Identification method and device for illegal operation equipment in network environment, medium and equipment

Abstract

The invention discloses a method and a device for identifying illegal operation equipment in a network environment, a medium and equipment. The invention belongs to the technical field of Internet. The method comprises the following steps: acquiring network address information of equipment which publishes violation contents; carrying out vector conversion on the published violation content, carrying out clustering analysis based on the obtained multi-dimensional vector, and distributing the published violation content to a corresponding violation category; screening network address information of equipment in each violation category based on a first mask length to obtain a preliminary screening set; screening the primary screening set with the element quantity reaching a first quantity threshold value based on a second mask length to obtain a screening subset; and if the number of the elements in the screening subset reaches a second number threshold value, determining that the equipment in the current screening subset is illegal operation equipment. According to the scheme, the illegal equipment can be accurately distinguished, the misjudgment rate is reduced, batch associated illegal equipment is locked, and the technical effects of monitoring and traceability requirements of an internet platform are met.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a method, apparatus, medium and device for identifying devices operating illegally in a network environment. Background Technology

[0002] With the rapid development of internet technology, cyberspace has become a core arena for public information exchange and opinion expression. However, this has also led to the proliferation of irregularities such as "internet trolls." These unauthorized devices disrupt the online ecosystem and harm the legitimate rights and interests of platforms and users by registering accounts in bulk, posting meaningless spam, flooding the screen with advertisements, or maliciously manipulating public opinion. Reliable technological means are urgently needed for accurate identification and control of these activities.

[0003] Current technologies for identifying devices operating illegally often rely on single-dimensional judgments, such as simply checking the overlap of account registration information, matching keywords in published illegal content, or basic classification based on IPv4 addresses. However, IPv4 address resources are limited, and many devices share the same public IP address, making it difficult to accurately distinguish individual devices. Furthermore, single-dimensional identification is susceptible to manipulation such as changing accounts or keywords, resulting in a high false positive rate and failing to focus on batches of devices in specific illegal scenarios. Moreover, this identification method's efficiency and accuracy fail to meet the needs of internet platform supervision and regulatory agencies for tracing the source of violations. Summary of the Invention

[0004] This application proposes a method, apparatus, medium, and device for identifying devices operating illegally in a network environment. It addresses the technical problems of existing methods for identifying illegally operated devices, such as reliance on single-dimensional judgment which is susceptible to circumvention techniques and has a high false positive rate; and the difficulty in accurately distinguishing individual devices based on IPv4 addresses, thus failing to meet the traceability requirements of internet platform supervision and regulatory agencies. This solution achieves the technical effects of accurately distinguishing illegal devices, reducing false positive rates, focusing on specific illegal scenarios to lock down batches of associated illegal devices, improving identification efficiency and accuracy, and meeting the traceability requirements of internet platform supervision and regulatory agencies.

[0005] This application provides a method for identifying devices operating illegally in a network environment, the method comprising: Obtain the network address information of the device that published the illegal content, as well as the illegal content itself; The published illegal content is vectorized, and cluster analysis is performed based on the obtained multi-dimensional vectors to assign the published illegal content to the corresponding illegal category; The network address information of devices in each violation category is filtered based on the first mask length to obtain an initial screening set; For the initial set where the number of elements reaches the first threshold, a selection subset is obtained by filtering based on the second mask length. If the number of elements in the filtered subset reaches the second threshold, then the device in the current filtered subset is determined to be a device operating in violation of regulations.

[0006] Furthermore, the published illegal content is vectorized, and cluster analysis is performed based on the obtained multi-dimensional vectors to assign it to the corresponding violation category, including: The illegal content published by each device is vectorized to obtain vector information; The vector information is categorized based on similarity using preset classification rules to obtain clustering results.

[0007] Furthermore, the vector information is categorized based on similarity using preset classification rules to obtain clustering results, including but not limited to: Based on the Euclidean or Mahalanobis distance between the vector information and the cluster center vectors, the shortest Euclidean or Mahalanobis distance is determined as the highest similarity, thus obtaining the clustering result of the illegal content published by the current device.

[0008] or, By training a large model, the model is used to classify and identify the published illegal content, thus obtaining the clustering results of the illegal content published on the current device.

[0009] Furthermore, the network address information of devices in each violation category is filtered based on the first mask length to obtain an initial screening set, including: The 128-bit network address information is split into its first 56 bits to obtain the address prefix of each network address; The network address information with the same address prefix is ​​placed into a set to obtain the initial screening set.

[0010] Furthermore, for the initial set where the number of elements reaches the first threshold, filtering is performed based on the second mask length to obtain a filtered subset, including: For the initial set where the number of elements reaches the first threshold, the new address prefix of each network address information is obtained by splitting the first 64 bits. Network address information with the same new address prefix is ​​placed into a subset to obtain the filtered subset.

[0011] Furthermore, the first quantity threshold is set to 64.

