Equipment abnormal behavior identification method and device, equipment, medium and product

Abstract

The invention provides an equipment abnormal behavior identification method and device, equipment, a medium and a product. The method comprises the following steps: acquiring first equipment information and second equipment information, wherein the first equipment information and the second equipment information respectively comprise at least one of equipment native parameters, equipment fingerprint data and interactive behavior characteristics; equipment abnormal behavior recognition is conducted on the first equipment based on the first equipment information and the second equipment information, an equipment abnormal behavior recognition result is obtained, and the equipment abnormal behavior recognition result comprises equipment migration or equipment splitting. According to the technical scheme of the invention, the method can achieve the recognition of the abnormal behaviors of the equipment through the multi-dimensional first equipment information and second equipment information, improves the comprehensiveness of information, achieves the recognition of equipment migration and equipment splitting through the combination of information of different dimensions, and improves the recognition accuracy of the abnormal behaviors of the equipment.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method, apparatus, device, medium, and product for identifying abnormal device behavior. Background Technology

[0002] With the continuous development of Internet technology, a large number of clients access business systems. Business systems generally identify devices by comparing the device identifier (ID) of the clients.

[0003] However, due to the poor stability of device identifier generation on the client side, such as during system version upgrades, application uninstallation and reinstallation, and device factory resets, the same device may generate different device identifiers, resulting in device fragmentation and making it impossible to accurately locate the same device. For example, in device migration scenarios, the identifiers of the former and latter devices may not be updated in time, making it impossible to accurately locate the new device.

[0004] In the above process of device identification, the comparison is based on only one dimension of device identification, which leads to inaccurate device identification and makes it impossible to identify abnormal device behavior scenarios such as device migration or device splitting. Summary of the Invention

[0005] This disclosure provides a method, apparatus, device, medium, and product for identifying abnormal device behavior, enabling accurate identification of abnormal device behavior scenarios such as device migration or device splitting through multi-dimensional information.

[0006] According to one aspect of this disclosure, a method for identifying abnormal device behavior is provided, comprising:

[0007] Obtain first device information and second device information, wherein the first device information is related to the first device currently accessing the target device; the second device information is related to the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics;

[0008] Based on the first device information and the second device information, the first device is subjected to abnormal device behavior identification to obtain abnormal device behavior identification results, which include device migration or device splitting.

[0009] Optionally, the method further includes: obtaining the number of information items in the first device information; determining a device abnormal behavior identification strategy based on the number of information items, wherein there are multiple device abnormal behavior identification strategies, and different device abnormal behavior identification strategies correspond to different ranges of the number of information items; and using the device abnormal behavior identification strategy, performing device abnormal behavior identification on the first device based on the first device information and the second device information to obtain the device abnormal behavior identification result.

[0010] Optionally, the device abnormal behavior identification strategy includes a rule-based identification strategy, a probability-based identification strategy, and a machine learning model identification strategy, wherein the number of information items corresponding to the rule-based identification strategy, the probability-based identification strategy, and the machine learning model identification strategy increases sequentially.

[0011] Optionally, based on the first device information and the second device information, the device abnormal behavior identification of the first device is performed to obtain the device abnormal behavior identification result, including: comparing the information content of each information item in the first device information and the second device information to determine the consistency identifier of each information item; judging the consistency identifier of each information item according to the preset identification rules to obtain the device abnormal behavior identification result.

[0012] Optionally, the first device information and the second device information each include a device identifier; the identification rule is used to determine whether the first device information and the second device information correspond to the same device;

[0013] According to pre-set identification rules, the consistency identifiers of each information item are determined to obtain the device abnormal behavior identification result, including: when the device identifiers in the first device information and the second device information are the same, the consistency identifiers of the information items are determined by the identification rules, and when it is determined that the first device information and the second device information correspond to different devices, the device abnormal behavior identification result is determined to be device migration; when the device identifiers in the first device information and the second device information are different, the consistency identifiers of the information items are determined by the identification rules, and when it is determined that the first device information and the second device information correspond to the same device, the device abnormal behavior identification result is determined to be device splitting.

[0014] Optionally, based on the first device information and the second device information, abnormal device behavior identification is performed on the first device to obtain an abnormal device behavior identification result, including: obtaining the confidence level of the consistency of each information item in the same device scenario and different device scenarios; comparing the information content of each information item in the first device information and the second device information to determine the consistency identifier of each information item; based on the consistency identifier of each information item and the confidence level of the consistency of each information item in the same device scenario, determining a first probability that the first device information and the second device information correspond to the same device; based on the consistency identifier of each information item and the confidence level of the consistency of each information item in different device scenarios, determining a second probability that the first device information and the second device information correspond to different devices; and determining the abnormal device behavior identification result based on the first probability and the second probability.

[0015] Optionally, the method for determining the first probability includes: determining the confidence level of the different devices corresponding to the consistency of each information item based on the consistency identifier of each information item and the confidence level of the information item in the same device scenario; determining the probability of different devices based on the confidence level of the different devices corresponding to the consistency of each information item; and determining the first probability based on the difference between a set value and the probability of different devices.

[0016] And / or, the method for determining the second probability includes: determining the confidence level of the consistency of the information item corresponding to the same device based on the consistency identifier of each information item and the confidence level of the information item in different device scenarios; determining the device same probability based on the confidence level of the consistency of each information item corresponding to the same device; and determining the second probability based on the difference between a set value and the device same probability.

