Evaluation and detection method and system for device fingerprint, device and medium

Abstract

The invention discloses an evaluation and detection method and system for device fingerprints, a device and a medium, and the method specifically comprises the steps: collecting the fine-grained device features of a client device, and carrying out the dynamic calculation of the addition amount of injected noise for the sensitive features in the fine-grained device features through a differential privacy technology, reporting the fine-grained equipment characteristics and the unique random identifier together; based on fine-grained equipment features, a bloom filter is adopted to perform fingerprint existence rapid screening, feature similarity is calculated through a SimHash algorithm, a fingerprint variation coefficient is calculated through a sliding window algorithm, and a fingerprint collision detection result and a fingerprint stability evaluation result are obtained; and dynamically adjusting the feature weight of each feature vector in the fine-grained equipment features through a Q-learning algorithm based on a fingerprint collision detection result and a fingerprint stability evaluation result. The uniqueness of the device fingerprint is improved, and the stability of the device fingerprint is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer equipment, and in particular to a method, system, equipment and medium for evaluating and detecting device fingerprints. Background Art

[0002] With the rapid advancement of mobile internet technology, device fingerprinting technology plays a vital role in the digital ecosystem due to its unique capabilities for security verification, user behavior analysis, and targeted advertising. Device fingerprinting generates a unique identifier by integrating the hardware and software properties of a device. Compared to traditional identification methods such as cookies or IP addresses, it exhibits greater anti-counterfeiting and long-term stability, effectively promoting both user privacy protection and service efficiency.

[0003] However, despite the widespread application and promising prospects of device fingerprinting technology, its reliability issues in practical applications have become increasingly prominent, becoming a technical bottleneck restricting its further development. Existing device fingerprint generation methods have exposed numerous flaws in practice. On the one hand, due to limitations in algorithm design or inappropriate feature selection, different devices may generate the same fingerprint identity, resulting in frequent identity confusion and seriously compromising the uniqueness of device fingerprints. On the other hand, the fingerprint of the same device may change at different time points or under different environmental conditions, making continuous tracking difficult and affecting the stability of device fingerprints.

[0004] The two core attributes of device fingerprinting technology—uniqueness and stability—are crucial factors hindering its development. The lack of uniqueness leads to frequent fingerprint collisions, reducing the discrimination and accuracy of device fingerprints. Meanwhile, insufficient stability makes device fingerprints inconsistent when responding to environmental changes or subtle differences in device status, making it difficult to maintain consistent results. These two intertwined technical challenges contribute to the difficulty in quantifying and verifying the reliability of device fingerprints, severely limiting their practical application value in dynamic and complex environments. Summary of the Invention

[0005] The purpose of the present invention is to provide a method, system, device and medium for evaluating and detecting device fingerprints, which accurately identify fingerprint collision events through an efficient mechanism, ensure the consistency of device fingerprints in multiple scenarios and conditions through in-depth data analysis, improve the uniqueness of device fingerprints, and enhance the stability of device fingerprints, so as to solve at least one of the above-mentioned problems in the prior art.

[0006] In a first aspect, the present invention provides a method for evaluating and detecting device fingerprints, the method specifically comprising:

[0007] When the client device is first started, the hash value of the device's hardware serial number is injected into the high-order field of the timestamp as a random seed based on the improved UUIDv7 algorithm to generate a unique random identifier with temporal correlation;

[0008] The unique random identifier is stored locally using AES-256 encryption technology, and a dynamic parameter of device screen pixel density is introduced as an additional entropy source for the key derivation function;

[0009] Collect fine-grained device features of the client device, apply differential privacy technology to sensitive features in the fine-grained device features to dynamically calculate the amount of injected noise, and report the fine-grained device features and the unique random identifier together;

[0010] Based on the fine-grained device features, a Bloom filter is used to quickly screen the fingerprint existence, the feature similarity is calculated using the SimHash algorithm, and the fingerprint variation coefficient is calculated using the sliding window algorithm to obtain fingerprint collision detection results and fingerprint stability assessment results;

[0011] Based on the fingerprint collision detection result and the fingerprint stability evaluation result, the feature weight of each feature vector in the fine-grained device feature is dynamically adjusted through the Q-learning algorithm.

[0012] In a second aspect, the present invention provides a device fingerprint evaluation and detection system, the system specifically comprising:

[0013] The first evaluation and detection module is configured to inject a hash value of the device's hardware serial number as a random seed into the high-order field of the timestamp based on the improved UUIDv7 algorithm when the client device is first started, thereby generating a unique random identifier with temporal correlation;

[0014] A second evaluation and detection module is used to locally store the unique random identifier using AES-256 encryption technology and introduce a dynamic parameter of device screen pixel density as an additional entropy source for a key derivation function;

[0015] A third evaluation and detection module is configured to collect fine-grained device features of the client device, dynamically calculate the amount of injected noise by applying differential privacy technology to sensitive features in the fine-grained device features, and jointly report the fine-grained device features and the unique random identifier;

[0016] A fourth evaluation and detection module is configured to perform rapid fingerprint presence screening based on the fine-grained device features using a Bloom filter, calculate feature similarity using a SimHash algorithm, calculate the fingerprint coefficient of variation using a sliding window algorithm, and obtain fingerprint collision detection results and fingerprint stability evaluation results;

[0017] The fifth evaluation and detection module is used to dynamically adjust the feature weight of each feature vector in the fine-grained device feature through a Q-learning algorithm based on the fingerprint collision detection result and the fingerprint stability evaluation result.

[0018] In a third aspect, the present invention provides a computer device comprising: a memory and a processor and a computer program stored in the memory, wherein when the computer program is executed on the processor, the device fingerprint evaluation and detection method described in any one of the above methods is implemented.

[0019] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for evaluating and detecting device fingerprints as described in any one of the above methods is implemented.

[0020] Compared with the prior art, the present invention has at least one of the following technical effects:

[0021] 1. The present invention accurately identifies fingerprint collision events through an efficient mechanism and ensures the consistency of device fingerprints in multiple scenarios and conditions through in-depth data analysis, thereby improving the uniqueness of device fingerprints and enhancing the stability of device fingerprints.

[0022] 2. The present invention generates a unique random identifier with time correlation through an improved UUIDv7 algorithm, thereby enhancing the uniqueness and time correlation of device fingerprints.

[0023] 3. The present invention injects the hash value of the device hardware serial number into the high-order field of the timestamp, thereby improving the unpredictability and security of the random identification.

[0024] 4. The present invention adopts AES-256 encryption technology and introduces the dynamic parameter of device screen pixel density as an additional entropy source of the key derivation function, thereby enhancing the storage security of the unique random identifier.

[0025] 5. The present invention improves the discrimination and accuracy of device fingerprints by collecting fine-grained device features, such as gyroscope calibration offset, GPU shader rendering error value and second-order derivative of battery charge and discharge curve.

[0026] 6. The present invention applies differential privacy technology to sensitive features to dynamically calculate the amount of injected noise, effectively protecting user privacy while maintaining the practicality of device fingerprints.

[0027] 7. The present invention adopts Bloom filter, SimHash algorithm and sliding window algorithm to perform rapid fingerprint existence screening and stability evaluation, which improves the accuracy of fingerprint collision detection and the efficiency of fingerprint stability evaluation.

[0028] 8. The present invention dynamically adjusts the feature weight of each feature vector in the fine-grained device features through the Q-learning algorithm, optimizes the device fingerprint generation algorithm, and reduces the number of fingerprint collisions and device restarts. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 This is a flow chart of a method for evaluating and detecting device fingerprints provided by one embodiment of the present invention;

[0031] Figure 2 This is a schematic diagram of the structure of a device fingerprint evaluation and detection system provided by one embodiment of the present invention;

[0032] Figure 3 It is a structural diagram of a computer device provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0033] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0034] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0035] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0036] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0037] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0038] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0039] In the embodiments of the present application, the execution subject of the process includes a terminal device, which includes but is not limited to: a server, a computer, a smart phone, a tablet computer, and other devices capable of executing the method disclosed in the present application. Figure 1 A schematic flow chart of the device fingerprint evaluation and detection method disclosed in the first embodiment of the present invention is shown, and is described in detail as follows:

[0040] S101, when the client device is started for the first time, a hash value of the device hardware serial number is injected into the high-order field of the timestamp as a random seed based on the improved UUIDv7 algorithm to generate a unique random identifier with time correlation.