[0012] Furthermore, the second quantity threshold is set to 16.

[0013] This application embodiment also provides a device for identifying devices operating illegally in a network environment, the device comprising: The information acquisition module is used to obtain the network address information of the device that published the illegal content; The violation category classification module is used to perform vector transformation on the published violation content, and to perform cluster analysis based on the obtained multi-dimensional vector to assign the published violation content to the corresponding violation category; The preliminary screening module is used to filter the network address information of devices in each violation category based on the first mask length to obtain a preliminary screening set; The fine-tuning module is used to filter the initial set whose number of elements reaches the first threshold based on the second mask length to obtain the filtered subset; The identification module is used to determine that the device in the current filter subset is a device that is operating illegally if the number of elements in the filter subset reaches a second threshold.

[0014] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method for identifying devices operating illegally in a network environment as described above.

[0015] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the method for identifying devices operating illegally in a network environment as described above.

[0016] The embodiments of this application adopt the following technical solution: obtaining the network address information of the device that published the illegal content and the illegal content; performing vector transformation on the published illegal content, and performing cluster analysis based on the obtained multi-dimensional vector to obtain each illegal category; filtering the network address information of the devices in each illegal category based on a first mask length to obtain a preliminary screening set; for the preliminary screening set where the number of elements reaches a first quantity threshold, filtering based on a second mask length to obtain a screening subset; if the number of elements in the screening subset reaches a second quantity threshold, then determining that the device in the current screening subset is an illegal operation device.

[0017] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects: This solution achieves a comprehensive improvement in the efficiency of identifying illegally operated devices through a multi-dimensional collaborative identification logic, resulting in significant technical effectiveness. Firstly, addressing the issues of existing technologies' susceptibility to circumvention and high false positive rates due to single-dimensional judgment, this solution first performs vector transformation and clustering on the published illegal content, further subdividing the analysis scenario by violation category. This avoids interference from mixed illegal information of different types, significantly reducing the risk of false judgments caused by cross-category misassociations. Secondly, this solution overcomes the drawbacks of limited IPv4 address resources and difficulty in distinguishing shared addresses. Based on a hierarchical masking screening mechanism using network addresses (such as IPv6), it first initially locks the initial screening set with a first mask length, and then precisely locates the screening subset with a second mask length. This not only distinguishes individual devices but also captures the cluster characteristics of illegal devices. Ultimately, this solution provides accurate evidence for locating illegal devices for internet platform supervision and reliable technical support for regulatory agencies to trace and handle cases, maintaining a healthy network ecosystem. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart illustrating the method for identifying devices operating illegally in a network environment, as provided in Embodiment 1 of this application. Figure 2 This is a flowchart illustrating the method for identifying and tracking online troll equipment provided in Embodiment 2 of this application. Figure 3 This is a schematic diagram of the structure of the identification device for illegally operated devices in a network environment provided in Embodiment 3 of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0021] Example 1 Figure 1 This is a flowchart illustrating the method for identifying devices operating illegally in a network environment, as provided in Embodiment 1 of this application. Figure 1As shown, the method includes: S11, Obtain the network address information of the device that published the illegal content and the illegal content; Published content refers to information carriers generated and uploaded by devices in various Internet application scenarios, including but not limited to text and image posts on social platforms, audio and video captions on short video platforms, product reviews on e-commerce platforms, and discussion replies on forums. Its forms include plain text and composite content with mixed multimedia elements.

[0022] Equipment refers to terminal entities with network access capabilities and information dissemination functions, including smartphones, desktop computers, portable laptops, IoT smart terminals, dedicated server clusters, etc.

[0023] Network address information can use IPv6 (Internet Protocol Version 6) addresses, which consist of 128 bits of binary data. This allows each device connected to the Internet to be assigned a globally unique network identifier, completely solving the technical bottleneck caused by the depletion of IPv4 (Internet Protocol Version 4) address resources, which leads to multiple devices sharing the same public network address and the inability to accurately trace individual devices.

[0024] This solution can acquire network address information through the backend service architecture of an internet platform. Specifically, the platform receives reports from internet service providers regarding the publication of illegal content, the IPv6 address of the device publishing the illegal content, metadata such as the content data of the illegal content, the publication timestamp, and the application account ID, and then synchronizes it to the backend processing system corresponding to this identification method through a secure data transmission channel to ensure the integrity and timeliness of the address information.

[0025] S12, the published illegal content is vectorized, and cluster analysis is performed based on the obtained multi-dimensional vector to assign the published illegal content to the corresponding illegal category; Vector transformation refers to the process of mapping unstructured text content that violates regulations into structured, multi-dimensional numerical vectors. For example, if the content violates regulations is text information, the core is to transform abstract information such as the semantic features, grammatical features, and keyword distribution features of the text into numerical forms that can be calculated by a computer.