[0017] Optionally, determining the device abnormal behavior identification result based on the first probability and the second probability includes: if the first probability is greater than a first threshold and the second probability is less than or equal to a second threshold, then determining the device abnormal behavior identification result as device splitting; if the second probability is greater than the first threshold and the first probability is less than or equal to the second threshold, then determining the device abnormal behavior identification result as device migration.

[0018] Optionally, based on the first device information and the second device information, the abnormal behavior of the first device is identified to obtain the abnormal behavior identification result, including: identifying the first device information and the second device information through a pre-trained device identification model to obtain the abnormal behavior identification result.

[0019] According to another aspect of this disclosure, a device for identifying abnormal device behavior is provided, comprising:

[0020] The information acquisition module is used to acquire first device information and second device information. The first device information is related information of the first device currently accessing the target device; the second device information is related information of the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics.

[0021] The identification module is used to identify abnormal device behavior of the first device based on the first device information and the second device information, and obtain the abnormal device behavior identification result, which includes device migration or device splitting.

[0022] According to another aspect of this disclosure, an electronic device is provided, the electronic device comprising:

[0023] At least one processor; and

[0024] A memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the device abnormal behavior identification method according to any embodiment of this disclosure.

[0026] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores computer instructions for causing a processor to execute and implement the device abnormal behavior identification method according to any embodiment of this disclosure.

[0027] According to another aspect of this disclosure, a computer program product is provided, which, when executed by a processor, implements a method for identifying abnormal device behavior as described in any of the embodiments of this disclosure.

[0028] The technical solution provided in this disclosure, when the first device accesses the target device, obtains multi-dimensional first device information and second device information, and uses the multi-dimensional first device information and second device information to identify abnormal device behavior, thereby improving the comprehensiveness of information. The first device information and second device information respectively include at least one of the device's native parameters, device fingerprint data, and interaction behavior characteristics. By combining information of different dimensions, the identification of device migration and device splitting is realized, thereby improving the accuracy of identifying abnormal device behavior.

[0029] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a flowchart of a method for identifying abnormal device behavior according to an embodiment of this disclosure;

[0032] Figure 2 This is a flowchart of another method for identifying abnormal device behavior in this disclosure embodiment;

[0033] Figure 3 This is a flowchart of another method for identifying abnormal device behavior in this disclosure embodiment;

[0034] Figure 4 This is a flowchart of another method for identifying abnormal device behavior in this disclosure embodiment;

[0035] Figure 5 This is a schematic diagram of the structure of a device for identifying abnormal device behavior according to an embodiment of this disclosure;

[0036] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of this disclosure. Detailed Implementation

[0037] To enable those skilled in the art to better understand the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present disclosure.

[0038] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0039] A brief introduction to the relevant terminology used in the embodiments of this disclosure is provided below:

[0040] Device identifier: Generated by concatenating and encoding multiple device characteristic values. The client's device identifier is typically stored in application storage. When a client logs into an application, it can retrieve the cached device identifier from the application storage to access the application server. During application uninstallation and reinstallation, the application's internal storage is cleared, causing the cache to expire and triggering a local regeneration of the device identifier. If the current device state has changed significantly compared to the last generated device identifier, such as during system version upgrades or factory resets, the newly generated device identifier may differ from the previous one.

[0041] Device splitting: In some scenarios, the same device may generate a new device identifier, making it impossible to locate the same device by using the device identifier.

[0042] Device migration: The cached data of the first device is migrated to the second device. For example, the first device can be an old device and the second device can be a new device. Since the cached data may include the device identifier of the first device, it may not be updated in time, resulting in the inability to accurately locate the new device when accessing the application server through the device identifier of the first device.

[0043] When a client logs into the application, an access request is generated and sent to the application server. This request may carry the client's device identifier. Typically, device identification is performed by comparing different device identifiers. However, this method of device identification has limitations: it relies on a single dimension, has poor accuracy, and cannot identify scenarios involving device migration or splitting. In this embodiment, device migration and splitting are treated as abnormal device behaviors. By identifying these occurrences, precise location of each device can be achieved, avoiding confusion between different devices or different device identifiers of the same device.

[0044] To address the aforementioned technical issues, this disclosure provides a method for identifying abnormal device behavior. This method uses multi-dimensional information to identify device migration and device splitting. Figure 1 This flowchart illustrates a method for identifying abnormal device behavior according to an embodiment of this disclosure. This embodiment is applicable when a client accesses a target device. By acquiring multi-dimensional device information corresponding to the client, the first device is identified using this multi-dimensional device information to determine if there is device splitting or migration. This method can be executed by a device abnormal behavior identification device according to this disclosure. This device can be implemented in software and / or hardware and is integrated into electronic devices such as computer devices and servers. Figure 1 As shown, the method specifically includes the following steps:

[0045] S110. Obtain first device information and second device information, wherein the first device information is the relevant information of the first device currently accessing the target device; the second device information is the relevant information of the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics.

[0046] S120. Based on the first device information and the second device information, perform abnormal device behavior identification on the first device to obtain abnormal device behavior identification results, wherein the abnormal device behavior identification results include device migration or device splitting.

[0047] In this embodiment, the first device and the second device can be accessing devices, and the target device can be the accessed device. In different scenarios, the first device, the second device, and the target device can be different devices. For example, in an application login scenario, the first device and the second device can be clients, and the target device can be an application server. The application type is not limited here.