[0041] In this embodiment, when the client device is first started, the clock system on the device is used to obtain the timestamp data of the current time. This timestamp data is accurate to the millisecond level to ensure the fine time granularity of the generated identifier. The device hardware serial number is read from the device's hardware information. This serial number is usually unique and is used to identify a specific hardware device. The device hardware serial number is hashed using the SHA-256 hash algorithm to obtain a fixed-length digest (e.g., a 256-bit hash value).

[0042] The timestamp data is divided into a high-order field and a low-order field. For example, if the timestamp is 64 bits, the first 32 bits can be used as the high-order field and the last 32 bits as the low-order field. The first k bits (for example, the first 16 bits) of the hash value are injected into the high-order field of the timestamp to reconstruct the high-order field. In this way, the reconstructed high-order field contains both time information and the hash value information of the device hardware serial number.

[0043] The Mersenne Twister algorithm is used to process the reconstructed high-order field (which serves as a random number seed) to generate a random number sequence. The generated random number sequence is formatted according to the UUIDv7 format and output as a 128-bit unique random identifier. This identifier combines the temporal nature of a timestamp with the uniqueness of the device's hardware serial number.

[0044] In this embodiment, by injecting the hash value of the device hardware serial number into the high-order field of the timestamp, the generated unique random identifier not only contains time information, but also contains the uniqueness information of the device hardware, thereby greatly enhancing the uniqueness of the identifier. Due to the use of the timestamp, the generated unique random identifier has a temporal correlation. This means that identifiers generated at different time points can be sorted and compared by the timestamp, which is helpful for subsequent data analysis and processing. The use of the SHA-256 hash algorithm to hash the device hardware serial number increases the complexity and unpredictability of the data and improves the security of the identifier. At the same time, the use of the Mersenne Twister algorithm also ensures the randomness and unpredictability of the random number sequence.

[0045] S102: Use AES-256 encryption technology to locally store the unique random identifier, and introduce a dynamic parameter of the device screen pixel density as an additional entropy source for the key derivation function.

[0046] In this embodiment, when the client device is started, the screen pixel density (such as PPI, pixels per inch) of the current device is obtained through the system API. This parameter is dynamic and may change with changes in the device display settings. The screen pixel density value when the device is started is recorded and compared with the previously recorded value (if any), and the dynamic fluctuation value of the pixel density is calculated. This fluctuation value reflects the degree of change in the pixel density of the device screen. The calculated dynamic fluctuation value of the pixel density is quantized and encoded, and converted into a form suitable for use as an input to the key derivation function. For example, the fluctuation value can be mapped to a fixed numerical range and discretized.

[0047] The SHA-256 hash value of the device's hardware serial number (as the master key) is combined with the quantized and encoded dynamic fluctuation value of the pixel density (as an additional entropy source) to construct the basic key material. The PBKDF2 (Password-Based KeyDerivation Function 2) algorithm is used in conjunction with the HMAC-SHA512 hash function to derive the basic key material. Through multiple iterations and hash calculations, a high-strength derived key is generated. Using the generated derived key, the unique random identifier is encrypted using the AES-GCM (Advanced Encryption Standard-Galois / Counter Mode) encryption algorithm. AES-GCM is a block cipher mode that provides authentication and encryption, ensuring data confidentiality and integrity. The encrypted ciphertext is stored in a local secure storage area of the client device (such as a keystore or encrypted file system) for subsequent use.

[0048] In this embodiment, the unique random identifier is encrypted using AES-256 encryption technology to ensure the confidentiality of the data when it is stored locally. AES-256 is a widely recognized high-strength encryption algorithm that provides extremely high security. Introducing the dynamic parameter of the device screen pixel density as an additional entropy source for the key derivation function increases the complexity and unpredictability of the key. In this way, even if an attacker obtains part of the key information, it is difficult to recover the original key through brute force cracking or other methods. Since the screen pixel density parameter is dynamic and changes with the device display settings, using it as an additional entropy source can improve the adaptability of the key. This means that even if the device is used at different times or in different environments, the encrypted data stored on it can maintain a high degree of security.

[0049] S103: Collect fine-grained device features of the client device, apply differential privacy technology to sensitive features in the fine-grained device features to dynamically calculate the amount of injected noise, and report the fine-grained device features and the unique random identifier together.

[0050] In this embodiment, the hardware information of the device is collected, such as the CPU model, GPU model, memory size, storage capacity, etc., the device usage behavior is recorded, such as the number of application launches, application usage time, the number of screen unlocks, etc., and the sensor data of the device is collected, such as the readings of sensors such as accelerometers, gyroscopes, and magnetometers. Sensitive features are identified from the fine-grained device features collected. For example, the user's specific location coordinates, personal identity information (such as the user's unique identifier indirectly inferred from hardware information), etc.

[0051] Determine a reasonable privacy budget ε based on business needs and data sensitivity. The privacy budget ε controls the amount of noise added to the data. A smaller ε value results in stronger privacy protection, but data accuracy may be reduced. For sensitive features requiring protection, calculate their global sensitivity. Global sensitivity refers to the maximum change in query results that may occur when any single record in a dataset is modified. Using a Laplace or Gaussian mechanism, dynamically calculate the amount of noise to be added to sensitive features based on the privacy budget ε and global sensitivity. For example, for a Laplace mechanism, the amount of added noise can be calculated as L = ε / Δf, where Δf is the global sensitivity. The calculated amount of noise is added to the sensitive features to generate perturbed data. This makes it difficult for an attacker to accurately infer the original sensitive features, even if they obtain the perturbed data.

[0052] The perturbed sensitive features, other non-sensitive fine-grained device features, and the previously generated unique random identifier are packaged to form a complete data packet. The data packet is compressed to reduce the amount of data transmitted over the network. Furthermore, the data packet is encrypted using an encryption algorithm such as AES to ensure data security during transmission. The encrypted data packet is reported to the server via a secure network protocol (such as HTTPS). On the server side, the received data can be decrypted, decompressed, and parsed to obtain the required fine-grained device features.

[0053] In this embodiment, by applying differential privacy technology, sensitive features are perturbed, effectively protecting the user's privacy information. Even if an attacker obtains the reported data, it is difficult to accurately infer the original sensitive features. The data packets are encrypted to ensure the security of the data during transmission. At the same time, the device is identified with a unique random identifier, which increases the traceability and integrity verification capabilities of the data. The collected fine-grained device features provide a rich data source for data analysis. By analyzing these features, we can better understand the user's behavioral habits and device usage, providing strong support for product optimization and decision-making. By dynamically calculating the amount of noise added, the privacy protection strength can be flexibly adjusted according to different privacy needs and data sensitivity, which helps to achieve a balance between privacy protection and data utilization in different scenarios.

[0054] S104: Based on the fine-grained device features, a Bloom filter is used to perform a rapid fingerprint existence screening, feature similarity is calculated using a SimHash algorithm, and the fingerprint variation coefficient is calculated using a sliding window algorithm to obtain fingerprint collision detection results and fingerprint stability evaluation results.

[0055] In this embodiment, a bit array of appropriate size and multiple hash functions are selected (for example, using high-performance hash algorithms such as MurmurHash and Fnv). A known device fingerprint (a unique identifier calculated based on fine-grained device features) is inserted into the Bloom filter. For each fingerprint, a hash function is used to map it to multiple positions in the bit array, and the bits at these positions are set to 1. For newly collected device fingerprints, a hash function is also used to map them to multiple positions in the bit array. Check whether the bits at these positions are all 1. If so, it is considered that the fingerprint may exist in the Bloom filter (there is a certain false positive rate); otherwise, it is considered that the fingerprint does not exist.