[0026] A multi-dimensional vector can be a numerical vector containing multiple independent numerical dimensions. For example, if the content of the violation is text information, each dimension corresponds to a specific feature of the text, such as keyword frequency, semantic similarity coefficient, sentiment value, sentence length normalization value, etc. The number of dimensions can be dynamically adjusted according to the actual recognition needs.

[0027] Cluster analysis is a data analysis method based on unsupervised learning. It aggregates data samples with similar features into multiple discrete category sets by calculating the feature similarity between data.

[0028] Violation categories are a predefined classification system based on the nature and characteristics of online violations, such as meaningless spamming, spamming commercial advertisements, malicious public opinion manipulation, dissemination of false information, and fraudulent inducement.

[0029] In this solution, vector transformation can be achieved using various natural language processing techniques. For example, the Word 2 Vec algorithm can be used to map words in the text into low-dimensional dense vectors, and then a weighted average can be used to obtain the vector representation of the entire text. Alternatively, a BERT pre-trained model can be used to semantically encode the text, outputting high-dimensional vectors containing deep semantic information. Clustering analysis can employ algorithms such as K-Means, DBSCAN, and hierarchical clustering. By calculating the similarity distance between multi-dimensional vectors, such as Euclidean distance and cosine similarity, vectors with similarity higher than a preset threshold are grouped into the same category. After clustering analysis, based on the matching degree between the core features of each category set and the preset violation category, the entire category set is mapped to the corresponding violation category. For example, a vector set containing a large number of repeated promotional keywords and link addresses is assigned to the commercial advertising spam category.

[0030] S13, filter the network address information of devices in each violation category based on the first mask length to obtain the initial screening set; The first mask length is a bit length parameter used to split network address information and extract address prefixes. Its value is set based on the network address encoding rules and identification requirements; in this embodiment, it is specifically 56 bits. The initial screening set is a set of all network address information within the same violation category that has the same or similar address prefixes after the network address information is split according to the first mask length. This set reflects the violation association characteristics of devices within the same network segment.

[0031] In this scheme, address prefix extraction and classification can be performed. Specifically, the IPv6 addresses of all devices in the violation category can be binary-split according to the preset first mask length, and the first 56 bits can be extracted as the address prefix. Then, all network address information in the violation category is traversed, and addresses with the same address prefix are grouped into the same set one by one. Each set formed in the end is the initial screening set, and one violation category can correspond to multiple different initial screening sets.

[0032] S14, For the initial set where the number of elements reaches the first threshold, filter based on the second mask length to obtain the filtered subset; The number of elements refers to the number of network address information contained in each initial screening set, which is a key indicator for measuring the concentration of violations by network segment devices corresponding to that set.

[0033] The first quantity threshold is a quantitative standard for determining whether the initial screening set has further analytical value. In this embodiment, it is specifically 64, and its value is set based on the equipment scale characteristics of the batch operation of online water army.

[0034] The second mask length is a bit length parameter used to further split the network address information in the initial screening set. Its number of bits is greater than the first mask length, specifically 64 bits in this embodiment, to achieve more refined address splitting.

[0035] The filtering subset refers to the subset of network address information with the same new address prefix after splitting the initial set according to the second mask length. It can more accurately locate a small cluster of devices that are in violation.

[0036] In this scheme, the initial screening set with the number of elements greater than or equal to the first threshold is selected, and the scattered address sets with a small number of elements are excluded. Then, fine-grained splitting and classification are carried out. That is, each IPv6 address in the selected initial screening set is split according to the second mask length, and the network address information is grouped into the same subset based on the new address prefix to form a screening subset.

[0037] S15, if the number of elements in the filtered subset reaches the second quantity threshold, then the device in the current filtered subset is determined to be a device operating in violation of regulations.

[0038] The second quantity threshold can be a quantitative standard for determining whether a device in the final selection subset is a device operating illegally. In this embodiment, it is specifically 16, and its value takes into account both the accuracy and comprehensiveness of identifying illegal devices.

[0039] Devices used for illegal operations refer to those used to publish illegal content in bulk and to carry out online trolling activities. These devices are usually characterized by centralized and large-scale operations, and their network address information shows a high-density aggregation in a specific network segment.

[0040] In this scheme, if the number of elements in the filtered subset is greater than or equal to the second quantity threshold, then all devices corresponding to the network address information in the filtered subset are determined to be devices operating illegally; if the number of elements does not reach the second quantity threshold, then the devices in the subset are not considered to be devices operating illegally, thus avoiding misjudgment of scattered illegal behaviors of ordinary users.