[0048] When the first device logs into the application, it generates an access request and sends it to the application server (i.e., the target device). The access request includes the first device's information. The target device may include a database to store information about second devices that have historically accessed the target device. By parsing the first device information in the access request and reading the second device information from the database, the device is identified using both the first and second device information to obtain the result of abnormal device behavior identification.

[0049] It is understandable that the target device's database stores a large amount of second device information. To improve the efficiency of the identification process and avoid invalid identification processes, the second device information is matched in the database based on the login information corresponding to the first device information to filter out a large amount of invalid device information. Optionally, the first device information and the second device information correspond to the same login information. The second device information can be empty; for example, if no second device information with the same login information is matched in the database, the device method for abnormal device behavior provided in this embodiment does not need to be executed. The second device information can also be one or more pieces of information. Abnormal device behavior identification is performed based on each piece of second device information and the first device information. The identification results of at least one piece of second device information and the first device information are combined to obtain the device abnormal behavior identification result corresponding to the first device. Specifically, if the identification result of any piece of second device information and the first device information is device migration or device splitting, it is determined that the first device exhibits abnormal device behavior of device migration or device splitting.

[0050] The first and second device information are multi-dimensional information, including at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics. Device native parameters can be understood as inherent information of the device itself, determined by the hardware or system level, such as, but not limited to, device model, device manufacturer, MAC address, OAID (Open Anonymous Device Identifier), hardware serial number, IMEI (International Mobile Equipment Identity), and device identifier. Device fingerprint data can be understood as a unique identifier generated by a specific algorithm using multi-dimensional features to represent a specific device. The multi-dimensional features used to generate the device fingerprint data include device hardware parameters, system characteristics, and network characteristics. Interaction behavior characteristics can be understood as feature data formed by the interaction behavior information between the client and the user. For example, it can include interaction behavior identifiers and interaction behavior timestamps. Each interaction behavior identifier identifies an interaction behavior, and the interaction behavior timestamp represents the event information of the interaction behavior. Interaction behavior characteristics can be in the form of data sequences or matrices, representing the interaction behavior characteristics between the client and the user within a set time period.

[0051] In this embodiment, multi-dimensional first device information and second device information are obtained respectively. The abnormal behavior of the device is identified by using multi-dimensional information, thereby improving the comprehensiveness of the information and the accuracy of the identification of abnormal device behavior, and realizing the identification of device migration and device classification.

[0052] In this embodiment, multiple device abnormal behavior identification strategies are pre-set. Based on the first device information and the second device information, device abnormal behavior can be identified using any of these strategies to obtain the identification result. Here, a device abnormal behavior identification strategy can be understood as a processing strategy capable of identifying device abnormal behavior. Different strategies are applicable to different identification conditions, where the identification condition can be the number of information items in the first device information; different identification conditions correspond to different ranges of the number of information items. Each information type among the device's native parameters, device fingerprint data, and interaction behavior features can be considered as an information item.

[0053] Optionally, the number of information items in the first device information is obtained; a device abnormal behavior identification strategy is determined based on the number of information items, wherein there are multiple device abnormal behavior identification strategies, and different device abnormal behavior identification strategies correspond to different ranges of the number of information items; based on the first device information and the second device information, the device abnormal behavior is identified using the device abnormal behavior identification strategy to obtain the device abnormal behavior identification result.

[0054] It is understandable that different clients may report different information items in the first device information when accessing the target device, resulting in a different number of information items in the first device information. Based on the correspondence between the device anomaly identification strategy and the range of information item counts, the information item data in the first device information is matched with the above correspondence to determine the range of information item counts to which the information item data in the first device information belongs. The device anomaly behavior identification strategy corresponding to the range of information item counts to which the information item data in the first device information belongs is determined as the selected device anomaly behavior identification strategy. Using the selected device anomaly behavior identification strategy, the first device is identified for anomaly behavior based on the first device information and the second device information to obtain the device anomaly behavior identification result.

[0055] Understandably, even with the same device abnormal behavior recognition strategy, different information items will result in varying computational loads and recognition effectiveness during the recognition process. To address these issues, multiple device abnormal behavior recognition strategies are designed, each suitable for different ranges of information item quantities, balancing recognition efficiency and accuracy.

[0056] Optionally, the device abnormal behavior identification strategy includes a rule-based identification strategy, a probability-based identification strategy, and a machine learning model identification strategy, wherein the number of information items corresponding to the rule-based identification strategy, the probability-based identification strategy, and the machine learning model identification strategy increases sequentially. The rule-based identification strategy can be understood as a strategy for identifying device abnormal behavior through pre-defined identification rules, suitable for situations where the first device information includes a small number of information items, for example, the number of information items in the first device information is less than N. The probability-based identification strategy can be understood as a strategy for identifying device abnormal behavior by determining the probability that the first device information and the second device information correspond to the same device and the probability that they correspond to different devices, suitable for situations where the number of information items in the first device information is greater than or equal to N and less than M, where M is greater than N. The machine learning model identification strategy can be understood as a strategy for identifying device abnormal behavior by analyzing the first device information and the second device information through a machine learning model, suitable for situations where the number of information items in the first device information is greater than or equal to M.