[0056] Convert fine-grained device features into feature vectors. For example, you can use methods such as Bag of Words or TF-IDF to convert text features (such as app installation lists) into vectors. Weight the feature vectors and assign different weights based on the importance of the features. Use a hash function (such as MD5, SHA-1, etc.) to hash the weighted feature vectors to obtain a SimHash value. For the SimHash values of two device fingerprints, calculate the Hamming distance between them. The smaller the Hamming distance, the higher the similarity between the two fingerprints.

[0057] A fixed-size sliding window is set up to slide across the device fingerprint sequence. The window size can be adjusted based on actual needs. Within the sliding window, the degree of variation between adjacent fingerprints is calculated. This is achieved by calculating the Hamming distance between the SimHash values of adjacent fingerprints. The coefficient of variation of the fingerprint is calculated based on all Hamming distances within the sliding window. The coefficient of variation reflects the stability of the device fingerprint over time. A smaller coefficient of variation indicates a more stable fingerprint. If a possible fingerprint is screened in the Bloom filter and the Hamming distance between it and the SimHash value of a known device fingerprint is less than a certain threshold, a fingerprint collision is considered to have occurred. The stability of the device fingerprint is evaluated based on the coefficient of variation calculated by the sliding window algorithm. If the coefficient of variation is less than a certain threshold, the fingerprint is considered to be relatively stable; otherwise, the fingerprint is considered to be less stable.

[0058] In this embodiment, the Bloom filter efficiently determines whether a fingerprint exists within a set of known device fingerprints, significantly reducing the time complexity of fingerprint collision detection. The SimHash algorithm accurately calculates the similarity between device fingerprints, providing a reliable basis for fingerprint collision detection. The sliding window algorithm dynamically calculates the coefficient of variation of device fingerprints, enabling timely assessment of fingerprint stability. This helps promptly detect potential device forgery or tampering.

[0059] S105 , based on the fingerprint collision detection result and the fingerprint stability evaluation result, dynamically adjust the feature weight of each feature vector in the fine-grained device feature through a Q-learning algorithm.

[0060] In this embodiment, fine-grained device features are converted into feature vectors. For example, text features such as device model and operating system version can be converted into vectors using a bag-of-words model or a TF-IDF method. For continuous features (such as CPU frequency and memory size in hardware configuration), normalization can be performed to make them comparable. A Q-table is created to store the feature weights of each feature vector in different states. Initialize the Q-table and set the initial weights of all feature vectors to the same value, or set different initial weights based on prior knowledge.

[0061] Define the state space and action space. The state space includes the current fingerprint collision detection results (e.g., whether a collision occurred), the fingerprint stability assessment results (e.g., the coefficient of variation), and the current weights of each eigenvector. The action space includes the weight adjustment actions for each eigenvector, which can be increases, decreases, or remain unchanged. To simplify the problem, the weight adjustment amplitude can be discretized into several fixed values. Based on the current state and Q-table, select an action using the ε-greedy strategy. Specifically, an action is randomly selected with probability ε (exploration) and the action with the highest Q value in the current state is selected with probability 1-∈ (exploitation). Adjust the weights of the selected eigenvectors. Define a reward function based on the improvement in fingerprint collision detection results and fingerprint stability. For example, a positive reward is given if the collision detection result is more accurate or the fingerprint stability is higher; otherwise, a negative reward is given. Based on the observed reward and the next state, the Q-table is updated using the Q-learning update rule. Repeat the above steps, continuously updating the Q-table based on feedback, until convergence conditions are met (e.g., the change in the Q-table is less than a certain threshold or the number of iterations reaches an upper limit).

[0062] In this embodiment, by dynamically adjusting the feature weights, the system can more accurately identify the device identity and reduce the false positive rate of fingerprint collisions. When the device features change (such as device upgrades, configuration adjustments, etc.), the system can quickly adapt and maintain stable fingerprint recognition performance by adjusting the feature weights. Through the learning process of the Q-learning algorithm, the system can gradually discover which features are more important for fingerprint recognition, thereby optimizing feature selection and reducing unnecessary computational overhead. The learning process of the Q-learning algorithm can record the weight adjustment process of each feature vector, which helps to understand which features have a greater impact on the fingerprint recognition results, and provide strong support for system tuning and troubleshooting.

[0063] In some embodiments, in step S101 above, injecting the hash value of the device hardware serial number as a random seed into the high-order field of the timestamp based on the improved UUIDv7 algorithm to generate a unique random identifier with temporal correlation specifically includes:

[0064] Obtain the timestamp data when the client device is first started, and divide the timestamp data into a high-order field and a low-order field;

[0065] Read the client device's hardware serial number and convert it into a fixed-length digest using the SHA-256 hash algorithm;

[0066] The first k bits of the fixed-length digest are injected into the high-order field for reconstruction to construct a random seed;

[0067] The Mersenne Twister algorithm is used to process the random number seed to generate a random number sequence, which is then output in UUIDv7 format to generate a unique random identifier.

[0068] In this embodiment, the timestamp data recorded when the client device is first booted is obtained. The timestamp data is decomposed using bitwise operations to obtain a high-order field and a low-order field. The client device's hardware serial number is read and hashed using the SHA-256 hash algorithm to obtain a fixed-length digest. The first several bits of data are extracted from the fixed-length digest. A determination is made as to whether the number of bits extracted meets a preset threshold. If so, the extracted data is retained. The first several bits of data are merged into the high-order field through an injection operation to obtain reconstructed high-order field data. A random seed is generated using the reconstructed high-order field data and the low-order field data using an XOR operation. The generated random seed is verified for uniqueness using a verification tool to obtain a verification result. If the verification result indicates insufficient uniqueness, a new random seed is generated by adjusting the parameters of the injection operation. Initial data is obtained from the random seed and processed using the Mersenne Twister algorithm to obtain a random number sequence. Numerical features are extracted from the random number sequence and encoded using the UUIDv7 format to generate a formatted sequence. The formatted sequence is verified. If the verification passes, uniqueness is confirmed, and a preliminary identifier is obtained. Obtain a preliminary identifier and process it using a hash function to determine if there are any duplicates, resulting in a deduplicated identifier. Extract key fields from the deduplicated identifier and adjust them according to the UUIDv7 specification to generate a final identifier. Obtain the output from the final identifier and determine if it meets uniqueness requirements to obtain a verification identifier. Store the verification identifier and record it using a database tool to obtain persistent data.