[0041] The technical solution provided in this embodiment achieves multi-dimensional collaborative optimization for identifying devices engaging in illegal operations. On one hand, by combining the semantic features of published illegal content with the network segment characteristics of network addresses, it overcomes the limitations of single-dimensional identification, which is susceptible to circumvention methods. Through hierarchical filtering with two levels of mask length and progressive judgment with dual quantity thresholds, it can accurately capture the cluster characteristics of online troll devices and effectively distinguish between scattered violations by ordinary users and mass violations by trolls, significantly reducing the false positive and false negative rates. Simultaneously, the entire process is based on standardized technical steps, possessing good operability and scalability, and can meet the dual needs of large-scale supervision of internet platforms and source tracing and handling by regulatory agencies, providing reliable technical support for purifying the online ecosystem.

[0042] In this embodiment, optionally, the published illegal content is vectorized, and cluster analysis is performed based on the obtained multi-dimensional vector to assign the published illegal content to the corresponding violation category, including: The illegal content published by each device is vectorized to obtain vector information; The vector information is categorized based on similarity using preset classification rules to obtain clustering results.

[0043] Among them, vector information is a structured numerical carrier formed by vector transformation of published illegal content. Each dimension corresponds to a specific characteristic indicator of the published illegal content. For example, in commercial advertising content, the values ​​of dimensions such as the frequency of promotional keywords, the number of product links, and the number of times contact information appears will be significantly higher than in other types of content. The numerical distribution of vector information directly reflects the core characteristics of published illegal content.

[0044] This solution employs the TF-IDF (Term Frequency-Inverse Document Frequency) algorithm to preprocess the published content that violates regulations, including word segmentation, stop word removal, and part-of-speech tagging. Then, it calculates the term frequency (the percentage of times the word appears in the current text) and inverse document frequency (the scarcity of the word among all samples of published content violating regulations) for each keyword. Finally, the product of the term frequency and inverse document frequency is used as the keyword's weight. A vector is constructed using the weights of all keywords as dimensions, thus transforming text into a vector.

[0045] The preset classification rules are a predefined classification logic system based on the characteristics of illegal content. They include core parameters such as similarity calculation methods, similarity thresholds, and category mapping relationships. For example, the keyword weight distribution range of advertising feature vectors can be set, or the vector similarity threshold can be set to 0.7.

[0046] Similarity refers to the degree of matching between the vector information to be classified and the preset category feature label vector. The higher the similarity, the better the fit between the content to be classified and the category feature. The clustering result refers to multiple vector sets formed after classification according to similarity. Each set corresponds to a specific violation category, and the vector information in the set all have the core features of that violation category.

[0047] In this scheme, preset feature label vectors for each violation category can be loaded. These vectors are standard feature vectors trained based on a large number of labeled violation content samples. Then, the similarity between the vector to be classified and each category label vector is calculated. Finally, the vectors to be classified with similarity higher than a preset threshold are assigned to the set to which the corresponding category label vector belongs. If the similarity between the vector to be classified and multiple category label vectors is higher than the threshold, the category with the highest similarity is selected for classification. The final set is the clustering result, and each clustering result corresponds to a specific violation category.

[0048] This technical solution clarifies the technical path and operational standards for classifying violation categories, avoiding the ambiguity and subjectivity of cluster analysis. Vector transformation achieved through the TF-IDF algorithm accurately extracts the core keyword features of published violation content, providing a reliable data foundation for subsequent classification. The similarity-based classification logic ensures that content with the same or similar violation characteristics is accurately grouped into the same category, significantly improving the accuracy of violation category classification. This refined design allows subsequent address screening to focus on device clusters within the same violation scenario, effectively reducing the problem of mis-associating addresses caused by the mixing of different types of violation information, providing crucial support for the accuracy of the entire identification method.

[0049] In this embodiment, optionally, the vector information is categorized based on similarity using preset classification rules to obtain clustering results, including: Based on the Euclidean or Mahalanobis distance between the vector information and the cluster center vectors, the shortest Euclidean or Mahalanobis distance is determined as the highest similarity, thus obtaining the clustering result of the illegal content published by the current device.

[0050] or, By training a large model, the model is used to classify and identify the published illegal content, thus obtaining the clustering results of the illegal content published on the current device.

[0051] First, cluster center vectors for each violation category are constructed. These vectors are obtained by vectorizing a large number of violation samples labeled as belonging to that category and calculating the mean of all sample vectors. This represents the standard feature of the violation content in that category. Then, the Euclidean or Mahalanobis distance between the vector to be classified and each cluster center vector is calculated. The vector with the shortest Euclidean or Mahalanobis distance is identified as having the highest similarity, and this vector is assigned to the category corresponding to its cluster center vector. This yields the clustering result for the violation content published on the current device. For example, if the Euclidean distance between a vector to be classified and the cluster center vector for malicious public opinion manipulation is 0.3, which is much smaller than the distances to the cluster center vectors of other categories, then it is classified as a violation of malicious public opinion manipulation.