[0057] By analyzing the first and second device information using any of the aforementioned device abnormal behavior identification strategies, a device abnormal behavior identification result is obtained. This result can be no abnormality, device migration, or device splitting. In this embodiment, the number of information items in the first device information is processed hierarchically, and the corresponding device abnormal behavior identification strategy is invoked based on the data volume range to which the number of information items in the first device information belongs. This achieves hierarchical invocation of different device abnormal behavior identification strategies, balancing identification efficiency and accuracy.

[0058] The technical solution of this embodiment, when the first device accesses the target device, obtains multi-dimensional first device information and second device information, and uses the multi-dimensional first device information and second device information to identify abnormal device behavior, thereby improving the comprehensiveness of information. The first device information and second device information respectively include at least one of the device's native parameters, device fingerprint data, and interaction behavior characteristics. By combining information of different dimensions, the identification of device migration and device splitting is realized, thereby improving the accuracy of device abnormal behavior identification.

[0059] Figure 2 This is a flowchart of another method for identifying abnormal device behavior provided in this disclosure. Based on the above embodiments, a method for identifying abnormal device behavior corresponding to a rule-based identification strategy is provided. This method specifically includes:

[0060] S210. Obtain first device information and second device information, wherein the first device information is related information of the first device currently accessing the target device; the second device information is related information of the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics.

[0061] S220. Compare the information content of each information item in the first device information and the second device information to determine the consistency identifier of each information item.

[0062] S230. The consistency identifier of each information item is determined according to the pre-set identification rules to obtain the identification result of the abnormal behavior of the device.

[0063] The first and second device information each include multiple information items. The information content of the same information item in the first and second device information is compared, and a consistency flag is set for that information item. The consistency flag can be 0 or 1, where 1 indicates that the information content of that information item is the same in both the first and second device information, and 0 indicates that the information content of that information item is different in both the first and second device information. For example, taking device model as an example, if the information content of the device model is the same in both the first and second device information, the consistency flag for the device model is 1; if the information content of the device model is different in both the first and second device information, the consistency flag for the device model is 0. See Table 1 for examples; Table 1 is a table displaying consistency flags.

[0064] Table 1

[0065]

[0066] As shown in Table 1, the information items in the first and second device information include device model, IMEI, ID, OAID, hardware serial number, MAC address, and device manufacturer. The information items in Table 1 are only one example. The consistency identifier for each row in Table 1 is obtained by comparing the first device information with an information item in the second device information. It is understood that the "-" in Table 1 indicates that the first and / or second device information does not include the information content of that item, making comparison impossible, i.e., the consistency identifier for that information item cannot be determined.

[0067] The identification rule is used to determine whether the first device information and the second device information correspond to the same device. When the consistency identifiers of each information item in the first device information and the second device information satisfy the identification rule, it can be determined that the first device information and the second device information correspond to the same device; correspondingly, when the consistency identifiers of each information item in the first device information and the second device information do not satisfy the identification rule, it can be determined that the first device information and the second device information correspond to different devices. Optionally, the identification rule may include a combination of at least one information item's consistency identifiers, which can determine that the first device information and the second device information correspond to the same device. The consistency identifiers of each information item in the first device information and the second device information are matched with the combination of the above-mentioned at least one information item's consistency identifiers. When the match is successful, it is determined that the first device information and the second device information correspond to the same device; when the match fails, it is determined that the first device information and the second device information correspond to different devices. In this embodiment, the identification rule uses an enumeration method to combine and determine the consistency identifiers of multiple information items, making the identification process simple, convenient, and highly accurate.

[0068] The first device information and the second device information each include a device identifier, i.e., the ID in the table above. The identification result of abnormal device behavior can be determined by the consistency of the device identifiers in the first device information and the second device information, as well as by the determination result of whether the first device information and the second device information belong to the same device according to the identification rules.

[0069] Optionally, the consistency identifiers of each information item are determined according to a pre-set identification rule to obtain the device abnormal behavior identification result, including: when the device identifiers in the first device information and the second device information are the same, the consistency identifiers of the information items are determined according to the identification rule, and when it is determined that the first device information and the second device information correspond to different devices, the device abnormal behavior identification result is determined to be device migration; when the device identifiers in the first device information and the second device information are different, the consistency identifiers of the information items are determined according to the identification rule, and when it is determined that the first device information and the second device information correspond to the same device, the device abnormal behavior identification result is determined to be device splitting.

[0070] If the device identifiers in the first device information and the second device information are the same, and if the identification rules determine that the first device information and the second device information correspond to the same device, that is, the device identifiers of the same device are the same in different accesses to the target device, which is a normal phenomenon, then the device abnormal behavior identification result is determined to be no abnormality; if the identification rules determine that the first device information and the second device information correspond to different devices, that is, the device identifiers of different devices are the same in different accesses to the target device, which meets the scenario of device migration, then the device abnormal behavior identification result is determined to be device migration.

[0071] If the device identifiers in the first device information and the second device information are different, and if the identification rules determine that the first device information and the second device information correspond to different devices, that is, the device identifiers are different in different accesses of the target device by different devices, which is a normal phenomenon, then the device abnormal behavior identification result is determined to be no abnormality; if the identification rules determine that the first device information and the second device information correspond to the same device, that is, the device identifiers are different in different accesses of the target device by the same device, which meets the scenario of device splitting, then the device abnormal behavior identification result is determined to be device splitting.