[0069] For example, suppose a device is first powered on at 10:00:00 on March 27, 2025. The corresponding timestamp might be 1711526400000 milliseconds. Dividing this timestamp into a high-order field and a low-order field can be understood as splitting it into two parts, for example, taking the first eight bits 17115264 as the high-order field and the last five bits 00000 as the low-order field. This split facilitates subsequent combination with other data, enhancing randomness. Reading the client device's hardware serial number is key to ensuring unique identification. Hardware serial numbers are typically assigned by the manufacturer. For example, a device's serial number might be "ABC123456789." After processing using the SHA-256 hash algorithm, a fixed-length digest is generated. The advantage of this algorithm is that even slightly different input serial numbers will produce a completely different output digest, ensuring uniqueness and irreversibility. Specifically, the first k bits of the digest, for example the first 16 bits "e8f32e72", are taken and injected into the high-order field 17115264, potentially reconstructing it as 17115264e8f32e72, which serves as the random seed. This injection enhances the uniqueness of the seed and avoids duplication caused by relying solely on the timestamp. After constructing the random seed, it is processed using the Mersenne Twister algorithm. Known for its high-quality randomness and long period, the Mersenne Twister algorithm is suitable for generating uniformly distributed random number sequences. In one possible implementation, this sequence is further processed to meet the requirements of the UUIDv7 format. UUIDv7 combines timestamps with randomness, typically formatted as "timestamp-random value." Preferably, the timestamp portion retains millisecond precision, such as "1711526400000-94725183-3058." This generates an identifier that combines chronological order with a high degree of randomness. It should be noted that the unique random identifier output by UUIDv7, such as "1711526400000-94725183-3058-4f12-a3b2-cdef12345678," can be used in practical applications such as device tracking and session management. In one possible implementation, if two devices are started simultaneously, their timestamps may be identical, but due to different hardware serial numbers, the hash digest and seed may differ significantly, and the resulting identifier remains unique. For example, the first 16 digits of the digest generated for another device with the serial number "XYZ987654321" might be "9d4a7b91." After seed injection, the hash becomes 171152649d4a7b91, a completely different random sequence. This multi-faceted design ensures the reliability and distinctiveness of the identifier. As you can see, this approach offers technical benefits including high uniqueness, temporal traceability, and collision resistance. In one possible implementation, even if a large number of devices are started simultaneously, duplication can be effectively avoided by combining the hash value of the hardware serial number with the randomness of the Mersenne Twister algorithm.Ideally, if device identity verification is required, the UUIDv7 timestamp can also provide clues to the initial boot time, facilitating auditing and sorting. This solution, from timestamp splitting to random number generation, forms a complete logical chain, making it both practical and efficient.

[0070] In some embodiments, in step S102, the use of AES-256 encryption technology to locally store the unique random identifier and the introduction of a dynamic parameter of the device screen pixel density as an additional entropy source for the key derivation function specifically include:

[0071] Obtain device screen pixel density parameters in real time, and calculate pixel density dynamic fluctuation values based on device screen pixel density parameters;

[0072] Quantize and encode the dynamic fluctuation value of pixel density to generate additional value of entropy source;

[0073] The base key material is constructed based on the SHA-256 hash value of the device's hardware serial number and the additional value of the entropy source, and the key is derived using the PBKDF2-HMAC-SHA512 algorithm to generate a key derivation function;

[0074] Based on the key derivation function, the AES-GCM encryption algorithm is used to encrypt the unique random identifier, generate ciphertext, and store the ciphertext locally.

[0075] In this embodiment, pixel density data is collected from the device screen, and initial density parameters are obtained in real time. Dynamic fluctuation values are calculated from the initial density parameters, and the fluctuation trend is determined using a differential algorithm. The trend is quantized and encoded, and a Huffman code is used to generate an encoded feature sequence. The entropy source added value is extracted from the feature sequence, and the distribution characteristics of the added value are calculated using information entropy. If the distribution characteristics exceed a preset threshold, the added value is smoothed to obtain an adjusted added value. The device hardware serial number and the entropy source added value are combined and a hash value is calculated using the SHA-256 algorithm to obtain basic key material. From this basic key material, the PBKDF2-HMAC-SHA512 algorithm is iteratively processed to obtain a key derivation function. A unique random identifier is obtained and, based on the key derivation function, encrypted using the AES-GCM algorithm to obtain ciphertext data. Once ciphertext data is generated, it is written to a preset storage area using a local storage mechanism to obtain a storage address. Based on the storage address, the ciphertext data is retrieved and decrypted using the AES-GCM algorithm to obtain a decrypted random identifier. If the decrypted random identifier is consistent with the original random identifier, the encryption and storage process is considered normal, and a verification result is obtained. Based on the verification result, a logging tool is used to record the hardware serial number and the timestamp of the ciphertext generation to obtain an operation log.

[0076] For example, the screen pixel density of a device may vary due to hardware differences. For example, one device may have a pixel density of 320 dpi, while another may have a pixel density of 480 dpi. This parameter is typically read directly by system APIs and reflects the physical characteristics of the screen. It is understood that dynamic fluctuations in pixel density arise from subtle changes during device operation, such as minor adjustments caused by screen refreshes or user interactions. Specifically, assume a device's initial pixel density is 320 dpi. During operation, as the screen brightness adjusts due to ambient light, the fluctuation may range between ±5 dpi. The difference in this fluctuation range, such as 5 dpi, can be used as the basis for the dynamic fluctuation calculation. This approach leverages the unique real-time state of the device. Quantizing and encoding the dynamic pixel density fluctuation to generate an additional entropy source is a key step in increasing randomness. In one possible implementation, the fluctuation value of 5 dpi can be mapped to a fixed range, such as an integer range from 0 to 255, resulting in an encoded value such as "128." This value, as an additional entropy source, provides additional unpredictability for subsequent key generation. It should be noted that quantization encoding can simply use linear mapping or be processed through more complex nonlinear functions, depending on the business's demand for entropy source strength. For example, after encoding 5dpi as "128", it can be further adjusted to "130" based on the time factor to enhance dynamics. Constructing basic key material based on the SHA-256 hash value of the device hardware serial number and the additional value of the entropy source is the preparatory stage for key derivation. Preferably, assuming the device serial number is "DEF456789123", the first 16 bits of the hash value generated by SHA-256 may be "7b9c2d4e". This is spliced with the additional value of the entropy source "130" to obtain the basic key material "7b9c2d4e130". This splicing method fully utilizes the combination of hardware uniqueness and dynamic entropy source. In one possible implementation, if the serial number of another device is "GHI789123456," the first 16 digits of the hash value might be "4a8f1e9d." After concatenating the entropy source value "135," it becomes "4a8f1e9d135," a significant difference. This diversity provides a solid foundation for subsequent derivation. Using the PBKDF2-HMAC-SHA512 algorithm for key derivation significantly improves key security. Specifically, based on the input "7b9c2d4e130" and combined with a random salt value such as "salt1234," a 64-byte key derivation function output is generated after multiple iterations, for example, 10,000 times. This algorithm's advantage lies in increasing computational complexity through iteration, enhancing attack resistance. Using the AES-GCM encryption algorithm based on the key derivation function to encrypt the unique random identifier and generate ciphertext is a core step in protecting the identifier. The advantage of AES-GCM is that it provides both encryption and integrity verification, and the attached authentication tag verifies that the data has not been tampered with.It's understandable that once the ciphertext is stored locally, it can be used for device authentication or security verification during data transmission. Local storage of the ciphertext is the final step in the entire process. In one possible implementation, if the device supports a hardware security module, the ciphertext can be further written to it to enhance storage security. This localization facilitates quick access while protecting the identifier from direct external access.

[0077] In some embodiments, in step S103 above, collecting fine-grained device features of the client device specifically includes:

[0078] When the client device is stationary, sample the gyroscope raw data, calculate the three-axis calibration offset based on the gyroscope raw data, and obtain the gyroscope calibration offset;

[0079] Generate a theoretical rendering matrix by executing a standard test shader program, and capture the actual frame buffer data output by the client device at the same time. Calculate the pixel-by-pixel error matrix based on the absolute value of the difference between the theoretical rendering matrix and the frame buffer data, and extract the GPU shader rendering error value from the pixel-by-pixel error matrix.

[0080] Continuously monitor the charge and discharge voltage sequence of the client device, perform discrete second-order derivative calculation based on the charge and discharge voltage sequence, and obtain the second-order derivative of the battery charge and discharge curve.

[0081] In this embodiment, when the client device is in a stationary state, gyroscope data is acquired through a sensor interface to obtain raw data. Using the collected raw data, the average values for the three axes are calculated to determine the initial offset for the three-axis calibration. The initial offset is compared with a preset threshold. If the difference exceeds the threshold, the raw data is adjusted to obtain adjusted data. For the adjusted data, the offset calculation process is optimized using the least squares method to obtain an optimized calibration offset. Based on the optimized calibration offset, the gyroscope data is analyzed axially to determine whether the data on each axis is balanced. After obtaining the balanced data, the final calibration offset is generated through a data processing process. The three-axis parameters are extracted from the final calibration offset to determine the gyroscope calibration result.

