Data processing method and system

Abstract

The invention discloses a data processing method and system, and the method comprises the steps: obtaining target historical use data of electronic equipment in response to a man-machine verification request; determining the legality of the man-machine verification request based on the target historical use data; when it is determined that the man-machine verification request is legal, it is determined that the man-machine verification request generates a target triggering behavior acting on the electronic device from a natural person, and a target response action responding to the target triggering behavior is executed; and / or under the condition of determining that the man-machine verification request is illegal, executing further security verification processing on the man-machine verification request.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data processing method and system. BACKGROUND

[0002] With the rapid development of the Internet, network security problems are increasingly prominent, and Captcha as an important technical means to distinguish between human users and automated programs (i.e. human-computer verification) always plays an indispensable role. However, since the Captcha method is designed based on stateless challenge problems, it is easy to be cracked and invalid. SUMMARY

[0003] The embodiment of the present application provides a data processing method, comprising: in response to obtaining a human-computer verification request, obtaining target historical use data of an electronic device; determining the legitimacy of the human-computer verification request based on the target historical use data; in the case of determining that the human-computer verification request is legitimate, determining that the human-computer verification request is generated from a natural person acting on the target trigger behavior of the electronic device, executing the target response action responding to the target trigger behavior; and / or in the case of determining that the human-computer verification request is illegal, executing further security verification processing on the human-computer verification request.

[0004] In some embodiments, the determination of the legitimacy of the human-computer verification request based on the target historical use data comprises: inputting the target historical use data into a local anomaly detection model built-in in the electronic device, to output a legitimacy detection result for the human-computer verification request by using the local anomaly detection model; wherein the local anomaly detection model is trained based on target sample data determined by the center server after shuffling and grouping a plurality of terminal sample data uploaded by a plurality of terminal devices including the electronic device.

[0005] In some embodiments, it further comprises: in response to obtaining a model update notification sent by the center server, sending random numbers generated by each terminal device in an online device group to which the electronic device belongs to the center server, so that the center server shuffles and groups each terminal device in the online device group based on the random numbers; determining target model change data based on the local use data of each terminal device in a first group to which the electronic device belongs, so that the center server updates the current anomaly detection model based on the target model change data; updating the local anomaly detection model built-in in the electronic device based on the updated anomaly detection model of the center server.

[0006] In some embodiments, the determining the target model change data based on the local usage data of each terminal device in the first group in which the electronic device is located comprises: controlling each terminal device in the first group to determine model change data of a local anomaly detection model of the terminal device based on local usage data of the terminal device; determining a last terminal device in the first group under a target ranking result, the target ranking result being determined by the center server according to the random numbers; and determining the target model change data based on model change total data determined by the last terminal device, the model change total data being determined by the last terminal device based on model change data of the last terminal device, obtained intermediate model change data, and random numbers transmitted from other terminal devices in the first group.

[0007] In some embodiments, the method further comprises: in a case where the electronic device is a first terminal device in the first group, transmitting, by the electronic device, the model change data of the electronic device and a first random number to a neighboring terminal device in the first group, so that other terminal devices in the first group sequentially transmit corresponding intermediate model change data based on model change data of the other terminal devices, obtained intermediate model change data generated by a previous terminal device, and a second random number transmitted from the previous terminal device, until the last terminal device determines the target model change data based on model change data of the last terminal device, obtained intermediate model change data, and random numbers transmitted from other terminal devices in the first group. In a case where the electronic device is a terminal device between a first terminal device and a last terminal device in the first group, the electronic device determines intermediate model change data of the electronic device based on model change data of the electronic device, random numbers generated by the electronic device, obtained intermediate model change data generated by a previous terminal device, and a second random number transmitted from the previous terminal device, transmits the intermediate model change data of the electronic device and a first random number to a neighboring terminal device in the first group, so that other terminal devices after the electronic device sequentially transmit corresponding intermediate model change data based on model change data of the other terminal devices, obtained intermediate model change data generated by a previous terminal device, and a second random number transmitted from the previous terminal device, until the last terminal device determines the target model change data based on model change data of the last terminal device, obtained intermediate model change data, and random numbers transmitted from other terminal devices in the first group.

[0008] In some embodiments, before sending the random numbers generated by each terminal device in the online device group where the electronic device is located to the center server, the method further comprises: obtaining target public data from a target storage location, the target public data at least including grouping information of the online device group, sorting results of each terminal device in each group, and IP address information of each terminal device in each group; and establishing a trusted communication channel between each terminal device in the first group according to the first digital certificate and the IP address information of each terminal device in the first group, wherein a trusted communication channel based on a second digital certificate exists between each terminal device in the first group and the center server, and the second digital certificate is different from the first digital certificate.

[0009] The embodiments of the present application also provide a data processing method, comprising: in response to obtaining a model update request, sending a model update notification to each terminal device in an online device group; performing out-of-order grouping on each terminal device in the online device group according to each random number returned by each terminal device in the online device group; and updating a current anomaly detection model of a center server according to each target model change data obtained from each group, so that the electronic device in the first group updates a local anomaly detection model built-in locally based on the updated anomaly detection model.

[0010] In some embodiments, the out-of-order grouping of each terminal device in the online device group according to each random number returned by each terminal device in the online device group comprises: determining a target sorting result of each terminal device in the online device group according to each random number, wherein the target sorting result is a sorting result of an aggregated result of a random number matrix formed by performing continuous hash calculation on the random number returned by each terminal device; and dividing each terminal device in the online device group into multiple groups based on the target sorting result.

[0011] In some embodiments, the determining of the target sorting result of each terminal device in the online device group according to each random number comprises: performing hash operation on each random number respectively for a target iteration number to determine a plurality of first hash data corresponding to each random number, wherein the plurality of first hash data corresponding to the same random number respectively correspond to different hash operation numbers, and the target iteration number is determined by subtracting one from the number of terminal devices in the online device group; determining a random number matrix according to each random number and each first hash data; performing aggregation processing on the random number matrix to determine a random number array formed by a plurality of aggregated random numbers, wherein the number of aggregated random numbers is equal to the number of terminal devices; and determining the target sorting result according to the size of each aggregated random number.

[0012] The embodiment of the present application also provides a data processing system, comprising a central server and a plurality of terminal devices in an online device group, the central server sends a model update notification to each terminal device in the online device group in response to obtaining a model update request; each terminal device in the online device group generates a random number, and returns each random number to the central server; the central server performs out-of-order grouping on each terminal device in the online device group based on each random number; target model change data corresponding to each group is determined based on local use data of each terminal device in each group, and each target model change data is sent to the central server; the central server updates a current anomaly detection model of the central server according to each target model change data; and each terminal device in the online device group updates a locally built local anomaly detection model based on the updated anomaly detection model. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the present application, the drawings required in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained according to these drawings without creative labor for those skilled in the art.