[0072] The technical solution provided in this disclosure, when the number of information items in the first device information is small, uses a rule-based identification strategy to identify abnormal device behavior in the first device information and the second device information, in order to determine whether there are abnormal situations such as device migration or device splitting in the first identification, thereby improving the accuracy of device identification and providing a basis for the client accessing the target device to perform device management.

[0073] Figure 3 This is a flowchart of another method for identifying abnormal device behavior provided in this disclosure. Based on the above embodiments, a method for identifying abnormal device behavior corresponding to a probability identification strategy is provided. This method specifically includes:

[0074] S310. Obtain first device information and second device information, wherein the first device information is related information of the first device currently accessing the target device; the second device information is related information of the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics.

[0075] S320. Obtain the confidence level of consistency of each information item in scenarios with the same device and scenarios with different devices.

[0076] S330. Compare the information content of each information item in the first device information and the second device information to determine the consistency identifier of each information item.

[0077] S340. Based on the consistency identifier of each information item and the confidence level of the consistency of each information item in the same device scenario, determine the first probability that the first device information and the second device information correspond to the same device.

[0078] S350. Based on the consistency identifier of each information item and the confidence level of the consistency of each information item in different device scenarios, determine the second probability that the first device information and the second device information correspond to different devices.

[0079] S360. Determine the abnormal behavior identification result of the device based on the first probability and the second probability.

[0080] The confidence level of information item consistency in the same device scenario can be understood as the confidence level that the first device information and the second device information belong to the same device if the information content of that information item is the same. The confidence level of information item consistency in different device scenarios can be understood as the confidence level that the first device information and the second device information belong to different devices if the information content of that information item is the same. The above confidence level can be understood as a probability, and can be a value between 0 and 1.

[0081] For each information item, a pre-set confidence level is provided for each information item in both the same and different device scenarios. This confidence level can be determined based on statistical data from historical abnormal device behavior identification processes, comparing device information with data from both the same and different device scenarios. Specifically, the confidence level of information item consistency in the same device scenario can be determined by the correspondence between the number of consistent information items and the number of scenarios with the same device during historical abnormal device behavior identification processes; the confidence level of information item consistency in different device scenarios can be determined by the correspondence between the number of consistent information items and the number of scenarios with different devices. Alternatively, the confidence levels of consistency for each information item in both the same and different device scenarios can be set by experts based on statistical results; this is not limited here. It is understood that the confidence levels of consistency for each information item in both the same and different device scenarios can be updated periodically. For example, see Table 2. Figure 2 These are examples of the confidence levels of consistency of each information item in scenarios with the same device and scenarios with different devices.

[0082] Table 2

[0083]

[0084] As shown in Table 2, the confidence levels of information item consistency in scenarios with the same device and scenarios with different devices are independent of each other and there is no correlation.

[0085] The information content of each information item in the first device information and the second device information is compared to determine the consistency identifier of each information item. See Table 1 for details.

[0086] The consistency of each information item is determined based on its consistency identifier. When the consistency identifier of an information item is 1, the information item is considered consistent, and the confidence level of this information item in scenarios with the same device and different devices is shown in Table 2. When the consistency identifier of an information item is 0, the information item is considered inconsistent, and the confidence level of this information item in scenarios with the same device and different devices is zero.

[0087] A first probability is determined based on the consistency identifier of each information item and the confidence level of the consistency of each information item in the same device scenario. Specifically, based on the consistency identifier of each information item and the confidence level of the information item in the same device scenario, the confidence level of the information item consistency corresponding to the device difference is determined; the device difference probability is determined based on the confidence level of the information item consistency corresponding to the device difference; the first probability is determined based on the difference between the set value and the device difference probability.

[0088] When the consistency flag of an information item is 1, the confidence level of the information item's consistency under the same device scenario is read. Correspondingly, the confidence level of information item consistency under different devices is the difference between the value 1 and the confidence level of the information item's consistency under the same device scenario. For example, the confidence level of IMEI information item consistency under the same device scenario is 0.95, and the confidence level under different devices is 1-0.95. When the consistency flag of an information item is 0, the confidence level of the information item's consistency under the same device scenario is zero, and correspondingly, the confidence level of the information item's consistency under different device scenarios is one. When the IMEI in the first device information and the second device information are different, the confidence level of the IMEI information item consistency under different device scenarios is 1-0.95×0=1.

[0089] The confidence level of information item consistency corresponding to different devices can be understood as the probability that the devices are different when the information items are the same. When there are multiple information items, the probability of device difference is determined based on the confidence level of each information item's consistency corresponding to different devices. Specifically, the probability of device difference is determined by multiplying the confidence levels of each information item's consistency corresponding to different devices. For example, the probability of device difference can be expressed as (1-P(e|IMEI_e))(1-P(e|OAID_e))..., where P(e|IMEI_e) represents the confidence level of IMEI consistency in the same device scenario, 1-P(e|IMEI_e) represents the confidence level of IMEI consistency corresponding to different devices, P(e|OAID_e) represents the confidence level of OAID consistency in the same device scenario, and 1-P(e|OAID_e) represents the confidence level of OAID consistency corresponding to different devices. The probability of device difference is determined by multiplying the confidence levels of multiple information item consistency corresponding to different devices.

[0090] For the first device information and the second device information, the sum of the probability that the devices are the same and the probability that the devices are different is 1. Accordingly, the first probability can be determined by setting the difference between the value 1 and the probability that the devices are different, that is, the probability that the first device information and the second device information correspond to the same device, which can be expressed as -(1-P(e|IMEI_e))(1-P(e|OAID_e))...