[0082] Generate a theoretical rendering matrix by running a test shader program. Obtain the frame buffer data output by the client device. Calculate the pixel-by-pixel error matrix between the theoretical rendering matrix and the frame buffer data using the absolute difference method. Extract the GPU shader rendering error value from the pixel-by-pixel error matrix. Determine GPU shader performance based on the rendering error value. If the error exceeds a preset threshold, adjust the shader parameters. Regenerate the theoretical rendering matrix using the adjusted shader program and obtain new frame buffer data. Use a support vector machine algorithm to classify the rendering error values from multiple iterations and determine the error convergence trend.

[0083] Continuously collect the charge and discharge voltages of client devices to generate a voltage sequence. This voltage sequence is processed through discrete calculations to obtain a second-order derivative. This second-order derivative is smoothed using a filtering method to obtain a smoothed second-order derivative. If a significant peak is observed in the smoothed second-order derivative, a peak detection algorithm is used to determine the characteristic points of the curve. Based on the characteristic points of the curve, the voltage trend is analyzed to obtain a trend sequence. A linear regression algorithm is used to determine the stability of the battery curve in this trend sequence, obtaining a stability index. The stability index is compared with a preset threshold to determine the state classification of the battery charge and discharge curve.

[0084] For example, assuming the device is placed on a stable tabletop, the gyroscope may detect slight vibrations, resulting in raw data showing three-axis values such as X: 0.02° / s, Y: -0.01° / s, and Z: 0.03° / s. These values reflect the inherent bias of the sensor hardware. In one possible implementation, a three-axis calibration offset is calculated by averaging 100 consecutive samples, resulting in X: 0.015° / s, Y: -0.008° / s, and Z: 0.025° / s. This calibration offset effectively corrects subsequent dynamic data, ensuring improved accuracy. Specifically, when executing a standard test shader program to generate a theoretical rendering matrix, a simple triangle rendering task can be designed. The theoretical rendering matrix defines vertex positions and color distribution, for example, with a theoretical red channel value of 1.0. Preferably, after actually capturing frame buffer data, the red channel value of a certain pixel may be found to be 0.95. The absolute difference between the two values is calculated to obtain a pixel-by-pixel error matrix, where the error at that point is 0.05. When extracting GPU shader rendering error values from the matrix, the average of all pixel errors can be taken, for example, 0.04. This error value reflects GPU rendering consistency and can provide a basis for device performance analysis. It should be noted that continuous monitoring of charge and discharge voltage sequences typically relies on real-time data provided by the battery management system. For example, when a device is charging, the voltage sequence may be 3.7V, 3.72V, and 3.75V, sampled at 1-second intervals. In one possible implementation, discrete second-order derivatives are calculated on this data, first taking first-order differences such as 0.02V and 0.03V, and then taking a second-order difference of 0.01V. This second-order derivative reveals the acceleration characteristics of the voltage change. It is understandable that if another device's sequence is 4.1V, 4.15V, and 4.18V, and the second-order derivative is 0.02V, this indicates a difference in battery performance. This approach helps accurately describe battery status. In one possible implementation, the calculation of the gyroscope calibration offset can be combined with ambient temperature. For example, if the temperature rises from 25°C to 30°C, the offset may change from 0.015° / s to 0.018° / s, reflecting subtle adjustments to environmental influences. Similarly, GPU rendering error values will vary under different loads. For example, an error of 0.04 under low load may increase to 0.06 under high load, reflecting the performance of the hardware under stress. Preferably, battery second-order derivative analysis can include a time dimension. For example, if the second-order derivative stabilizes at 0.01V after 10 minutes of charging, it indicates a plateau. This multi-faceted analysis supports each other and fully characterizes device characteristics. Specifically, if the device remains stationary for an extended period, gyroscope sampling may show a more stable offset, such as X: 0.014° / s, making it suitable for long-term calibration. Frame buffer data can also be rendered multiple times to obtain a median error, such as 0.045, to improve reliability. Voltage sequences can be verified under discharge scenarios. For example, if the second-order derivative drops from 3.8V to 3.75V, it will be -0.015V, revealing discharge characteristics.

[0085] In some embodiments, in step S103, dynamically calculating the amount of injected noise by applying differential privacy technology to the sensitive features in the fine-grained device features specifically includes:

[0086] Setting a feature sensitivity index, and dynamically classifying each feature vector of the fine-grained device feature according to the feature sensitivity index to obtain sensitive features and non-sensitive features;

[0087] Setting a total privacy budget, and allocating the privacy budget based on the total privacy budget according to the feature weight of each sensitive feature;

[0088] Calculate the feature sensitivity of the sensitive features after the privacy budget is allocated to obtain the feature sensitivity calculation results;

[0089] Based on the feature sensitivity calculation results, corresponding noise addition amounts are injected into different types of sensitive features.

[0090] In this embodiment, device feature data is obtained, and fine-grained features and corresponding feature vectors are decomposed using a preset feature extraction method to obtain an initial feature set. The feature vectors in the initial feature set are analyzed using a sensitivity index, and dynamic classification is performed using a support vector machine algorithm to obtain sensitive features and non-sensitive features. The feature weights of the sensitive features are extracted based on the classification results, and the sensitivity ranking of each sensitive feature is calculated using the feature weights to obtain a sensitive feature sequence. A total privacy budget is set, and a differential privacy algorithm is used to allocate the privacy budget based on the sensitive feature sequence and feature weights to obtain a privacy budget value for each sensitive feature. If the privacy budget value of the sensitive feature is lower than a preset threshold, the privacy budget is reallocated by adjusting the feature weights to obtain an updated privacy budget distribution. For the updated privacy budget distribution, the remaining budget ratio of non-sensitive features is obtained to determine the final budget allocation plan.

[0091] For sensitive feature data that has undergone privacy budget adjustment, the feature sensitivity calculation formula is used to calculate the feature sensitivity, resulting in a feature sensitivity value: S = f(X, P), where S represents feature sensitivity, X represents the sensitive feature, and P represents the privacy budget. Based on the feature sensitivity value, the sensitive feature type is determined. If the feature sensitivity value exceeds a preset threshold, it is classified as a high-sensitivity feature type; otherwise, it is classified as a low-sensitivity feature type, resulting in a set of classified feature types. From this set of classified feature types, data of the high-sensitivity feature type is obtained and noise is injected using a Gaussian noise generation algorithm to obtain feature data after Gaussian noise addition. For data of the low-sensitivity feature type, noise is injected using a Laplace noise generation algorithm to obtain feature data after Laplace noise addition. By comparing the feature data after Gaussian noise addition with the feature data after Laplace noise addition, the correspondence between the amount of noise added and the feature sensitivity value is determined, resulting in the final noise-adjusted sensitive feature dataset. Statistical analysis tools are used to analyze the final noise-adjusted sensitive feature dataset to determine whether the noise addition meets the privacy budget requirements, resulting in verified sensitive feature data.