[0052] Alternatively, in another implementation, a pre-trained large model suitable for text classification tasks is first selected, such as BERT (Bidirectional Encoder Representations from Transformers) or GPT (Generative Pre-trained Transformer). Then, a violation content classification dataset is constructed, containing a large number of text samples labeled with specific violation categories. This dataset is used to fine-tune the pre-trained large model, enabling it to learn the text features and category mappings for different violation categories. After training, the violation content to be classified is directly input into the trained large model. The model uses its internal semantic understanding and feature matching logic to determine the violation category of the published content and outputs a clear classification result, which is the clustering result of the violation content published on the current device. For example, if violation content containing phrases like "earn money by forwarding" or "cash back for referring others" is input into the model, it can directly classify it as a fraudulent inducement violation.

[0053] In this technical solution, the first method uses Euclidean or Mahalanobis distance as the similarity criterion, which is a traditional quantitative analysis method. Its calculation logic is clear, its interpretability is strong, and it ensures the objectivity and repeatability of the classification process. It is suitable for scenarios with clear violation characteristics and regular data distribution. It should be noted that in addition to Euclidean or Mahalanobis distance, other methods can also be used, such as defining similarity based on the cosine of the angle between two vectors; the closer the cosine value is to 1, the higher the similarity. The second method leverages the classification capabilities of large models and uses deep learning technology to capture the deep semantic features of text. It can effectively handle semantically complex and diverse violation content, solving the problem of inaccurate classification of fuzzy semantics by traditional methods. Both methods can be flexibly selected or combined according to the actual application scenario, covering both the efficient classification needs of simple scenarios and the accurate classification requirements of complex scenarios, further improving the reliability of clustering results and providing a higher-quality classification foundation for subsequent address screening and violation device identification.

[0054] In this embodiment, optionally, the network address information of devices in each violation category is filtered based on the first mask length to obtain a preliminary set, including: The 128-bit network address information is split into its first 56 bits to obtain the address prefix of each network address; The network address information with the same address prefix is ​​placed into a set to obtain the initial screening set.

[0055] First, the network address information is identified as a 128-bit IPv6 address. This address uses colon-separated hexadecimal notation, divided into 8 fields, each containing 4 hexadecimal numbers, corresponding to 16 binary bits. Then, the IPv6 address is binary-trimmed according to a preset first mask length. Since each hexadecimal field corresponds to 16 bits, 56 bits correspond to 3 complete fields plus half a field, i.e., 48 bits plus 8 bits. Therefore, the first 3 complete hexadecimal fields plus the first 2 hexadecimal numbers of the fourth field are extracted as the address prefix. For example, an IPv6 address is "2001:0db8:85a3:0000:0000:8a2e:0370:7334", whose first 56 bits in binary form correspond to the hexadecimal representation "2001:0db8:85a3:00", and this part is the extracted address prefix. Finally, iterate through all IPv6 addresses in the current violation category, and place IPv6 addresses with identical address prefixes into the same set. Each such set is the initial screening set. For example, group all IPv6 addresses with the prefix "2001:0db8:85a3:00" together to form an initial screening set, which represents a cluster of violating device addresses within the same 56-bit network segment.

[0056] This technical solution, by specifying the first mask length as 56 bits, provides a unified and specific technical standard for network address information splitting and prefix extraction. This avoids the confusion in screening logic caused by ambiguous mask lengths, improving the operability and repeatability of the method. Prefix clustering based on the first 56 bits of IPv6 addresses can effectively aggregate device addresses within the same network segment. This segment typically corresponds to a specific regional allocation segment of the same network service provider. Its address clustering characteristics can initially reflect the network affiliation of a batch of non-compliant devices, thus quickly pinpointing the approximate network range of potential fraudulent groups. This narrows the analysis scope for subsequent refined screening, significantly improving overall identification efficiency. Simultaneously, the choice of a 56-bit mask length balances network segment coverage and clustering accuracy, avoiding both overly scattered address clusters due to excessively short masks and the inability to capture cluster association characteristics due to excessively long masks.

[0057] In this embodiment, optionally, for the initial screening set where the number of elements reaches a first threshold, filtering is performed based on the second mask length to obtain a filtered subset, including: For the initial set where the number of elements reaches the first threshold, the new address prefix of each network address information is obtained by splitting the first 64 bits. Network address information with the same new address prefix is ​​placed into a subset to obtain the filtered subset.

[0058] The number of IPv6 addresses in each initial screening set is counted. Sets with a first threshold number of elements are designated as target sets for further refinement. These sets typically correspond to large-scale clusters of non-compliant devices. Then, for each IPv6 address in the target set, it is binary-coded according to a preset second mask length. 64 bits correspond to four complete hexadecimal fields; the first four hexadecimal fields of the IPv6 address are used as the new address prefix. For example, the first 64 bits of the IPv6 address 2001:0db8:85a3:0000:0000:8a2e:0370:7334 are represented as 2001:0db8:85a3:0000 in hexadecimal, which is the new address prefix. Finally, all IPv6 addresses in the target initial screening set are iterated through, and IPv6 addresses with the same new address prefix are grouped into the same subset. Each such subset is the selected subset. For example, all IPv6 addresses with the prefix 2001:0db8:85a3:0000 in the initial target screening set are grouped together to form a screening subset, which represents a cluster of non-compliant device addresses within the same 64-bit sub-segment.