[0014] Figure 1 Flowchart of a data processing method of the embodiment of the present application Figure 1 ; Figure 2 Flowchart of a data processing method of the embodiment of the present application Figure 2 ; Figure 3 Flowchart of determining target model change data of the embodiment of the present application Figure 4 Flowchart of a data processing method of the embodiment of the present application Figure 3 ; Figure 5 Connection principle schematic diagram of the central server and each terminal device of the embodiment of the present application Figure 6 Flowchart of a data processing method of the embodiment of the present application Figure 4 ; Figure 7 Flowchart of out-of-order grouping of the embodiment of the present application Figure 8 Flowchart of determining target sorting result of the embodiment of the present application Figure 9 Principle schematic diagram of determining target sorting result of the embodiment of the present application Figure 10 Flowchart of human-computer verification of the terminal device of the embodiment of the present application Figure 11 Flow chart for model updating of embodiments of the present application; Figure 12 Principle diagram for model updating of embodiments of the present application; Figure 13 Structure block diagram of a data processing system of embodiments of the present application. DETAILED DESCRIPTION

[0015] Various aspects and features of the present application are described herein with reference to the drawings.

[0016] It is to be understood that various alterations and modifications can be made to the embodiments of the application herein. Therefore, the above description should not be taken as limiting, but merely as exemplification of the embodiments of the application. Those skilled in the art will envision other modifications within the scope and spirit of the application.

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the application and, together with the general description of the application given above, and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0018] These and other characteristics of the present application will become apparent from the following description of the preferred forms given, by way of non-limiting example only, with reference to the attached drawings.

[0019] It is also to be understood that even though a number of embodiments of the present application have been described herein, the application should not be construed as limited thereto since modifications will readily occur to those skilled in the art.

[0020] The above and other aspects, features, and advantages of the present application will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, when considered in conjunction with the following detailed description.

[0021] Specific embodiments of the present application are described herein with reference to the accompanying drawings. However, it should be noted that the application can be implemented in various ways and should not be construed as limited to the embodiments set forth herein. Rather, these described embodiments are merely exemplary and are used to teach a person skilled in the art how to make and use the application. Other embodiments will occur to those skilled in the art and are within the scope of the present application.

[0022] The specification can use phrases like "in one embodiment", "in another embodiment", "in yet another embodiment", or "in other embodiments", which can refer to one or more embodiments of the same or different embodiments under the present application.

[0023] A data processing method according to an embodiment of the present application comprises the following steps:

[0024] As shown in Figure 1 the data processing method comprises the following steps: Step S101, in response to obtaining a human-computer verification request, obtaining target historical usage data of an electronic device.

[0025] In the embodiment, the electronic device may, for example, include any one of a computer, a tablet, a mobile phone, and a wearable device. The human-computer verification request may be a request for verifying whether a user is a natural person. The human-computer verification request may be triggered after the user completes a verification code input operation, or may be triggered after the user completes a click operation on a specific position or content in a specific picture, or may be triggered after the user completes a movement operation on a specific image or character. The scenario requiring human-computer verification may include any one of the following scenarios: account login, access to a specific function, execution of a specific service, update of device software, download of data from a server, secure payment, content sharing, and the like.

[0026] In response to obtaining the human-computer verification request, target historical data of the electronic device is obtained. The target historical data may include usage data of the electronic device in a past target time period (such as 24 hours, 48 hours, or the like), running data of the electronic device, and the like, and the association therebetween, operation behavior data on the electronic device, and the like.

[0027] Step S102, determining the legality of the human-computer verification request based on the target historical usage data.

[0028] In this embodiment, the target historical use data can be analyzed based on the anomaly detection model, and the legitimacy of the human-computer verification request can be determined according to the result output by the anomaly detection model. For example, the human-computer verification request can be determined to be legitimate if the output result of the anomaly detection model meets a target condition. The target condition can include one of the following: the output result of the anomaly detection model is legitimate, the score output by the anomaly detection model reaches a target threshold, or the anomaly detection model outputs that the target user is performing an operation. If the target condition is not met, the human-computer verification request is determined to be illegitimate. For example, if the output result of the anomaly detection model is illegitimate, or the score output by the anomaly detection model does not reach the target threshold, or the anomaly detection model outputs that a non-target user is performing an operation, the human-computer verification request is determined to be illegitimate.

[0029] In step S103, if it is determined that the human-computer verification request is legitimate, it is determined that the human-computer verification request is generated from a target triggering behavior of a natural person acting on the electronic device, and a target response action responding to the target triggering behavior is executed.

[0030] In this embodiment, if it is determined that the human-computer verification request is legitimate, it is determined that the human-computer verification request is generated from a target triggering behavior of a natural person acting on the electronic device, and a target response action responding to the target triggering behavior is executed. The target triggering behavior may, for example, include any one of the following: performing account login, accessing a specific function, performing a specific service, updating device software, downloading data from a server, secure payment, and content sharing. Correspondingly, the target response action may, for example, include the following: completing login, triggering a specific function, performing address access, downloading, sharing, and the like.

[0031] and / or, In step S104, if it is determined that the human-computer verification request is illegitimate, further security verification processing is performed on the human-computer verification request.

[0032] In this embodiment, if it is determined that the human-computer verification request is illegitimate, further security verification processing is performed on the human-computer verification request. The further security verification processing may, for example, include the following: short message verification, biometric identification verification, question verification, and the like.

[0033] Exemplarily, if a human-computer verification request in a scenario of account login on a notebook computer is received, usage data of the notebook computer in the past 24 hours can be obtained, including the number of unlocking times per hour, the number of input method invocation times per hour, the power consumption per hour, and the charging amount per hour, and then whether the human-computer verification request is legal is determined according to the usage data in the past 24 hours, if legal, the notebook computer performs account login. If illegal, the login is stopped, and prompt information that short message verification needs to be performed is displayed on the notebook computer to perform further security verification processing. Or, if a human-computer verification request in a scenario of secure payment on a mobile phone is received, usage data of the mobile phone in the past 12 hours can be obtained, including the number of unlocking times per hour, the number of input method invocation times per hour, the power consumption per hour, the location change per hour, and the charging time, and then whether the human-computer verification request is legal is determined according to the usage data in the past 12 hours, if legal, the mobile phone performs the corresponding payment function. If illegal, the payment is stopped, and prompt information that face verification needs to be performed is displayed on the mobile phone to perform further security verification processing.

[0034] The data processing method of the embodiment of the application responds to obtaining a human-computer verification request, obtains target historical usage data of an electronic device, determines the legality of the human-computer verification request based on the target historical usage data, determines that the human-computer verification request is generated from a target triggering behavior of a natural person acting on the electronic device in the case of determining that the human-computer verification request is legal, and executes a target response action responding to the target triggering behavior, and / or executes further security verification processing on the human-computer verification request in the case of determining that the human-computer verification request is illegal. In this way, the legality of the human-computer verification request is determined through the target historical usage data of the electronic device, further improving the accuracy of human-computer verification, thereby improving the security of the electronic device.