[0092] For example, assuming that the data collected by a device includes location, temperature, and battery voltage, a feature sensitivity index might be defined based on the potential risk of a data breach. Location, as it relates to user movements, is highly sensitive, while temperature is generally more neutral and less sensitive. In one possible implementation, each feature can be assigned a value based on expert scoring or historical data analysis, for example, a sensitivity of 0.9 for location, 0.3 for temperature, and 0.5 for voltage. Dynamic classification of fine-grained device features based on the feature sensitivity index can categorize feature vectors into sensitive and non-sensitive features. Specifically, a threshold, such as 0.6, is set. Features above this threshold are classified as sensitive, such as location, and features below this threshold are classified as non-sensitive, such as temperature. In one possible implementation, the classification process can be dynamically adjusted. For example, the location sensitivity might increase to 0.95 when the device is moving and decrease to 0.85 when stationary. This dynamism ensures that the classification is tailored to the actual scenario. When setting a total privacy budget, it can be considered the total amount of resources required to protect all sensitive features. For example, a total budget of 10 units is allocated based on the weight of the sensitive features. Preferably, the weight for location is 0.6 and the weight for voltage is 0.3. During allocation, location receives 6 units and voltage receives 3 units, leaving 1 unit for reserve. In one possible implementation, if a new sensitive feature, such as acceleration, is added, its weight is 0.2 and can be allocated from the reserve budget. This approach ensures flexibility and fairness in resource allocation. When calculating the feature sensitivity of sensitive features, their protection needs can be assessed based on the allocated privacy budget. It should be noted that, due to a sufficient budget, the calculated sensitivity of location may decrease to 0.7, while the sensitivity of voltage, due to a smaller budget, may remain at 0.5. It is understandable that this calculation reflects the moderating effect of budget on feature privacy. For example, location data can be fully protected with a high budget, reducing the risk of leakage. When injecting noise based on the feature sensitivity calculation results, different sensitive features must have corresponding noise amounts. Specifically, if the location sensitivity is 0.7, a larger noise level can be injected, such as adding a random offset of ±0.05 to the longitude and latitude; if the voltage sensitivity is 0.5, a smaller noise level can be injected, such as a perturbation of ±0.02V. In one possible implementation, the amount of noise may vary over time. For example, the noise may be ±0.06 at the beginning of device operation, and then reduced to ±0.03 after stabilization. This differentiated processing protects privacy while preserving data availability as much as possible. For example, if a device collects location data for a long time, its trajectory will still be blurred after multiple injections of noise, making it difficult to reverse engineer the true path. Preferably, voltage data can still reflect battery trends for performance analysis due to its low noise. This multi-faceted design, from core classification to noise injection, forms a complete protection chain. In one possible implementation, if sensitive features change with the environment, such as a sudden temperature rise leading to increased voltage sensitivity, the amount of noise can be temporarily increased to ±0.03V to ensure privacy and security.

[0093] In some embodiments, in step S104, based on the fine-grained device features, a Bloom filter is used to perform rapid fingerprint existence screening, feature similarity is calculated using a SimHash algorithm, and the coefficient of variation of the fingerprint is calculated using a sliding window algorithm to obtain a fingerprint collision detection result and a fingerprint stability assessment result, specifically including:

[0094] Dynamically adjusting the bit array length and the number of hash functions of the Bloom filter according to the current system load, performing a fast existence screening on the fine-grained device features, outputting a potential collision fingerprint identifier when all hash bit marks are detected to be true, and generating a fingerprint collision detection result;

[0095] Based on the fingerprint collision detection results, the SimHash algorithm with feature weights is used to calculate the similarity between fine-grained device features. When the similarity exceeds the preset similarity threshold, the DBSCAN clustering analysis of dynamic neighborhood parameters is triggered to generate a similar device cluster report;

[0096] Based on the similar device cluster report, the sliding window algorithm is used to calculate the fingerprint variation coefficient. When the fingerprint variation coefficient is greater than or equal to the preset coefficient threshold, the correlation between the operating system upgrade event and the fingerprint stability decay rate is evaluated, the device identity credibility score is output, and the fingerprint stability evaluation result is generated.

[0097] In this embodiment, dynamic adjustment parameters are obtained based on the current system load to determine the bit array length and number of hash functions of the Bloom filter. The adjusted bit array length and number of hash functions are used to perform existence screening on the device features to obtain the hash bit mark status. If all hash bit marks are true, a potential collision fingerprint identifier is generated and a preliminary screening result is output. For the potential collision fingerprint identifier, a preset threshold is used to determine whether a real collision exists, and a collision confirmation result is obtained. Based on the collision confirmation result, an associated feature set is extracted from the device features to generate a fingerprint feature vector. The fingerprint feature vector is clustered using the K-means algorithm to determine the distribution pattern of the collision fingerprint. The abnormal fingerprint identifier is obtained through the distribution pattern, and the final detection result is output.

[0098] Through fingerprint collision detection, initial data is obtained from device features, and the SimHash algorithm with feature weights is used to calculate the similarity between fine-grained features to obtain a similarity value. If the similarity value exceeds the preset threshold, the dynamic neighborhood parameter adjustment is triggered to determine the configuration required for DBSCAN clustering. Based on the dynamic neighborhood parameters, DBSCAN clustering is used to group device features with high similarity to obtain preliminary clustering results. Based on the preliminary clustering results, the distribution characteristics of fine-grained features are analyzed to determine whether there are abnormal device features. Based on the distribution characteristics of abnormal device features, the feature weights are adjusted, the similarity calculation of the SimHash algorithm is optimized, and an updated similarity value is obtained. Based on the updated similarity value, DBSCAN clustering is re-executed to determine the final similar device cluster. The final similar device cluster is used, combined with the fingerprint collision data, to verify the consistency of the device features and obtain a similar device cluster report.

[0099] Using a sliding window algorithm, fingerprint variation data is extracted from reports of similar device clusters, and the coefficient of variation is calculated to quantify the degree of fingerprint variation. If the coefficient of variation is greater than or equal to a preset threshold, the upgrade event record is retrieved from the operating system log to determine the time of the upgrade event. By comparing the upgrade event time with the fingerprint variation data, the trend of stability decay is analyzed and the decay rate is calculated. Based on the decay rate trend, whether the device identity has experienced an anomaly is determined, and a credibility score for the device identity is output. Based on the credibility score, the degree of fingerprint stability decay is evaluated, generating preliminary data for the fingerprint stability assessment. After obtaining this preliminary data, the final score is calculated using a preset weighting formula, resulting in a quantitative output of the fingerprint stability assessment results. Based on this quantitative output, the credibility level of the device identity is determined, and the complete results of the fingerprint stability assessment are output.

[0100] For example, when the system load is low, the bit array length can be set to 10,000 bits and the number of hash functions to 3 to reduce memory usage. When the load increases, the bit array length can be increased to 20,000 bits and the number of hash functions to 5 to ensure screening accuracy. It is understood that this dynamic adjustment can reduce false positives under high load. In one possible implementation, after a device feature, such as a MAC address, is hashed, if all corresponding bits are 1, a potential collision fingerprint identifier, such as "MAC_Collision_001," is output, indicating a possible duplication. Based on the fingerprint collision detection results, when calculating similarity using the feature-weighted SimHash algorithm, weights can be assigned to different features. For example, the MAC address can be weighted 0.7, the device model can be weighted 0.4, and the IP address can be weighted 0.2. Specifically, after a device feature vector is calculated using weighted SimHash, a 64-bit fingerprint is generated. If the similarity between two device fingerprints reaches 0.85, exceeding the threshold of 0.8, DBSCAN clustering is triggered. Preferably, DBSCAN's dynamic neighborhood parameters can be adjusted based on load, such as setting the radius to 0.1 under low load and increasing it to 0.15 under high load. This generates a similar device cluster report and identifies potential duplicate device groups. In one possible implementation, based on the similar device cluster report, the sliding window algorithm can set the window size to 5 samples when calculating the coefficient of variation of the fingerprint. For example, if the variation of a device fingerprint in 5 samples is 0.05, 0.07, 0.03, 0.06, and 0.04, the calculated coefficient of variation is 0.25. A preset threshold of 0.2 indicates fingerprint instability. It should be noted that this instability may be related to operating system upgrades, such as frequent adjustments to device fingerprints due to driver changes after an upgrade. Assume that the fingerprint stability decay rate increases from 0.1 to 0.3 after the upgrade, and the device identity confidence score decreases from 0.9 to 0.6, a fingerprint stability assessment result is generated. Specifically, the dynamic adjustment of the Bloom filter can quickly screen a large number of device features, reducing the subsequent computational burden. Weighted SimHash improves similarity accuracy by highlighting key features, and DBSCAN clustering further groups similar devices for easier management. Sliding window combined with coefficient of variation analysis can timely capture fingerprint change trends and evaluate credibility. This multi-level design forms a complete chain from screening to evaluation. In one possible implementation, if the system detects a sudden increase in load, the number of hash functions can be temporarily increased to 7 to ensure screening efficiency. This flexibility adapts to the needs of different scenarios.