[0091] Similarly, the method for determining the second probability includes: determining the confidence level of the consistency of each information item corresponding to the same device based on the consistency identifier of each information item and the confidence level of the information item in different device scenarios; determining the device same probability based on the confidence level of the consistency of each information item corresponding to the same device; and determining the second probability based on the difference between a set value and the device same probability.

[0092] When the consistency flag of an information item is 1, the confidence level of the information item's consistency in different device scenarios is read. Correspondingly, the confidence level of the information item's consistency in different device scenarios is the difference between the value 1 and the confidence level of the information item's consistency in different device scenarios. For example, the confidence level of the device model information item's consistency in different device scenarios is 0.99, and the confidence level is 1-0.99 when the corresponding device is the same. When the consistency flag of an information item is 0, the confidence level of the information item's consistency in different device scenarios is zero. Correspondingly, the confidence level of the information item's consistency in different device scenarios is 1. When the OAID in the first device information and the second device information are different, the confidence level of the IMEI information item's consistency in different device scenarios is 1 - 0.99 × 0 = 1.

[0093] The confidence level of information item consistency corresponding to the same device can be understood as the probability that the device is the same when the information items are the same. When there are multiple information items, the probability of the device being the same is determined based on the confidence level of the consistency of each information item corresponding to the same device. Specifically, the probability of the device being the same is determined by multiplying the confidence levels of the consistency of each information item corresponding to the same device. For example, the probability of the device being the same can be expressed as (1-P(e|IMEI_ue))(1-P(e|OAID_ue))..., where P(e|IMEI_ue) represents the confidence level of IMEI consistency in scenarios where the devices are not the same, 1-P(e|IMEI_ue) represents the confidence level of IMEI consistency corresponding to the same device, P(e|OAID_ue) represents the confidence level of OAID consistency in scenarios where the devices are not the same, and 1-P(e|OAID_e) represents the confidence level of OAID consistency corresponding to the same device. The probability of the device being the same is determined by multiplying the confidence levels of the consistency of multiple information items corresponding to the same device.

[0094] For the first device information and the second device information, the sum of the probabilities of the devices being the same and the probabilities of the devices being different is 1. Correspondingly, the second probability, i.e., the probability that the first device information and the second device information correspond to different devices, can be determined by setting a value of 1 and the difference between that value and the probability of the devices being the same. This can be expressed as:

[0095] 1-(1-P(e|IMEI_ue))(1-P(e|OAID_ue))….

[0096] It is understandable that if some information items in the first device information are not reported, that is, when the information content of an information item is missing, the role of that information item in the calculation process of the first probability and the second probability is ignored.

[0097] A pre-defined correspondence between a first probability and a second probability combination and the device anomaly identification result is established. The calculated first and second probabilities are then matched against this correspondence to obtain the device anomaly identification result. Specifically, device splitting and device migration correspond to the first probability data range and the second probability data range, respectively. When the first probability and the second probability fall within the first probability data range corresponding to device splitting, the device anomaly identification result is determined to be device splitting. When the first probability and the second probability fall within the first probability data range corresponding to device migration, the device anomaly identification result is determined to be device migration. When the first probability and the second probability fall within the first probability data range corresponding to no anomaly, the device anomaly identification result is determined to be no anomaly.

[0098] Optionally, determining the device abnormal behavior identification result based on the first probability and the second probability includes: if the first probability is greater than a first threshold and the second probability is less than or equal to a second threshold, then determining the device abnormal behavior identification result as device splitting; if the second probability is greater than the first threshold and the first probability is less than or equal to the second threshold, then determining the device abnormal behavior identification result as device migration.

[0099] The first threshold and the second threshold can be preset, for example, the first threshold and the second threshold can each be 90%. In some embodiments, the first threshold and the second threshold can also be different, and the first threshold and the second threshold can be determined based on statistical data of a large number of device anomaly identification results, which is not limited here. For example, see Tables 3 and 4, Table 3 is an example of the probability range corresponding to device migration, and Table 4 is an example of the probability range corresponding to device splitting.

[0100] Table 3

[0101]

[0102] Table 4

[0103]

[0104]

[0105] Where P_Equal is the first probability and P_Unequal is the second probability.

[0106] In some embodiments, if the first probability is greater than the first threshold and the second probability is greater than the second threshold, it indicates that the data is abnormal, and a counterfeit device behavior prompt message is generated and displayed to the operator so that the operator can further verify the first device information and the second device information to avoid the occurrence of counterfeit device behavior.

[0107] The technical solution provided in this disclosure, when the first device information meets the set information item data range, determines the first probability that the first device information and the second device information correspond to the same device and the second probability that they correspond to different devices by using the consistency identifier of each information item in the first device information and the second device information, and the confidence level of the consistency of each information item in the same device scenario and different device scenarios. The combination of the first probability and the second probability is used to determine the device abnormal behavior identification result, thereby expanding the information items and providing strong interpretability of the device abnormal behavior identification result.

[0108] Figure 4This is a flowchart of another method for identifying abnormal device behavior provided in this disclosure. Based on the above embodiments, a method for identifying abnormal device behavior corresponding to a machine learning model identification strategy is provided. This method specifically includes:

[0109] S410. Obtain first device information and second device information, wherein the first device information is related information of the first device currently accessing the target device; the second device information is related information of the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of device native parameters, device fingerprint data and interaction behavior characteristics.