[0035] In some embodiments of the application, the legality of the human-computer verification request is determined based on the target historical usage data, including: The target historical usage data is input into a local anomaly detection model built in the electronic device to output a legality detection result for the human-computer verification request by using the local anomaly detection model. The local anomaly detection model is trained based on target sample data determined by the center server after shuffling and grouping a plurality of terminal sample data uploaded by a plurality of terminal devices including the electronic device.

[0036] In the embodiment, a plurality of terminal devices including the electronic device are respectively built with a local anomaly detection model, after obtaining the target historical usage data, the electronic device inputs the target historical data into the local anomaly detection model corresponding to the electronic device, and the local anomaly detection model detects the target historical data and outputs a legality detection result for the human-computer verification request.

[0037] Each terminal device can communicate with the center server, each terminal device can send respective terminal sample data to the center server, the server determines target sample data after reordering grouping of the terminal sample data, then trains an anomaly detection model using the target sample data, then each terminal device can obtain the anomaly detection model from the center server and deploy it locally as a local anomaly detection model. Each terminal sample data, for example, includes usage data of each terminal device in a past target time length, such as charging time, unlocking times, power-consuming applications, input method usage times, opened applications and frequencies, network connection information such as network connection times / IP addresses, location change information, and the like. Optionally, the types of each terminal device can be the same, such as all being notebook computers, or all being mobile phones. The types of each terminal device can also be different, for example, some terminal devices are mobile phones, some terminal devices are notebook computers, and some terminal devices are tablet computers.

[0038] In some embodiments of the present application, after the electronic device obtains the anomaly detection model from the center server, the electronic device performs local parameter tuning on the anomaly detection model based on its own sample data to obtain a local anomaly detection model adapted to the electronic device, so that the local anomaly detection model is more in line with the actual situation of the electronic device, and the accuracy of the legality detection can be improved.

[0039] In this way, by inputting the target historical usage data into the local anomaly detection model to perform legality detection of the human-computer verification request, the accuracy and efficiency of the legality detection of the human-computer verification request are improved. Moreover, since the target sample data is determined by reordering grouping of each terminal sample data, the accuracy of the local anomaly detection model is improved.

[0040] In some embodiments of the present application, the local anomaly detection model built-in each terminal device and the anomaly detection model in the center server can adopt an autoencoder model. In anomaly detection, the encoder part of the autoencoder can learn the low-dimensional representation of the data, and the decoder part can be used to reconstruct the input data. When the input data is a normal sample, the autoencoder can better reconstruct the data; when the input data is an abnormal sample, the reconstruction error will usually significantly increase, so that it can be used to identify abnormal samples.

[0041] By adopting an autoencoder model as each local anomaly detection model and the anomaly detection model in the center server, the detection efficiency and accuracy of the local anomaly detection model and the anomaly detection model are improved.

[0042] In some embodiments of the present application, as shown in Figure 2 The data processing method further includes the following steps: Step S105, in response to obtaining the model update notification sent by the center server, sending the random number generated by each terminal device in the online device group where the electronic device is located to the center server, so that the center server reorders and groups each terminal device in the online device group based on the random number.

[0043] In this embodiment, in order to adapt to the changing attack means and user behavior patterns, it is necessary to update the local anomaly detection model of each terminal device. The model update notification can be sent by the center server to each terminal device in the online device group where the electronic device is located periodically, or it can be sent by the center server to each terminal device in the online device group in response to the user's update request. Each terminal device can periodically send its status to the center server, and the center server can determine each terminal device in the online state or active state as the online device group, or the online device group can also be composed of multiple online terminal devices specified by the user.

[0044] After obtaining the model update notification, each terminal device in the online device group generates a random number, and the electronic device can collect the random numbers of other terminal devices in the online device group. Each random number is sent to the center server by the electronic device, and then the center server can reorder and group each terminal device in the online device group based on the random number. Alternatively, each terminal device in the online device group can also send its own random number directly to the center server.

[0045] Step S106, determining target model change data based on the local usage data of each terminal device in the first group where the electronic device is located, so that the center server updates the current anomaly detection model based on the target model change data.

[0046] In this embodiment, after the center server reorders and groups, multiple groups can be obtained, and the group where the electronic device is located can be taken as the first group. The local usage data of each terminal device in the first group can be the usage data of each terminal device in the past target time length, for example, including charging time, unlocking times, power-consuming applications, input method usage times, opened applications and frequencies, network connection information such as network connection times / IP addresses, location change information, etc. Each terminal device in the first group can update its local anomaly detection model based on each local usage data, determine model change data, and determine target model change data from each model change data. Then the target model change data can be sent to the center server, so that the center server can update the current anomaly detection model based on the target model change data.

[0047] Step S107, updating the local anomaly detection model built-in locally based on the updated anomaly detection model of the center server.

[0048] In this embodiment, after updating the anomaly detection model, the center server can send a model update completion message to each terminal device in the first group. After receiving the model update completion message, the first electronic device can download the updated anomaly detection model from the center server to the local to update the local built-in local anomaly detection model.

[0049] In this way, the center server groups each terminal device in disorder through each random number, and determines target model change data through the local use data of each terminal device, so that the center server updates the current anomaly detection model based on the target model change data, so that the updated local anomaly detection model can adapt to the constantly changing attack means and user behavior patterns, improve the robustness of the local anomaly detection model, and improve the attack cost of the local anomaly detection model. And in the process of updating the local model, homomorphic encryption, secure multi-party computation technology and other encryption algorithms with high performance loss are not used, which realizes more efficient updating of the local anomaly detection model, while reducing the performance loss in the updating process.

[0050] In some embodiments of the present application, the target model change data is determined based on the local use data of each terminal device in the first group in which the electronic device is located, as follows: Figure 3 As shown, the method comprises the following steps: Step S1061, controlling each terminal device in the first group to determine the model change data of the local anomaly detection model of each terminal device based on the local use data of each terminal device; Step S1062, determining the last terminal device in the first group under a target sorting result, wherein the target sorting result is determined by the center server according to the sorting of each terminal device in the online device group according to each random number.

[0051] In this embodiment, the electronic device can control each terminal device in the first group to train the local anomaly detection model of each terminal device based on the local use data of each terminal device, and determine the model change data. The center server can sort each terminal device in the online device group according to each random number to determine the target sorting result. The electronic device can determine the last terminal device in the first group according to the target sorting result.

[0052] Step S1063, determining the target model change data according to the model change total data determined by the last terminal device, wherein the model change total data is determined by the last terminal device according to the model change data of the last terminal device, the obtained intermediate model change data, and the random number transmitted from each terminal device in the first group, and the intermediate model change data is formed based on the model change data of each terminal device in the first group.

[0053] In this embodiment, the last terminal device in the first group can obtain the intermediate model change data generated by the previous terminal device and the random numbers respectively generated by the other terminal devices in the first group. The last terminal device can determine the total model change data according to the model change data corresponding to the last terminal device, the obtained intermediate model change data, and the random numbers respectively obtained from the other terminal devices in the first group. The electronic device can determine the target model change data according to the total model change data obtained from the last terminal device, and then send the target model change data to the center server for subsequent model updating operation. Alternatively, the last terminal device can also directly send the total model change data as the target model change data to the center server.