[0101] In some embodiments, in step S105, dynamically adjusting the feature weight of each feature vector in the fine-grained device feature based on the fingerprint collision detection result and the fingerprint stability evaluation result through the Q-learning algorithm specifically includes:

[0102] The feature discrimination of the fine-grained device feature, the ratio of the current fingerprint collision rate to the baseline fingerprint collision rate, and the fingerprint variation coefficient are used as the state space, the feature weight adjustment operation of each feature vector in the fine-grained device feature is used as the action space, and the minimization of the number of fingerprint collisions, the number of client device restarts, and the severity of feature weight changes is used as the reward function;

[0103] Based on the state space, the action space and the reward function, a Q-learning algorithm is used for training optimization, and a long-term reward decay factor is combined to dynamically adjust the feature weight of each feature vector in the fine-grained device feature.

[0104] In this embodiment, the initial distribution of feature vectors is calculated using feature discrimination and the coefficient of variation of fingerprints to obtain a preliminary description of the state space. Based on this preliminary description, the collision trend is extracted from the ratio of the current fingerprint collision rate to the baseline fingerprint collision rate, and the dynamic range of the number of fingerprint collisions is determined. Using the Q-learning algorithm, a strategy for adjusting feature weights in the action space is trained based on the dynamic range and the number of device restarts, resulting in an optimized feature weight distribution. If the feature weight distribution causes the weight variation to exceed a preset threshold, the reward function is adjusted using a long-term reward decay factor to determine a new feature weight combination. The adjusted feature weight combination is obtained, and the records of fingerprint collisions and device restarts in the state space are updated to obtain a new state description. Using this new state description, the mapping relationship between feature vectors and the action space is analyzed to determine the final feature weight adjustment result. Based on the final feature weight adjustment result, the convergence of the number of fingerprint collisions and weight variation severity is verified in conjunction with the reward function to obtain a stable optimization output.

[0105] For example, the discriminability of fine-grained device features can be viewed as a measure of each feature vector's ability to distinguish different devices. For example, MAC addresses, due to their uniqueness, may have high discriminability, while device models, due to their high reproducibility, may have low discriminability. Assuming that the discriminability of MAC addresses in a system is assessed to be 0.9, device models to be 0.5, and IP addresses to be 0.3, analyzing these values can provide a preliminary assessment of which features are more suitable as core identifiers. Specifically, the ratio of the current fingerprint collision rate to the baseline fingerprint collision rate reflects the system's performance under the current load. If the baseline collision rate is 0.01 and it rises to 0.03 due to increased load, the ratio is 3, indicating that the system needs to adjust to cope with the pressure. It is understandable that this ratio can intuitively reflect the impact of environmental changes on fingerprint screening. In one possible implementation, if the ratio exceeds 2, the system may prioritize feature weighting to enhance the role of key features. It should be noted that the fingerprint coefficient of variation is used to capture the stability of device fingerprints. For example, if a device's fingerprint varies significantly over multiple samplings, such as 0.02, 0.06, and 0.08, the coefficient of variation may reach 0.35, exceeding the threshold of 0.2, indicating an unstable fingerprint. Preferably, this situation may be triggered by a device reboot or network switch, and the system can accordingly reduce the credibility of the device's fingerprint. In one possible implementation, the state space consists of the three features described above, and the action space is the adjustment of feature weights. For example, if the initial weights are 0.6 for MAC address, 0.3 for device model, and 0.1 for IP address, if the collision rate increases, the MAC address weight can be increased to 0.8 to observe the effect. The reward function's core objective is to minimize the number of collisions, the number of reboots, and the drastic weight changes. If the number of collisions decreases from 10 to 5 after adjustment, the number of reboots does not increase, and the weight changes are smooth, the reward value will increase, indicating that the adjustment is effective. For example, the Q-learning algorithm optimizes weights through trial and error. In one possible implementation, the Q-table is initially empty, and the system updates the Q-values based on the state and action. Incorporating a long-term reward decay factor, such as 0.9, it tends to select a long-term stable strategy. Specifically, during a certain training session, after the MAC address weight increased from 0.5 to 0.7, the number of collisions decreased without causing drastic fluctuations, the Q value increased, and the algorithm recorded this experience. After multiple iterations, the system learned to prioritize adjusting the MAC weight under high load. Preferably, dynamically adjusting feature weights can make the system more flexible. For example, the MAC weight can be reduced to 0.4 to save resources under low load, and increased to 0.8 to improve accuracy under high load. This adaptability ensures a balance between resource utilization and accuracy. In one possible implementation, after training, it was found that the IP address weight remained at 0.2 for a long time, indicating that its contribution to distinguishing devices was limited. The system can optimize feature selection accordingly and reduce invalid calculations. It can be understood that this method forms a closed-loop feedback mechanism through multi-dimensional state evaluation and action optimization.For example, after adjustment, the collision rate of a certain device cluster dropped from 0.05 to 0.02, significantly improving stability and demonstrating the effectiveness of training. This approach also allows for timely response to environmental changes, maintaining efficient system operation.

[0106] Reference Figure 2 An embodiment of the present invention provides a device fingerprint evaluation and detection system 2, the system 2 specifically comprising:

[0107] The first evaluation and detection module 201 is configured to inject a hash value of the device hardware serial number as a random seed into the high-order field of the timestamp based on the improved UUIDv7 algorithm when the client device is first started, thereby generating a unique random identifier with temporal correlation;

[0108] A second evaluation and detection module 202 is configured to locally store the unique random identifier using AES-256 encryption technology and introduce a dynamic parameter of device screen pixel density as an additional entropy source for a key derivation function;

[0109] The third evaluation and detection module 203 is configured to collect fine-grained device features of the client device, dynamically calculate the amount of injected noise by applying differential privacy technology to sensitive features in the fine-grained device features, and report the fine-grained device features and the unique random identifier together;

[0110] The fourth evaluation and detection module 204 is configured to perform a rapid fingerprint presence screening based on the fine-grained device features using a Bloom filter, calculate feature similarity using a SimHash algorithm, and calculate the fingerprint coefficient of variation using a sliding window algorithm to obtain fingerprint collision detection results and fingerprint stability evaluation results;

[0111] The fifth evaluation and detection module 205 is configured to dynamically adjust the feature weight of each feature vector in the fine-grained device feature through a Q-learning algorithm based on the fingerprint collision detection result and the fingerprint stability evaluation result.

[0112] It is understandable that if Figure 1 The contents of the embodiment of the evaluation and detection method for device fingerprint shown in the figure are applicable to the embodiment of the evaluation and detection system for device fingerprint. The functions specifically implemented by the embodiment of the evaluation and detection system for device fingerprint are similar to those in the embodiment of the device fingerprint. Figure 1 The embodiment of the method for evaluating and detecting device fingerprints shown is the same as that shown in FIG. Figure 1 The beneficial effects achieved by the embodiment of the device fingerprint evaluation and detection method shown are also the same.

[0113] It should be noted that the information interaction, execution process and other contents between the above-mentioned systems are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0114] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0115] Reference Figure 3 An embodiment of the present invention further provides a computer device 3, comprising: a memory 302, a processor 301, and a computer program 303 stored in the memory 302. When the computer program 303 is executed on the processor 301, the device fingerprint evaluation and detection method described in any one of the above methods is implemented.

[0116] The computer device 3 may be a desktop computer, a notebook computer, a PDA, a cloud server or other computing devices. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that Figure 3 This is merely an example of the computer device 3 and does not constitute a limitation on the computer device 3 . The computer device 3 may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the computer device 3 may also include input and output devices, network access devices, etc.

[0117] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor may be a microprocessor or any conventional processor.