[0059] This technical solution, by explicitly defining the second mask length as 64 bits, achieves fine-grained segmentation of the initial screening set. Compared to a 56-bit mask length, the 64-bit mask can divide network addresses into smaller segments, typically corresponding to network allocation addresses within the same local area network or the same device cluster. This allows for more precise targeting of small-scale, concentrated clusters of non-compliant devices, reducing identification interference caused by mixed addresses from different device clusters. Furthermore, by only refining the initial screening set with the required number of elements, it avoids ineffective processing of scattered sets of non-compliant addresses, effectively controlling the data processing volume while improving screening accuracy, thus balancing identification precision and processing efficiency. In addition, the 64-bit mask length is a commonly used subnetting length in IPv6 address allocation, and using this length better adapts to the address allocation rules of existing network architectures, improving the practicality and compatibility of the method.

[0060] In this embodiment, optionally, the specific value of the first quantity threshold is 64.

[0061] When counting the number of elements in the initial screening sets, the number of unique IPv6 addresses contained in each initial screening set is counted one by one to form the element count result for each initial screening set. If the number of elements in an initial screening set is 64 or more, for example, if an initial screening set contains 72 different IPv6 addresses, then the initial screening set meets the condition of "the number of elements reaches the first threshold" and will be included in the subsequent fine-grained screening process based on the second mask length; if the number of elements in an initial screening set is less than 64, for example, if it only contains 45 different IPv6 addresses, then the initial screening set does not meet the condition and will be excluded from the subsequent fine-grained screening process, and will not be further split and classified.

[0062] This technical solution, by clearly defining a first quantity threshold of 64, provides a clear and quantifiable criterion for selecting the initial screening set, avoiding inconsistencies in screening scales caused by ambiguous thresholds and ensuring the standardization and repeatability of the identification process. This threshold is set based on the typical operational characteristics of online trolls—they typically manipulate a large number of devices to conduct batch violations, resulting in a significantly higher number of address elements compared to the scattered violations of ordinary users. Setting the first quantity threshold to 64 effectively filters out initial screening sets with fewer elements. These sets are likely to correspond to independent violations or a small number of related violations by ordinary users, rather than organized batch operations by trolls, thus reducing the data processing volume for subsequent refined screening and improving overall identification efficiency. Simultaneously, this threshold value effectively balances the risks of missed detections and false positives, avoiding both excessively high thresholds that might miss genuine troll device sets and excessively low thresholds that might allow a large number of ordinary violation sets to enter the subsequent process, thereby reducing the overall false positive rate.

[0063] In this embodiment, optionally, the specific value of the second quantity threshold is 16.

[0064] When counting the number of elements in a selected subset, the number of unique IPv6 addresses contained in each subset is counted one by one to form the element count result for each subset. If a selected subset has 16 or more elements, for example, a selected subset contains 23 different IPv6 addresses, then all devices corresponding to the IPv6 addresses in the selected subset are determined to be devices operating illegally. If a selected subset has fewer than 16 elements, for example, it contains only 11 different IPv6 addresses, then the devices in the subset are not considered to be devices operating illegally. The illegal behavior corresponding to these devices is likely to be an occasional associated violation by ordinary users, rather than an organized operation by online trolls.

[0065] This technical solution, by defining a second quantity threshold of 16, provides a precise and quantifiable standard for the final determination of illegally operated devices, ensuring the consistency and reliability of the judgment results. This threshold is set based on the small-batch, concentrated operational characteristics of online troll equipment. After initial screening with a 56-bit mask and fine screening with a 64-bit mask, the range of network segments corresponding to the selected subsets has been significantly narrowed. At this point, a subset with 16 elements indicates the existence of a centralized cluster of illegally operated devices within that subdivided network segment, consistent with the device distribution characteristics of online troll operations. Setting the second quantity threshold to 16 accurately distinguishes between clusters of online troll equipment and occasional violations by ordinary users. This avoids both underestimating small-scale clusters of online troll equipment due to an excessively high threshold and misjudging minor related violations by ordinary users as online troll operations due to an excessively low threshold, further improving the accuracy of identifying illegally operated devices. Simultaneously, the quantifiable judgment standard makes the identification results more convincing, providing clear and reliable technical evidence for the regulatory actions of internet platforms and the source tracing investigations of regulatory agencies.

[0066] Example 2 This embodiment is a preferred embodiment of this application. In order to enable those skilled in the art to better understand the technical solution of this application, this preferred embodiment provides some specific implementation methods. It can be understood that the protection scope of this application includes, but is not limited to, the implementation methods given in this embodiment.