[0054] In this way, the target model change data is determined by the total model change data determined by the last terminal device. Since the determination process of the total model change data needs to use the intermediate model change data obtained from the previous terminal device and the random numbers respectively obtained from the other terminal devices in the first group, the difficulty of obtaining the total model change data is improved, thereby improving the attack cost of the attacker, and further improving the security in the local anomaly detection model updating process.

[0055] In some embodiments of the present application, the model change data corresponding to each terminal device includes model parameter gradient, and the total model change data is the sum of the model parameter gradients corresponding to each terminal device, so that the total model change data can accurately represent the parameter adjustment result of each local anomaly detection model corresponding to the first group, thereby improving the accuracy of the total model change data.

[0056] In some embodiments of the present application, the data processing method further comprises: In the case that the electronic device is the first terminal device under the first group, the electronic device passes the model change data and the first random number to the adjacent terminal device in the first group, so that the other terminal devices in the first group pass the corresponding intermediate model change data to the adjacent terminal device in turn based on the model change data, the obtained intermediate model change data generated by the previous terminal device, and the second random number passed from the previous terminal device, until the last terminal device determines the target model change data according to the model change data, the obtained intermediate model change data, and the random numbers respectively passed from the other terminal devices in the first group. In a case where the electronic device is a terminal device between the first terminal device and the last terminal device in the first group, the electronic device determines the intermediate model change data of the electronic device according to the self model change data, the first random number, the obtained intermediate model change data generated by the previous terminal device, and the transmitted second random number, and transmits the intermediate model change data of the electronic device and the first random number to the adjacent terminal device in the first group, so that the other terminal devices after the electronic device transmit the corresponding intermediate model change data in turn based on the self model change data, the obtained intermediate model change data generated by the previous terminal device, and the transmitted second random number, until the last terminal device determines the target model change data according to the self model change data, the obtained intermediate model change data, and the random number transmitted from each terminal device in the first group.

[0057] In the embodiment, if the electronic device is the first terminal device in the first group, the electronic device can generate a plurality of random numbers after determining the corresponding model change data of the electronic device, each random number corresponding to one terminal device after the electronic device, the first random number being the random number corresponding to the second terminal device among the random numbers generated by the electronic device, for example, if there are five terminal devices including the electronic device in the first group, there are four terminal devices after the electronic device, and the electronic device generates four random numbers. Then the electronic device transmits the model change data of the electronic device and the first random number to the adjacent terminal device in the first group, so that the other terminal devices in the first group transmit the corresponding intermediate model change data in turn based on the self model change data, the obtained intermediate model change data generated by the previous terminal device, and the transmitted second random number, until the last terminal device determines the target model change data according to the self model change data, the obtained intermediate model change data, and the random number transmitted from each terminal device in the first group. In some embodiments of the present application, the electronic device determines the corresponding intermediate model change data of the electronic device according to the corresponding model change data of the electronic device and the random numbers generated by the electronic device, and then transmits the random numbers generated by the electronic device to each terminal device after the electronic device, and transmits the corresponding intermediate model change data of the electronic device to the adjacent terminal device in the first group.

[0058] If the electronic device is a terminal device in the first group between the first terminal device and the last terminal device, the electronic device can generate a plurality of random numbers after determining the model change data corresponding to the electronic device, each random number corresponding to a terminal device after the electronic device, for example, if the terminal devices in the first group including the electronic device are 5, the electronic device is the second terminal device, and there are 3 terminal devices after the electronic device, the electronic device generates 3 random numbers. Then, the electronic device determines the intermediate model change data of the electronic device according to the model change data of the electronic device, each random number generated by the electronic device, the intermediate model change data generated by the previous terminal device obtained and the second random number transmitted, and then transmits the intermediate model change data of the electronic device and the first random number to the adjacent terminal device in the first group, so that the other terminal devices after the electronic device successively transmit the corresponding intermediate model change data based on the model change data of the electronic device, the intermediate model change data generated by the previous terminal device obtained and the second random number transmitted, until the last terminal device determines the target model change data according to the model change data of the electronic device, the intermediate model change data obtained and the random number transmitted from each terminal device in the first group.

[0059] In this way, by transmitting each random number generated by the electronic device to each terminal device after the electronic device, and transmitting the intermediate model change data corresponding to the electronic device to the next terminal device after the electronic device, the model change total data is determined by the model change data of each terminal device and each random number generated by each terminal device, which improves the difficulty of obtaining the model change total data, thereby improving the attack cost of the attacker, and further improving the security in the local anomaly detection model updating process.

[0060] In some embodiments of the present application, the model change data corresponding to each terminal device respectively includes model parameter gradients, and determining the intermediate model change data corresponding to the electronic device according to the model change data corresponding to the electronic device and each random number generated by the electronic device can include: subtracting each random number generated by the electronic device from the model parameter gradient corresponding to the electronic device to determine the intermediate model change data corresponding to the electronic device.

[0061] The electronic device determines the intermediate model change data of the electronic device according to the model change data of the electronic device, each random number generated by the electronic device, the intermediate model change data generated by the previous terminal device obtained and the second random number transmitted, which can include: adding the model parameter gradient corresponding to the electronic device, the intermediate model change data received from the previous terminal device before the electronic device, and each random number received from each terminal device before the electronic device, and subtracting each random number generated by the electronic device to determine the intermediate model change data corresponding to the electronic device.

[0062] The intermediate model change data is determined by performing operations on the corresponding model parameter gradient and the corresponding random number, the difficulty of obtaining the total model change data is improved, the attack cost of the attacker is improved, and the security in the local anomaly detection model updating process is improved. In the process of determining the total model change data, the encryption algorithm such as homomorphic encryption and secure multi-party computation technology with high performance loss is not used, the total model change data is determined more efficiently, and the performance loss is reduced.

[0063] Exemplarily, the first terminal device in the first group generates a plurality of random numbers Λ_(1,j), where j∈[1,…,M-Gid], Gid is the group number, and each Λ_(1,j) is sequentially transmitted to the subsequent terminal device in the group, and _1-Λ_(1,j) is transmitted to the second device in the group, where _1 is the model parameter gradient corresponding to the first terminal device; the remaining terminal devices in the group follow the same way, that is, first generate random numbers Λ_(Gid,j), where j∈[Gid,…,M-Gid], and Λ_(Gid,j) is transmitted to each subsequent terminal device, and the data transmitted by the previous terminal device is added with its own _Gid-∑Λ_(Gid,j) and the previous random number ∑Λ_(i,Gid), where i<Gid. Then ∑(i≤Gid) _i+∑(i<Gid,j≤Gid)Λ_(i,j) -∑(j>Gid)Λ_(Gid,j) is transmitted backward, where the first part is the cumulative model parameter gradient value, the second part is the previous model parameter gradient value restored by the backfill random number, and the third part is the model parameter gradient value of the current terminal device protected by adding the random number generated by itself; the last terminal device in the group adds the parameter gradient of itself to the data transmitted by the previous terminal device, and then adds the random number ∑(i<M,j≤M)Λ_(i,j) received from each previous device to obtain the total model change data ∑(i≤M) _i is transmitted to the center server, where M is the number of terminal devices in the first group.