[0118] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc. equipped on the computer device 3. Furthermore, the memory 302 may include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory 302 may also be used to temporarily store data that has been output or is about to be output.

[0119] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for evaluating and detecting device fingerprints as described in any one of the above methods is implemented.

[0120] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process of the above-mentioned method embodiment by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can at least include: any entity or device capable of carrying computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. For example, a USB flash drive, mobile hard drive, magnetic disk, or optical disk. In some jurisdictions, based on legislation and patent practice, computer-readable media cannot be electric carrier signals or telecommunication signals.

[0121] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0122] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0123] In the embodiments disclosed in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely schematic. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0124] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. A method for evaluating and detecting device fingerprints, characterized in that: The method specifically includes: When the client device is first started, the hash value of the device's hardware serial number is injected into the high-order field of the timestamp as a random seed based on the improved UUIDv7 algorithm to generate a unique random identifier with temporal correlation; The unique random identifier is stored locally using AES-256 encryption technology, and a dynamic parameter of device screen pixel density is introduced as an additional entropy source for the key derivation function; Collect fine-grained device features of the client device, apply differential privacy technology to sensitive features in the fine-grained device features to dynamically calculate the amount of injected noise, and report the fine-grained device features and the unique random identifier together; Based on the fine-grained device features, a Bloom filter is used to quickly screen the fingerprint existence, the feature similarity is calculated using the SimHash algorithm, and the fingerprint variation coefficient is calculated using the sliding window algorithm to obtain fingerprint collision detection results and fingerprint stability assessment results; Based on the fingerprint collision detection result and the fingerprint stability evaluation result, the feature weight of each feature vector in the fine-grained device feature is dynamically adjusted through the Q-learning algorithm.

2. The method according to claim 1, characterized in that The improved UUIDv7 algorithm is based on injecting the hash value of the device hardware serial number as a random seed into the high-order field of the timestamp to generate a unique random identifier with time correlation, specifically including: Obtain the timestamp data when the client device is first started, and divide the timestamp data into a high-order field and a low-order field; Read the client device's hardware serial number and convert it into a fixed-length digest using the SHA-256 hash algorithm; The first k bits of the fixed-length digest are injected into the high-order field for reconstruction to construct a random seed; The Mersenne Twister algorithm is used to process the random number seed to generate a random number sequence, which is then output in UUIDv7 format to generate a unique random identifier.

3. The method according to claim 1, characterized in that The unique random identifier is stored locally using AES-256 encryption technology, and a dynamic parameter of the device screen pixel density is introduced as an additional entropy source for the key derivation function, specifically including: Obtain device screen pixel density parameters in real time, and calculate pixel density dynamic fluctuation values based on device screen pixel density parameters; Quantize and encode the dynamic fluctuation value of pixel density to generate additional value of entropy source; The base key material is constructed based on the SHA-256 hash value of the device's hardware serial number and the additional value of the entropy source, and the key is derived using the PBKDF2-HMAC-SHA512 algorithm to generate a key derivation function; Based on the key derivation function, the AES-GCM encryption algorithm is used to encrypt the unique random identifier, generate ciphertext, and store the ciphertext locally.

4. The method according to claim 1, wherein The collecting of fine-grained device features of the client device specifically includes: When the client device is stationary, sample the gyroscope raw data, calculate the three-axis calibration offset based on the gyroscope raw data, and obtain the gyroscope calibration offset; Generate a theoretical rendering matrix by executing a standard test shader program, and capture the actual frame buffer data output by the client device at the same time. Calculate the pixel-by-pixel error matrix based on the absolute value of the difference between the theoretical rendering matrix and the frame buffer data, and extract the GPU shader rendering error value from the pixel-by-pixel error matrix. Continuously monitor the charge and discharge voltage sequence of the client device, perform discrete second-order derivative calculation based on the charge and discharge voltage sequence, and obtain the second-order derivative of the battery charge and discharge curve.

5. The method according to claim 1, wherein The step of applying differential privacy technology to the sensitive features in the fine-grained device features to dynamically calculate the amount of injected noise specifically includes: Setting a feature sensitivity index, and dynamically classifying each feature vector of the fine-grained device feature according to the feature sensitivity index to obtain sensitive features and non-sensitive features; Setting a total privacy budget, and allocating the privacy budget based on the total privacy budget according to the feature weight of each sensitive feature; Calculate the feature sensitivity of the sensitive features after the privacy budget is allocated to obtain the feature sensitivity calculation results; Based on the feature sensitivity calculation results, corresponding noise addition amounts are injected into different types of sensitive features.

6. The method according to claim 1, wherein Based on the fine-grained device features, a Bloom filter is used to quickly screen the fingerprint existence, the feature similarity is calculated using the SimHash algorithm, and the fingerprint variation coefficient is calculated using the sliding window algorithm to obtain the fingerprint collision detection result and the fingerprint stability evaluation result, which specifically includes: Dynamically adjusting the bit array length and the number of hash functions of the Bloom filter according to the current system load, performing a fast existence screening on the fine-grained device features, outputting a potential collision fingerprint identifier when all hash bit marks are detected to be true, and generating a fingerprint collision detection result; Based on the fingerprint collision detection results, the SimHash algorithm with feature weights is used to calculate the similarity between fine-grained device features. When the similarity exceeds the preset similarity threshold, the DBSCAN clustering analysis of dynamic neighborhood parameters is triggered to generate a similar device cluster report; Based on the similar device cluster report, the sliding window algorithm is used to calculate the fingerprint variation coefficient. When the fingerprint variation coefficient is greater than or equal to the preset coefficient threshold, the correlation between the operating system upgrade event and the fingerprint stability decay rate is evaluated, the device identity credibility score is output, and the fingerprint stability evaluation result is generated.

7. The method according to claim 1, characterized in that The method of dynamically adjusting the feature weight of each feature vector in the fine-grained device feature based on the fingerprint collision detection result and the fingerprint stability evaluation result by using the Q-learning algorithm specifically includes: The feature discrimination of the fine-grained device feature, the ratio of the current fingerprint collision rate to the baseline fingerprint collision rate, and the fingerprint variation coefficient are used as the state space, the feature weight adjustment operation of each feature vector in the fine-grained device feature is used as the action space, and the minimization of the number of fingerprint collisions, the number of client device restarts, and the severity of feature weight changes is used as the reward function; Based on the state space, the action space and the reward function, a Q-learning algorithm is used for training optimization, and a long-term reward decay factor is combined to dynamically adjust the feature weight of each feature vector in the fine-grained device feature.

8. A device fingerprint evaluation and detection system, characterized in that: The system specifically includes: The first evaluation and detection module is configured to inject a hash value of the device's hardware serial number as a random seed into the high-order field of the timestamp based on the improved UUIDv7 algorithm when the client device is first started, thereby generating a unique random identifier with temporal correlation; A second evaluation and detection module is used to locally store the unique random identifier using AES-256 encryption technology and introduce a dynamic parameter of device screen pixel density as an additional entropy source for a key derivation function; A third evaluation and detection module is configured to collect fine-grained device features of the client device, dynamically calculate the amount of injected noise by applying differential privacy technology to sensitive features in the fine-grained device features, and jointly report the fine-grained device features and the unique random identifier; A fourth evaluation and detection module is configured to perform rapid fingerprint presence screening based on the fine-grained device features using a Bloom filter, calculate feature similarity using a SimHash algorithm, calculate the fingerprint coefficient of variation using a sliding window algorithm, and obtain fingerprint collision detection results and fingerprint stability evaluation results; The fifth evaluation and detection module is used to dynamically adjust the feature weight of each feature vector in the fine-grained device feature through a Q-learning algorithm based on the fingerprint collision detection result and the fingerprint stability evaluation result.

9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory, which, when executed on the processor, implements the device fingerprint evaluation and detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the method for evaluating and detecting device fingerprints according to any one of claims 1 to 7 is implemented.

Images