[0067] This application proposes a method and device for identifying and tracking "internet troll" equipment, to curb the proliferation of "internet trolls" and other chaotic phenomena, and to provide internet companies and regulatory agencies with reliable technical means.

[0068] Based on the characteristics of IPv6 addresses, this application provides a method and apparatus for identifying and tracking network troll devices. Figure 2 This is a flowchart illustrating the method for identifying and tracking online troll equipment provided in Embodiment 2 of this application. Figure 2 As shown, it includes: Step S1: Internet companies collect the IPv6 address information and content information of accounts that violate posting rules and report them to this device; Step S2: This device clusters the illegal information, such as distinguishing between meaningless spam or advertisements.

[0069] Step S3: This device performs address aggregation processing within a category of violation information.

[0070] Step S4: The device addresses are collected, the illegal addresses are located, and the data is submitted for further processing.

[0071] Specifically: Step S1: The internet company determines whether the posted content violates company regulations or national laws. If so, it collects the IPv6 address information, time information, and content of the posting account, and reports this information to this device. This device stores the reported IPv6 address, time information, and content in its database, and records the reporting time and basic information of the reporting internet company. If the collected IPv6 address is newly added to the database, the violation counter is set to 1; if the reported IPv6 address is already in the database, the violation counter is incremented by 1.

[0072] Step S2: This device clusters the violation information and transforms the post content into a multi-dimensional information vector. Within the defined multi-dimensional vector space, the clustering categories have been set. The setting method may include k-means, etc. The clustering of the violation information is determined based on the shortest distance between the information vector and the Euclidean or Mahalanobis distance between all cluster center vectors. The violation information is then located in a pre-set category, such as meaningless spam or advertisement.

[0073] Step S3: This device will aggregate the newly collected IPv6 addresses within a category: S3-1, Extract the prefix. The collection method is to divide the collected IPv6 addresses into prefixes and suffixes. The division method is defined by this device. It is recommended to divide them with a / 56 mask length. The first 56 bits are the IPv6 address prefix. Extract the prefix bits of the collected IPv6 addresses.

[0074] S3-2, aggregate the collected IPv6 addresses. If an IPv6 address prefix set exists where the IPv6 address prefix value is equal to `prefix`, then add the collected IPv6 addresses to this set. If it does not exist, create a new set using the collected IPv6 address prefix value `prefix`.

[0075] S3-3 performs statistical analysis on the elements within the set created in S3-2. Sets with more elements are more likely to be "internet troll" devices. This device sets a threshold for the elements in the sets to filter these sets. The threshold for the elements in the sets can be set to 64.

[0076] S3-4, further divide the address prefixes of suspected "internet troll" devices selected in step S3-3 into addresses. It is recommended to divide them into / 64 mask lengths, with the first 56 bits of the address prefix being the prefix. Therefore, the further divided 64-bit mask subset has a maximum of 256 subprefixes (subprefix_n, n∈[1,256]); extract all IPv6 address subprefixes in the set.

[0077] S3-5, group the subprefix addresses. IPv6 addresses with the IPv6 address prefix "subprefix_n" are grouped into a subset, identified as "subprefix_n". If no IPv6 address prefixes are identical, a new subset is created, identified as "subprefix_n".

[0078] The device counts the elements within each subset and sorts them by the number of elements in each subset. The subset with more elements is more likely to be a "cyber army" device. This device sets a threshold for subset elements to filter these subsets. The subset element threshold can be set to 16.

[0079] Step S4: The device addresses are collected, the illegal addresses are located, and the data is submitted for further processing.

[0080] For the "internet troll" devices identified in S3 using subprefix_n, their geographic coordinates can be determined using a geographic information database of IPv6 addresses. This information can also be submitted to operators, regulatory agencies, and law enforcement agencies for further action.

[0081] This technical solution achieves precise and efficient identification and tracking of online troll equipment. On one hand, it first transforms the illegal content into a multi-dimensional vector, then uses Euclidean or Mahalanobis distance clustering to further subdivide the illegal categories, avoiding interference from mixed types of illegal information and laying a precise foundation for address aggregation. On the other hand, leveraging the 128-bit characteristic of IPv6 addresses, it employs / 56 and / 64 masks to hierarchically split the address prefix, combined with progressive filtering using 64 and 16 level quantity thresholds. This not only captures the cluster characteristics of troll equipment characterized by "large-scale association and small-scale concentration," but also records the frequency of address violations through a violation counter, enhancing identification reliability. This effectively solves the problems of easy misjudgment in traditional single-dimensional identification, difficulty in distinguishing individual devices using IPv4 addresses, and inability to lock down batches of associated illegal devices. Simultaneously, the solution can utilize a geographic information database to locate illegal devices, providing operators, regulatory agencies, and law enforcement departments with precise traceability evidence, significantly improving the efficiency and accuracy of online troll identification, effectively curbing online illegal activities, and providing reliable technical support for maintaining a healthy network ecosystem.