[0064] In the entire data transmission process, each terminal device restores the value of the previous terminal device while protecting its own value. The data of the initial terminal device is always protected by multiple random numbers, and the data of the subsequent terminal device is in a safe state after the sum of the values of the previous terminal device is completed.

[0065] In some embodiments of the present application, before the random numbers generated by each terminal device in the online device group where the electronic device is located are sent to the center server, the following steps are further included: Step S108, obtaining target public data from a target storage location, the target public data at least including grouping information of the online device group, ranking results of each terminal device in each group, and IP address information of each terminal device in each group.

[0066] In this embodiment, in order to improve the authenticity and reliability of the model updating of the center server, the center server saves the target public data to the target storage location, and each terminal device in the online device group can access the target public data according to the url of the target storage location, and can verify the accuracy of the target public data. The target public data can at least include grouping information of the online device group, ranking results of each terminal device in each group, and IP address information of each terminal device in each group. In some embodiments of the present application, the target public data can also include process data for determining the ranking results. Since the IP address information of each terminal device is included in the target public data, to some extent, the device manufacturer is limited to invest in colluding devices, and if he wants to affect the updating of the anomaly detection model, he must invest a large number of real devices, thereby increasing the attack cost of the attacker, and since the target public data also includes the ranking results of each terminal device in each group, the device manufacturer cannot control the ranking.

[0067] Step S109, establishing a trusted communication channel between each terminal device in the first group according to the first digital certificate and the IP address information of each terminal device in the first group, and there is a trusted communication channel between each terminal device in the first group and the center server based on a second digital certificate, and the second digital certificate is different from the first digital certificate.

[0068] In this embodiment, the electronic device can obtain the IP address information of each terminal device in the first group from the target public data, and establish a trusted communication channel between each terminal device in the first group according to the first digital certificate and the IP address information of each terminal device. There is a trusted communication channel between each terminal device in the first group and the center server based on a second digital certificate, and the second digital certificate is different from the first digital certificate.

[0069] In this way, by establishing a trusted communication channel between each terminal device, the security in the model updating process is further improved, and since the second digital certificate is different from the first digital certificate, the attack cost of the attacker is further improved.

[0070] In some embodiments of the present application, a TEE (Trusted Execution Environment, trusted execution environment) chip or a TEE application program can be arranged in each terminal device and the center server. For example, Figure 5As shown, both terminal device 1 and terminal device 2 include a REE (Rich Execution Environment) and a TEE. Other apps and browsers run in the REE, while the corresponding local anomaly detection model runs in the TEE, thereby further improving the security of the detection process. Terminal device 1 and terminal device 2 train their respective local anomaly detection models through the model trainers in their respective TEEs to determine the model change data of the local anomaly detection models. Before updating the model, each terminal device needs to establish a trusted communication channel (mTLS) between itself and with the central server. The trusted communication channel connection with the central server is based on an X.509 certificate (i.e., the second digital certificate), and the device certificate is pre-installed by the manufacturer. Authentication between terminal devices is based on an EK (Endorsement Key) certificate (i.e., the first digital certificate), and the EK is pre-installed by the CPU manufacturer. This hybrid authentication mechanism forces attackers to use real devices from the device manufacturer to infiltrate the "training device group," and even the device manufacturer itself must consume the corresponding real CPU to join the "training device group." This hybrid authentication scheme, combined with out-of-order packet processing, makes it impossible for attackers to complete an attack at a low cost. The model trainer is the only application that has access to user data, which may include hourly statistics (i.e., 24 data points per data attribute) for the past 24 hours, including unlock counts, input method call counts, hourly power consumption / charging time, etc. The model trainer must prove its trustworthiness and software integrity to users, based on its open-source code and the device manufacturer's software signature. Therefore, the model trainer's code and the device manufacturer's software signature are also included in the target public data.

[0071] For example, such as Figure 10 As shown, the terminal device is equipped with REE and TEE, and the terminal device can perform the following steps: Step S301: Obtain a human verification request.

[0072] Step S302: Invoke the local anomaly detection model.

[0073] Step S303: Input the target historical usage data into the local anomaly detection model, so as to use the local anomaly detection model to output the legality detection result for the human-machine verification request.

[0074] Step S304: Check if the human verification request is valid. If yes, proceed to step S305; otherwise, proceed to step S306.

[0075] Step S305: Determine that the human-machine verification request originates from a natural person's action on an electronic device, and execute a target response action in response to the target triggering action.

[0076] Step S306, further security verification processing is performed on the human-computer verification request.

[0077] Among them, step S303 is executed in the TEE of the terminal device, and the remaining steps are executed in the REE of the terminal device, thereby improving the security of the legitimacy detection performed by the local anomaly detection model.

[0078] The embodiments of the present application also propose a data processing method, as shown in the following steps: Figure 6 Step S201, in response to obtaining a model update request, sending a model update notification to each terminal device in the online device group.

[0079] In the present embodiment, each terminal device can periodically send its own state to the center server, and the center server can determine each terminal device in an online state or an active state as an online device group, or the online device group can also be composed of multiple online terminal devices specified by the user.

[0080] The model update request can be triggered automatically periodically, or triggered according to the user's update instruction. The model update request is a model update request for the anomaly detection model, and each terminal device in the online device group is respectively provided with a local anomaly detection model, and each terminal device in the online device group can input the target historical use data into the local anomaly detection model to output the legitimacy detection result for the human-computer verification request by using the local anomaly detection model. In order to adapt to the constantly changing attack means and user behavior patterns, it is necessary to update the local anomaly detection model of each terminal device. The center server responds to obtaining a model update request and sends a model update notification to each terminal device in the online device group.

[0081] Step S202, according to each random number returned by each terminal device in the online device group, performing out-of-order grouping on each terminal device in the online device group.

[0082] In the present embodiment, after obtaining the model update notification, each terminal device in the online device group respectively generates a random number and sends it to the center server, and the center server performs out-of-order grouping on each terminal device in the online device group according to each random number.

[0083] Step S203, according to each target model change data obtained from each group, updating the current anomaly detection model of the center server, so that the electronic device in the first group updates the local anomaly detection model built-in locally based on the updated anomaly detection model.

[0084] ​In this embodiment, after the center server performs out-of-order grouping, a plurality of groups can be obtained, and the group in which the electronic device is located can be determined as the first group. Each terminal device in each group trains the local anomaly detection model thereof using local usage data to determine model change data, and the target model change data corresponding to the group can be determined by the model change data of each terminal device in the same group. The local usage data can include usage data of each terminal device in a past target time period, for example, charging time, unlocking times, power-consuming applications, input method usage times, opened applications and frequencies, network connection information such as network connection times / IP addresses, location change information, and the like.

[0085] The center server updates the current anomaly detection model of the center server according to the target model change data obtained from each group, and the electronic device in the first group can download the updated anomaly detection model from the center server to update the local anomaly detection model corresponding thereto.