[0110] S420. Using a pre-trained device recognition model, identify the first device information and the second device information to obtain the device abnormal behavior recognition result.

[0111] When the first device information includes a large number of information items, in order to improve recognition efficiency, a machine learning model recognition strategy is used to analyze the first and second device information. Specifically, a pre-trained device recognition model is invoked, and the first and second device information are input into the device recognition model to obtain the device abnormal behavior recognition result output by the device recognition model. This device recognition model is an end-to-end machine learning model, realizing automatic identification of abnormal device behavior with high recognition efficiency.

[0112] Optionally, the device recognition model can be an XGBoost model. Alternatively, the device recognition model can also be a neural network model such as a CNN or a transformer model.

[0113] The device recognition model is pre-trained based on a sample dataset. The sample dataset can include sample data and corresponding abnormal device behavior labels. The sample data can include two pieces of device information. The device recognition model to be trained is iteratively trained using the above sample dataset to optimize the model parameters until the training termination condition is met, resulting in a well-trained device recognition model.

[0114] The technical solution provided in this disclosure provides a device identification model that is pre-set. This device identification model is suitable for analyzing and processing first and second device information with a large number of information items. When the number of information items is large, it ensures the efficiency and accuracy of identifying abnormal device behavior.

[0115] Figure 5 This is a schematic diagram illustrating the structure of a device for identifying abnormal device behavior, provided in an embodiment of this disclosure. The device can be implemented using software and / or hardware, and can be integrated into any device that provides data processing capabilities, such as… Figure 5 As shown, the device for identifying abnormal behavior of the equipment specifically includes: an information acquisition module 510 and an identification module 520.

[0116] The information acquisition module 510 is used to acquire first device information and second device information. The first device information is related information of the first device currently accessing the target device; the second device information is related information of the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics.

[0117] The identification module 520 is used to identify abnormal device behavior of the first device based on the first device information and the second device information, and obtain the abnormal device behavior identification result, which includes device migration or device splitting.

[0118] The technical solution of this embodiment, when the first device accesses the target device, obtains multi-dimensional first device information and second device information, and uses the multi-dimensional first device information and second device information to identify abnormal device behavior, thereby improving the comprehensiveness of information. The first device information and second device information respectively include at least one of the device's native parameters, device fingerprint data, and interaction behavior characteristics. By combining information of different dimensions, the identification of device migration and device splitting is realized, thereby improving the accuracy of device abnormal behavior identification.

[0119] Optionally, based on the above embodiments, the device further includes a strategy determination module for obtaining the number of information items in the first device information;

[0120] A device abnormal behavior identification strategy is determined based on the number of information items, wherein there are multiple device abnormal behavior identification strategies, and different device abnormal behavior identification strategies correspond to different ranges of information item numbers.

[0121] The identification module 520 is used to identify abnormal device behavior of the first device based on the first device information and the second device information through the device abnormal behavior identification strategy, and obtain the device abnormal behavior identification result.

[0122] Optionally, the device abnormal behavior identification strategy includes a rule-based identification strategy, a probability-based identification strategy, and a machine learning model identification strategy, wherein the number of information items corresponding to the rule-based identification strategy, the probability-based identification strategy, and the machine learning model identification strategy increases sequentially.

[0123] Based on the above embodiments, optionally, the identification module 520 is further configured to compare the information content of each information item in the first device information and the second device information to determine the consistency identifier of each information item; and to determine the consistency identifier of each information item according to the preset identification rules to obtain the identification result of the abnormal behavior of the device.

[0124] Optionally, the first device information and the second device information each include a device identifier; the identification rule is used to determine whether the first device information and the second device information correspond to the same device;

[0125] The identification module 520 is further configured to determine the consistency of the information item by means of the identification rule when the device identifier in the first device information and the second device information are the same, and when it is determined that the first device information and the second device information correspond to different devices, the identification result of the abnormal device behavior is determined to be device migration.

[0126] If the device identifiers in the first device information and the second device information are different, the consistency identifier of the information item is determined by the identification rule. If the first device information and the second device information correspond to the same device, the abnormal behavior identification result of the device is determined to be device splitting.

[0127] Based on the above embodiments, optionally, the identification module 520 is further configured to obtain the confidence level of the consistency of each information item in the same device scenario and in different device scenarios; compare the information content of each information item in the first device information and the second device information to determine the consistency identifier of each information item; based on the consistency identifier of each information item and the confidence level of the consistency of each information item in the same device scenario, determine a first probability that the first device information and the second device information correspond to the same device; based on the consistency identifier of each information item and the confidence level of the consistency of each information item in different device scenarios, determine a second probability that the first device information and the second device information correspond to different devices; and determine the device abnormal behavior identification result based on the first probability and the second probability.

[0128] Optionally, the identification module 520 is further configured to determine the confidence level of the different devices corresponding to the consistency of each information item based on the consistency identifier of each information item and the confidence level of the information item in the same device scenario; determine the probability of different devices based on the confidence level of the different devices corresponding to the consistency of each information item; and determine the first probability based on the difference between a set value and the probability of different devices.

[0129] Optionally, the identification module 520 is further configured to determine the confidence level of the consistency of the information item corresponding to the same device based on the consistency identifier of each information item and the confidence level of the information item in different device scenarios; determine the probability of the same device based on the confidence level of the consistency of each information item corresponding to the same device; and determine the second probability based on the difference between the set value and the probability of the same device.