[0082] Example 3 Figure 3 This is a schematic diagram of the structure of the identification device for illegally operated devices in a network environment provided in Embodiment 3 of this application. Figure 3 As shown, the device includes: Information acquisition module 31 is used to acquire the network address information of the device that published the illegal content; The violation category classification module 32 is used to perform vector transformation on the published violation content, and perform cluster analysis based on the obtained multi-dimensional vector to assign the published violation content to the corresponding violation category; The preliminary screening module 33 is used to filter the network address information of devices in each violation category based on the first mask length to obtain a preliminary screening set; The fine filtering module 34 is used to filter the initial set whose number of elements reaches the first quantity threshold based on the second mask length to obtain the filtered subset; The identification module 35 is used to determine that the device in the current filtering subset is a device operating illegally if the number of elements in the filtering subset reaches the second quantity threshold.

[0083] This device can execute the identification method for devices operating illegally in a network environment provided in the above embodiments, and has corresponding functional units and beneficial effects. Further details are omitted here.

[0084] Example 4 Those skilled in the art will understand that embodiments of the present invention can provide methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] Therefore, this application also proposes a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the methods described in any embodiment of this application.

[0086] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0087] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0089] Furthermore, Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of this application. Figure 4As shown, this application also proposes an electronic device (or computing device) including a processor 11, a memory 12, and a computer program stored on the memory 12 and executable on the processor 11, wherein the processor 11 executes the computer program to implement the method described in any embodiment of this application.

[0090] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory. Memory may include non-persistent storage in computer-readable media, random access memory (RAM), and / or non-volatile memory such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media. Computer-readable media includes both permanent and non-persistent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information that can be accessed by the computing device. As defined in this article, computer-readable media do not include transient media, such as modulated data signals and carrier waves.

[0091] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0092] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying devices operating improperly in a network environment, characterized in that, The method includes: Obtain the network address information of the device that published the illegal content, as well as the illegal content itself; The published illegal content is vectorized, and cluster analysis is performed based on the obtained multi-dimensional vectors to assign the published illegal content to the corresponding illegal category; The network address information of devices in each violation category is filtered based on the first mask length to obtain an initial screening set; For the initial set where the number of elements reaches the first threshold, a selection subset is obtained by filtering based on the second mask length. If the number of elements in the filtered subset reaches the second threshold, then the device in the current filtered subset is determined to be a device operating in violation of regulations.

2. The method according to claim 1, characterized in that, The published illegal content is vectorized, and cluster analysis is performed based on the obtained multi-dimensional vectors to assign it to the corresponding violation category, including: The illegal content published by each device is vectorized to obtain vector information; The vector information is categorized based on similarity using preset classification rules to obtain clustering results.

3. The method according to claim 2, characterized in that, The vector information is categorized based on similarity using preset classification rules to obtain clustering results, including: Based on the Euclidean or Mahalanobis distance between the vector information and each cluster center vector, the shortest Euclidean or Mahalanobis distance is determined as the highest similarity, thus obtaining the clustering result of the illegal content published by the current device. or, By training a large model, the model is used to classify and identify the published illegal content, thus obtaining the clustering results of the illegal content published on the current device.

4. The method according to claim 1, characterized in that, The network address information of devices in each violation category is filtered based on the first mask length to obtain an initial screening set, including: The 128-bit network address information is split into its first 56 bits to obtain the address prefix of each network address; The network address information with the same address prefix is ​​placed into a set to obtain the initial screening set.

5. The method according to claim 1, characterized in that, For the initial set where the number of elements reaches the first threshold, further filtering is performed based on the second mask length to obtain a filtered subset, including: For the initial set where the number of elements reaches the first threshold, the new address prefix of each network address information is obtained by splitting the first 64 bits. Network address information with the same new address prefix is ​​placed into a subset to obtain the filtered subset.

6. The method according to claim 5, characterized in that, The first quantity threshold is set to 64.

7. The method according to claim 1, characterized in that, The second quantity threshold is set to 16.

8. A device for identifying devices operating improperly in a network environment, characterized in that, The device includes: The information acquisition module is used to acquire the network address information of the device that published the illegal content and the illegal content itself. The violation category classification module is used to perform vector transformation on the published violation content, and to perform cluster analysis based on the obtained multi-dimensional vector to assign the published violation content to the corresponding violation category; The preliminary screening module is used to filter the network address information of devices in each violation category based on the first mask length to obtain a preliminary screening set; The fine-tuning module is used to filter the initial set whose number of elements reaches the first threshold based on the second mask length to obtain the filtered subset; The identification module is used to determine that the device in the current filter subset is a device that is operating illegally if the number of elements in the filter subset reaches a second threshold.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

10. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-7.

Images