[0086] In some embodiments of the present application, the model change data includes model parameter gradients, the target model change data is the sum of the model parameter gradients corresponding to each terminal device in the same group, and updating the current anomaly detection model of the center server according to the target model change data obtained from each group includes: determining a model parameter gradient average value corresponding to each group according to the number of terminal devices in each group and the target model change data; determining a target gradient according to the average of the model parameter gradient average values; and updating the current anomaly detection model of the center server using the target gradient.

[0087] In this way, the target model change data is determined by the model parameter gradients corresponding to each terminal device, so that the target model change data conforms to the parameter change of each local anomaly detection model, the accuracy of the target model change data is improved, and the current anomaly detection model of the center server can be accurately updated.

[0088] The data processing method of the embodiments of the present application groups the terminal devices in disorder by the center server through random numbers, determines the target model change data by the local usage data of each terminal device, and updates the current anomaly detection model of the center server based on the target model change data, so that the updated local anomaly detection model can adapt to the constantly changing attack means and user behavior patterns, the robustness of the local anomaly detection model is improved, and the attack cost of the local anomaly detection model is improved. Moreover, in the process of updating the local model, no encryption algorithm such as homomorphic encryption and secure multi-party computation technology with high performance loss is used, the local anomaly detection model is updated more efficiently, and the performance loss in the updating process is reduced.

[0089] In some embodiments of the present application, the reordering grouping of the terminal devices in the online device group according to the random numbers returned by the terminal devices is performed as shown in Figure 7 comprises the following steps: In step S2021, a target ranking result of the terminal devices in the online device group is determined according to the random numbers, which is a ranking result of an aggregated result of a random number matrix formed by performing a continuous hash calculation on the random numbers returned by the terminal devices.

[0090] In this embodiment, the central server forms a random number matrix by performing a continuous hash calculation on the random numbers returned by the terminal devices, and determines the target ranking result of the terminal devices in the online device group according to the aggregated result of the random number matrix.

[0091] In step S2022, the terminal devices in the online device group are divided into multiple groups based on the target ranking result.

[0092] In this embodiment, the terminal devices in the online device group are divided based on the target ranking result and the number of terminal devices in each group, and multiple groups are determined, and the number of terminal devices in each group can be the same or different.

[0093] In this way, the reordering grouping is performed according to the target ranking result determined by the random numbers, which improves the randomness of the grouping result, thereby improving the security of the model updating process.

[0094] In some embodiments of the present application, the target ranking result of the terminal devices in the online device group is determined according to the random numbers as shown in Figure 8 comprises the following steps: In step S20211, a hash operation is performed on each random number according to a target iteration number, and a plurality of first hash data corresponding to each random number is determined, and the plurality of first hash data corresponding to the same random number corresponds to different hash operation numbers, and the target iteration number is determined by subtracting one from the number of terminal devices in the online device group.

[0095] In this embodiment, the hash operation is performed, i.e., Hash, and the hash operation is performed on each random number according to a target iteration number, and a plurality of first hash data determined by each hash operation is determined. Each random number can correspond to a plurality of first hash data.

[0096] In step S20212, a random number matrix is determined according to each random number and each first hash data.

[0097] Each random number and each first hash data is distributed in rows and columns to determine the random number matrix.

[0098] Step S20213, aggregate processing is performed on the random number matrix to determine a random number array formed by a plurality of aggregated random numbers, the number of the aggregated random numbers being equal to the number of the terminals.

[0099] In this embodiment, the random number matrix is aggregated to determine a plurality of aggregated random numbers, the plurality of aggregated random numbers forming a random number array, the number of each aggregated random number being equal to the number of the terminals.

[0100] Step S20214, the target ranking result is determined according to the size of each aggregated random number.

[0101] In this embodiment, since the number of each aggregated random number is equal to the number of the terminals, the target ranking result can be determined according to the size of each aggregated random number, for example, the target ranking result can be determined according to each aggregated random number from small to large, or the target ranking result can be determined according to each aggregated random number from large to small.

[0102] In this way, the random number matrix is determined according to each random number and each first hash data by performing hash operation on each random number iteratively, and the target ranking result is determined after the random number matrix is aggregated, thereby improving the randomness of the target ranking result, improving the attack cost of the attacker, and further improving the security of the model updating process.

[0103] In some embodiments of the present application, the number of hash operations corresponding to each column in the random number matrix is the same, and the number of hash operations corresponding to each row is sequentially increased, and the aggregation processing on the random number matrix includes summing each column in the random number matrix to determine the random number array, thereby efficiently determining the random number array.

[0104] For example, as shown in FIG. 6, the number of hash operations corresponding to each column in the random number matrix is the same, and the number of hash operations corresponding to each row is sequentially increased. Figure 9As shown, if the online device group includes 4 terminal devices, and the random numbers are r1, r2, r3, and r4 respectively, then the number of iterations is 3. The first hash data corresponding to r1 includes hash(r1), hash(hash(r1)), hash(hash(hash(r1))), the first hash data corresponding to r2 includes hash(r2), hash(hash(r2)), hash(hash(hash(r2))), the first hash data corresponding to r3 includes hash(r3), hash(hash(r3)), hash(hash(r3))), and the first hash data corresponding to r4 includes hash(r4), hash(hash(r4)), hash(hash(r4))). A random number matrix is ​​formed using each random number and each first hash data. The number of hash operations corresponding to each column in the random number matrix is ​​the same, and the number of hash operations corresponding to each row increases sequentially. The random number matrix is ​​summed column by column to determine the random number array. This array contains four aggregated random numbers: ∑ri, ∑hash(ri), ∑hash(hash(ri)), and ∑hash(hash(hash(ri))). The target sorting result can be determined based on the magnitude of these four aggregated random numbers. Because the target sorting result is based on these random numbers, even if an attacker controls the individual terminal devices, they cannot control the target sorting result.

[0105] For example, such as Figure 11 As shown, the terminal devices in the first group include terminal device 1, terminal device 2 and terminal device 3. During the model update process, terminal device 1, terminal device 2, terminal device 3 and the central server all perform corresponding operations in their respective TEEs.

[0106] The central server triggers the start with a time period (24 hours), selects N active terminal devices to participate in this round of model update (the terminal device period informs the central server of its own state), and then sends a model update notification to each terminal device. After receiving the model update notification, each terminal device generates a random number r_i and sends it to the central server. The central server performs out-of-order grouping to obtain N / M groups (M is the number of terminal devices in each group), and publishes the received random numbers r_i, IP addresses of each terminal device and the sorting result (terminal devices can access through a specified url), terminal device 1 is the first terminal device, followed by terminal device 2, and terminal device 3 is the last terminal device. Each terminal device determines the IP addresses of the other two terminal devices through the published data, and establishes a trusted communication channel with the other two terminal devices according to the IP addresses. Then, each terminal device updates the local anomaly detection model based on the local usage data to obtain the model change amount, and the terminal device 1, terminal device 2 and terminal device 3 correspond to the model change amount (i.e. model parameter gradient) Δ_1, Δ_2 and Δ_3 respectively.