[0130] Optionally, the identification module 520 is further configured to: if the first probability is greater than the first threshold and the second probability is less than or equal to the second threshold, then determine that the abnormal device behavior identification result is device splitting; if the second probability is greater than the first threshold and the first probability is less than or equal to the second threshold, then determine that the abnormal device behavior identification result is device migration.

[0131] Based on the above embodiments, optionally, the identification module 520 is further configured to identify the first device information and the second device information through a pre-trained device identification model to obtain the device abnormal behavior identification result.

[0132] The above-mentioned device for identifying abnormal equipment behavior can execute the device abnormal behavior identification method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the method execution.

[0133] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0134] like Figure 6As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0135] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0136] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as methods for identifying abnormal device behavior.

[0137] In some embodiments, the method for identifying abnormal device behavior can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via read-only memory (ROM) 12 and / or communication unit 19. When the computer program is loaded into random access memory (RAM) 13 and executed by processor 11, one or more steps of the method for identifying abnormal device behavior described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the method for identifying abnormal device behavior by any other suitable means (e.g., by means of firmware).

[0138] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0139] Computer programs used to implement the methods for identifying abnormal device behavior disclosed herein can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0140] This disclosure also provides a computer-readable storage medium storing computer instructions for causing a processor to execute a method for identifying abnormal device behavior, the method comprising:

[0141] Obtain first device information and second device information, wherein the first device information is the relevant information of the first device currently accessing the target device; the second device information is the relevant information of the second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the device's native parameters, device fingerprint data, and interaction behavior features; based on the first device information and the second device information, perform device abnormal behavior identification on the first device to obtain device abnormal behavior identification results, wherein the device abnormal behavior identification results include device migration or device splitting.

[0142] In the context of this disclosure, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0143] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0144] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0145] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0146] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0147] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for identifying abnormal behavior of equipment, characterized in that, include: Obtain first device information and second device information, wherein the first device information is the relevant information of the first device currently accessing the target device; The second device information is related information of a second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics; Based on the first device information and the second device information, the first device is subjected to abnormal device behavior identification to obtain abnormal device behavior identification results, which include device migration or device splitting.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the number of information items in the first device information; The abnormal behavior identification strategy of the device is determined based on the number of information items, wherein there are multiple abnormal behavior identification strategies of the device, and different abnormal behavior identification strategies correspond to different ranges of the number of information items. The device abnormal behavior identification strategy is used to identify abnormal behavior of the first device based on the first device information and the second device information, and the device abnormal behavior identification result is obtained.

3. The method according to claim 2, characterized in that, The device abnormal behavior identification strategy includes a rule-based identification strategy, a probability-based identification strategy, and a machine learning model identification strategy, wherein the number of information items corresponding to the rule-based identification strategy, the probability-based identification strategy, and the machine learning model identification strategy increases sequentially.

4. The method according to any one of claims 1-3, characterized in that, Based on the first device information and the second device information, abnormal device behavior is identified for the first device to obtain abnormal device behavior identification results, including: The information content of each information item in the first device information and the second device information is compared to determine the consistency identifier of each information item; The consistency of each information item is determined according to the pre-set identification rules to obtain the identification result of the abnormal behavior of the device.

5. The method according to claim 4, characterized in that, The first device information and the second device information each include a device identifier; the identification rule is used to determine whether the first device information and the second device information correspond to the same device; Based on pre-set identification rules, the consistency identifiers of each information item are determined to obtain the abnormal behavior identification result of the device, including: If the device identifiers in the first device information and the second device information are the same, the consistency identifiers of the information items are determined by the identification rules. If the first device information and the second device information correspond to different devices, the abnormal behavior identification result of the device is determined to be device migration. If the device identifiers in the first device information and the second device information are different, the consistency identifier of the information item is determined by the identification rule. If the first device information and the second device information correspond to the same device, the abnormal behavior identification result of the device is determined to be device splitting.

6. The method according to any one of claims 1-3, characterized in that, Based on the first device information and the second device information, abnormal device behavior is identified for the first device to obtain abnormal device behavior identification results, including: Obtain the confidence level of consistency of each information item in scenarios with the same device and scenarios with different devices; The information content of each information item in the first device information and the second device information is compared to determine the consistency identifier of each information item; Based on the consistency identifier of each information item and the confidence level of the consistency of each information item in the same device scenario, a first probability is determined that the first device information and the second device information correspond to the same device. Based on the consistency identifier of each information item and the confidence level of the consistency of each information item in different device scenarios, a second probability is determined that the first device information and the second device information correspond to different devices. The abnormal behavior identification result of the device is determined based on the first probability and the second probability.

7. A device for identifying abnormal equipment behavior, characterized in that, include: The information acquisition module is used to acquire first device information and second device information, wherein the first device information is the relevant information of the first device currently accessing the target device; The second device information is related information of a second device that has historically accessed the target device; the first device information and the second device information respectively include at least one of the following: device native parameters, device fingerprint data, and interaction behavior characteristics; The identification module is used to identify abnormal device behavior of the first device based on the first device information and the second device information, and obtain the abnormal device behavior identification result, which includes device migration or device splitting.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method for identifying abnormal device behavior according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method for identifying abnormal device behavior as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements a method for identifying abnormal device behavior according to any one of claims 1-6.

Images