device access feature data; Determine the target distribution probability that the target device display-related parameters appear in multiple preset types of devices; Generate a target feature group corresponding to the target access request according to the target distribution probability and the target device access feature data; Input the target feature group into a pre-constructed risk identification model, and output a risk identification result of the device corresponding to the target access request.

2. The method according to claim 1, wherein Determining the target distribution probability that the target device display-related parameters appear in multiple preset types of devices includes: Match the target device display-related parameters in a pre-constructed device parameter library; the device parameter library contains the distribution probabilities of the device display-related parameters appearing in multiple preset types of devices, and the distribution probabilities are obtained by statistically analyzing the device types corresponding to the device display-related parameters of historical access requests; When the target device display-related parameters are matched, query the target distribution probability that the target device display-related parameters appear in multiple preset types of devices.

3. The method according to claim 2, characterized in that, Determining the target distribution probability that the target device display-related parameters appear in multiple preset types of devices further includes: When the target device display-related parameters cannot be matched, obtain the monitoring data of the display view window of the device corresponding to the target access request; Determine the device screen size corresponding to the target access request according to the monitoring data; Allocate a target distribution probability for the target device display-related parameters to appear in multiple preset types of devices according to the device screen size; where the maximum appearance probability allocated matches the device type corresponding to the device screen size.

4. The method according to claim 1, wherein The target device access feature data includes: target device access-related parameters and target device access behavior statistical data; Generating a target feature group corresponding to the target access request according to the target distribution probability and the target device access feature data includes: Perform encoding processing on the target distribution probability corresponding to the target device display-related parameters, the target device access-related parameters, and the target device access behavior change statistical data respectively to obtain corresponding probability encoding features, parameter encoding features, and access behavior encoding features; Perform splicing processing on the probability encoding feature, the parameter encoding feature, and the access behavior encoding feature to obtain the target feature group.

5. The method according to claim 1, wherein The target device access feature data includes: target device access-related parameters and target device access behavior statistical data; The device display-related parameters include at least two of the following: browser type, operating system, system platform type, user agent information, system language, screen resolution, plugin list, browser extension, color depth, device pixel ratio, graphics card vendor information, graphics card information, WebGL version, font list, RGB information of colors; The target device access-related parameters include at least one of the following: device IP address, URL address to be accessed by the device, Canvas fingerprint; The statistical data of the target device access behavior includes at least one of the following information of the device or the corresponding change information within a preset statistical period: the number of users, IP addresses, appearance areas, the number of accessed URLs, access duration, and the user agent corresponding to the device identifier.

6. The method according to claim 1, characterized in that The risk identification model is constructed in the following manner: Obtain the device feature information corresponding to multiple historical access requests in the training set, where the device feature information includes: device display-related parameters, device access feature data; Statistically calculate the distribution probability of the device display-related parameters appearing in multiple preset types of devices, obtain the statistical result of the distribution probability, and store it in the device parameter library; For each historical access request, generate a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display-related parameters and the device access feature data; Input the training feature group into the classification prediction model to be trained for training, where the training label is the true result of whether the initiating device of the corresponding historical access request is a risk device, and the output of the classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risk device; Use the trained classification prediction model as the risk identification model; or, based on the test set data, perform parameter tuning on the trained classification prediction model, and use the classification prediction model with the test effect meeting the set indicators after parameter tuning as the risk identification model.

7. The method according to any one of claims 1 to 6, characterized in that It further includes: According to the risk identification result, perform corresponding response processing on the target access request.

8. A method for constructing a risk identification model, characterized in that, It includes: Obtain the device feature information corresponding to multiple historical access requests in the training set, where the device feature information includes: device display-related parameters, device access feature data; Statistically calculate the distribution probability of the device display-related parameters appearing in multiple preset types of devices to obtain the statistical result of the distribution probability; For each historical access request, generate a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display-related parameters and the device access feature data; Input the training feature group into the classification prediction model to be trained for training, where the training label is the true result of whether the initiating device of the corresponding historical access request is a risk device, and the output of the classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risk device; Use the trained classification prediction model as the risk identification model; or, based on the test set data, perform parameter tuning on the trained classification prediction model, and use the classification prediction model with the test effect meeting the set indicators after parameter tuning as the risk identification model.

9. A device risk identification apparatus, characterized in that, It includes: The first device feature acquisition module is used to acquire the target device feature information corresponding to the target access request, where the target device feature information includes: target device display-related parameters, target device access feature data; The first probability determination module is used to determine the target distribution probability of the target device display-related parameters appearing in multiple preset types of devices; The first feature generation module is used to generate a target feature group corresponding to the target access request according to the target distribution probability and the target device access feature data; A risk identification module, configured to input the target feature group into a pre-constructed risk identification model, and output a risk identification result of the device corresponding to the target access request.

10. An apparatus for constructing a risk identification model, characterized in that, It includes: A second device feature acquisition module, configured to acquire device feature information corresponding to multiple historical access requests in a training set, where the device feature information includes: device display-related parameters, device access feature data; A second probability determination module, configured to count the distribution probability of the device display-related parameters appearing in multiple preset types of devices, and obtain a statistical result of the distribution probability; A second feature generation module, configured to generate a training feature group corresponding to the current historical access request according to the distribution probability corresponding to the device display-related parameters and the device access feature data for each historical access request; A training module, configured to input the training feature group into a classification prediction model to be trained for training, where the training label is the true result of whether the initiating device of the corresponding historical access request is a risky device, and the output of the classification prediction model is the prediction result of whether the initiating device of the corresponding historical access request is a risky device; A model generation module, configured to use the trained classification prediction model as the risk identification model; or, perform parameter tuning on the trained classification prediction model based on test set data, and use the classification prediction model with test effects meeting the set indicators after parameter tuning as the risk identification model.

11. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete communication with each other through the communication bus; The memory is used to store a computer program; The processor, when executing the program stored on the memory, implements the method described in any one of claims 1-8.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program, when executed by the processor, implements the method described in any one of claims 1-8.

Images