[0107] Terminal device 1 generates random numbers Λ_(1,1) and Λ_(1,2), calculates Δ_1-Λ_(1,1)-Λ_(1,2), sends Λ_(1,1) as a random number to terminal device 2, sends Λ_(1,2) as a random number to terminal device 3, and sends Δ_1-Λ_(1,1)-Λ_(1,2) as intermediate model change data to terminal device 2.

[0108] Terminal device 2 generates a random number Λ_(2,1), calculates Δ_1-Λ_(1,1)-Λ_(1,2)+Λ_(1,1)+Δ_2-Λ_(2,1)=Δ_1+Δ_2-Λ_(1,2)-Λ_(2,1), sends Λ_(2,1) as a random number to terminal device 3, and sends Δ_1+Δ_2-Λ_(1,2)-Λ_(2,1) as intermediate model change data to terminal device 3.

[0109] Terminal device 3 calculates Δ_1+Δ_2-Λ_(1,2)-Λ_(2,1)+Λ_(2,1)+Λ_(1,2)+Δ_3=Δ_1+Δ_2+Δ_3, and sends Δ_1+Δ_2+Δ_3 as target model change data to the central server. Then the central server obtains the average value of Δ of one group = (Δ_1+Δ_2+Δ_3) / M, and after obtaining the average value of Δ of all groups, updates the current anomaly detection model. Finally, each terminal device can download and update the local anomaly detection model.

[0110] The model update of the present scheme is based on the model parameter update data (i.e. model parameter gradient) of each terminal device _i, Model Updater only needs to calculate the average value of Δ of each group = (Δ_1+Δ_2+Δ_3) / M, and then update the current anomaly detection model. _i ) (mean) update model. Since it is generally believed that _i can lead to privacy data leakage, existing solutions usually protect _i with homomorphic encryption technology, which has certain design overkill problems for the scenario of the present solution. The data participating in the training cannot be identified, so it does not belong to PII / PI data, and based on the gradient _i, the original data is reversed, which is not easy to implement. Therefore, the present solution adopts a more balanced way of security and feasibility.

[0111] Exemplarily, as shown in Figure 12 , the central server (Model Updater) randomly groups Device1-Device11, and the terminal devices in the first group are Device1, Device5, Device10 and Device6 respectively. Each terminal device in the first group determines the model change data of the local anomaly detection model according to its own local use data, and the local use data includes the number of unlocking times per hour, the number of input method calls per hour, the power consumption per hour and the charging amount per hour in the last 24 hours. The corresponding model change amount (i.e. model parameter gradient) of Device1, Device5, Device10 and Device6 is Δ1, Δ2, Δ3 and Δ4 respectively.

[0112] Device1 generates random numbers Λ11, Λ12 and Λ13, and Device1 sends Λ11, Λ12 and Λ13 as random numbers to Device5, Device10 and Device6 respectively, and sends Δ1-Λ11-Λ12-Λ13 as intermediate model change data to Device5.

[0113] Device5 generates random numbers Λ21 and Λ22, and Device5 sends Λ21 and Λ22 as random numbers to Device10 and Device6 respectively, calculates Δ1-Λ11-Λ12-Λ13+Δ2+Λ11-Λ21-Λ22=Δ1-Λ12-Λ13+Δ2-Λ21-Λ22, and sends Δ1-Λ12-Λ13+Δ2-Λ21-Λ22 as intermediate model change data to Device10.

[0114] Device 10 generates a random number Λ31, Device 10 sends Λ31 as a random number to Device 6, calculates Δ1-Λ12-Λ13+Δ2-Λ21-Λ22+Δ3+Λ12+Λ21-Λ31=Δ1-Λ13+Δ2-Λ22+Δ3-Λ31, and sends Δ1-Λ13+Δ2-Λ22+Δ3-Λ31 as intermediate model change data to Device 6.

[0115] Device 6 calculates Δ1-Λ13+Δ2-Λ22+Δ3-Λ31+Λ13+Λ22+Λ31+Δ4=Δ1+Δ2+Δ3+Δ4, and sends Δ1+Δ2+Δ3+Δ4 as target model change data of the first group to the Model Updater, which updates the current anomaly detection model according to the target model change data of each group.

[0116] By applying the above technical solutions, the model parameter gradient of a certain terminal device is protected by two protection mechanisms, i.e., Λ_(1,j) of the preceding terminal device and Λ_(1,j) of the subsequent terminal device. In the process of passing and accumulating, an attacker, even if intercepts the intermediate passing data, obtains the specific Λ_(1,j) of a certain device, on the premise that the data of the remaining M-1 terminal devices in the group are obtained, i.e., M-1 terminal devices need to be in collusion. _i and Λ_(1,j) of the subsequent terminal device. In the process of passing and accumulating, an attacker, even if intercepts the intermediate passing data, obtains the specific Λ_(1,j) of a certain device, on the premise that the data of the remaining M-1 terminal devices in the group are obtained, i.e., M-1 terminal devices need to be in collusion. _i and Λ_(1,j) of the subsequent terminal device. In the process of passing and accumulating, an attacker, even if intercepts the intermediate passing data, obtains the specific Λ_(1,j) of a certain device, on the premise that the data of the remaining M-1 terminal devices in the group are obtained, i.e., M-1 terminal devices need to be in collusion.

[0117] The attack cost corresponding to the embodiment of the application is quantifiable, and the related parameters can be dynamically adjusted according to the number of devices, the expected attack difficulty. Even if the user does not trust the device manufacturer, there is still a data-neutral proof (privacy guarantee), that is, from the cost point of view, the device manufacturer cannot control the behavior of the anomaly detection model. Since the terminal devices are randomly sorted, the total number of combinations is N! / (N-F)!F!, where N is the number of devices, and M is the group size; only a few combinations of groups form an attack scenario. First, select a group (N / M), select a victim in the group (M), (N / M)*M=N, and there are F-(M-1) attack devices left to be randomly arranged, (N-M)! / (N-M-F+M-1)!(F-M+1)!=(N-M)! / (N-F-1)!(F-M+1)!, the total number of combinations is N(N-M)! / (N-F-1)!(F-M+1)!, and the disclosure probability is (N-F)(N-M)!F! / (F-M+1)!(N-1)!. By using specific numerical analysis, it can be known that when N=50,000 and M=40, F reaches 20% of N, and the probability of successful attack is close to 0; when N=100,000 and M=30, even if F reaches 50% of N, the probability of successful attack remains close to 0, so the attack is economically meaningless, thereby indicating that the device manufacturer (that is, the service provider) will not obtain user data.

[0118] The embodiment of the application also provides a data processing system, as shown in Figure 13 The center server responds to obtain a model update request, and sends a model update notification to each terminal device in the online device group; each terminal device in the online device group generates a random number, and returns each random number to the center server; the center server reorders and groups each terminal device in the online device group based on each random number; determines target model change data corresponding to each group based on the local use data of each terminal device in each group, and sends each target model change data to the center server; the center server updates the current anomaly detection model of the center server according to each target model change data; and each terminal device in the online device group updates the local anomaly detection model built-in based on the updated anomaly detection model.

[0119] The data processing system of the embodiment of the present application makes the center server perform out-of-order grouping on each terminal device through each random number, and determines target model change data through local use data of each terminal device, so that the center server updates the current anomaly detection model based on the target model change data, thereby making the updated local anomaly detection model adapt to the constantly changing attack means and user behavior patterns, improving the robustness of the local anomaly detection model, and improving the attack cost of the local anomaly detection model. And in the process of updating the local model, encryption algorithms such as homomorphic encryption, secure multi-party computation technology and the like with high performance loss are not used, so that the local anomaly detection model is more efficiently updated, and the performance loss in the updating process is reduced.

[0120] The electronic device in the embodiment of the present application can be a terminal, or other devices other than the terminal. Illustratively, the electronic device can be a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted electronic device, a mobile Internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and can also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc., and the embodiment of the present application is not limited specifically.

[0121] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD), or semiconductor media (for example, solid state disk) and the like.

[0122] The above embodiments are only exemplary embodiments of the present application, and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art can make various modifications or equivalent replacements to the present application within the spirit and protection scope of the present application, and such modifications or equivalent replacements shall also be considered to fall within the protection scope of the present application.

Claims

1. A data processing method comprising: obtaining target historical usage data of an electronic device in response to obtaining a human-computer verification request; determining legality of the human-computer verification request based on the target historical usage data; in a case where it is determined that the human-computer verification request is legal, determining that the human-computer verification request is generated from a target triggering behavior of a natural person acting on the electronic device, and performing a target response action in response to the target triggering behavior; and / or, in a case where it is determined that the human-computer verification request is illegal, performing further security verification processing on the human-computer verification request.

2. The method of claim 1, wherein the determining legality of the human-computer verification request based on the target historical usage data comprises: inputting the target historical usage data into a local anomaly detection model built-in the electronic device to output a legality detection result for the human-computer verification request by the local anomaly detection model; wherein the local anomaly detection model is trained by target sample data determined by a center server based on a plurality of terminal sample data uploaded by a plurality of terminal devices including the electronic device after being shuffled and grouped.

3. The method of claim 1 or 2, further comprising: in response to obtaining a model update notification sent by the center server, sending random numbers generated by each terminal device in an online device group to which the electronic device belongs to the center server, so that the center server shuffles and groups each terminal device in the online device group based on the random numbers; determining target model change data based on local usage data of each terminal device in a first group to which the electronic device belongs, so that the center server updates a current anomaly detection model based on the target model change data; updating a local anomaly detection model built-in locally based on the updated anomaly detection model of the center server.

4. The method of claim 3, wherein the determining target model change data based on local usage data of each terminal device in a first group to which the electronic device belongs comprises: controlling each terminal device in the first group to determine model change data of a local anomaly detection model of itself based on local usage data of itself; determining a last terminal device in the first group under a target ordering result, the target ordering result being determined by the center server after ordering each terminal device in the online device group according to each random number; determining the target model change data according to model change total data determined by the last terminal device, wherein the model change total data is determined by the last terminal device according to model change data of itself, obtained intermediate model change data, and random numbers respectively transmitted from other terminal devices in the first group, and the intermediate model change data is formed based on the other terminal devices sequentially transmitting model change data of themselves.

5. The method of claim 4, further comprising: In a case where the electronic device is a first terminal device under the first group, the electronic device passes the self-model change data and the first random number to a neighboring terminal device in the first group, so that other terminal devices in the first group pass corresponding intermediate model change data in turn based on the self-model change data, obtained intermediate model change data generated by a previous terminal device, and the passed second random number, until a last terminal device determines the target model change data according to the self-model change data, obtained intermediate model change data, and random numbers respectively passed from other terminal devices in the first group. In a case where the electronic device is a terminal device between the first terminal device and the last terminal device in the first group, the electronic device determines the self-intermediate model change data according to the self-model change data, self-generated random numbers, obtained intermediate model change data generated by a previous terminal device, and the passed second random number, passes the self-intermediate model change data and the first random number to a neighboring terminal device in the first group, so that other terminal devices after the electronic device pass corresponding intermediate model change data in turn based on the self-model change data, obtained intermediate model change data generated by a previous terminal device, and the passed second random number, until a last terminal device determines the target model change data according to the self-model change data, obtained intermediate model change data, and random numbers respectively passed from other terminal devices in the first group.

6. The method of claim 3, before sending the random numbers generated by the terminal devices in the online device group to the center server, further comprising: obtaining target public data from a target storage location, the target public data at least including grouping information of the online device group, ranking results of the terminal devices in each group, and IP address information of the terminal devices in each group; establishing a trusted communication channel between the terminal devices in the first group according to the first digital certificate and the IP address information of each terminal device in the first group, and a trusted communication channel between the terminal devices in the first group and the center server based on a second digital certificate, the second digital certificate being different from the first digital certificate.

7. A data processing method, comprising: in response to obtaining a model update request, sending a model update notification to each terminal device in an online device group; reordering and grouping each terminal device in the online device group according to each random number returned by each terminal device in the online device group; updating a current anomaly detection model of a center server according to each target model change data obtained from each group, so that an electronic device in a first group updates a locally built local anomaly detection model based on the updated anomaly detection model.

8. The method of claim 7, wherein reordering and grouping each terminal device in the online device group according to each random number returned by each terminal device in the online device group comprises: determining a target ranking result of each terminal device in the online device group according to each random number, the target ranking result being a ranking result of an aggregated result of a random number matrix formed by performing continuous hash calculation on the random number returned by each terminal device; dividing each terminal device in the online device group into multiple groups based on the target ranking result.

9. The method of claim 8, wherein the determining a target ranking result of each terminal device in the online device group according to each random number comprises: performing hash operation on each random number according to a target iteration number to determine a plurality of first hash data corresponding to each random number, the plurality of first hash data corresponding to a same random number corresponding to different hash operation numbers respectively, the target iteration number being determined by subtracting one from a terminal number of the online device group; determining a random number matrix according to each random number and each first hash data; performing aggregation processing on the random number matrix to determine a random number array formed by a plurality of aggregated random numbers, the number of the aggregated random numbers being equal to the terminal number; determining the target ranking result according to the size of each aggregated random number.

10. A data processing system comprising a central server and a plurality of terminal devices in an online device group, the central server sending a model update notification to each terminal device in the online device group in response to obtaining a model update request; each terminal device in the online device group generating a random number and returning each random number to the central server; the central server performing out-of-order grouping on each terminal device in the online device group based on each random number; determining target model change data corresponding to each group based on local use data of each terminal device in each group and sending each target model change data to the central server; the central server updating a current anomaly detection model of the central server according to each target model change data; each terminal device in the online device group updating a locally built local anomaly detection model based on the updated anomaly detection model.

Images