A time series kinship chain fingerprint tracking method and system resistant to feature drift

Abstract

This invention relates to a time-series kinship chain fingerprinting method and system resistant to feature drift. The method includes: identifying field information in a data entity that can be used for fingerprint recognition as feature factors; preprocessing the corresponding original feature data to obtain multi-dimensional vector data; generating base blocks of a target length from the multi-dimensional vector data according to time slices, where time slices are collected periodically or triggered when features change, with timestamps in UTC millisecond format; setting the target length as needed based on the number of feature factors and hash algorithm type in the actual scenario; concatenating the base blocks into a one-way hash chain to obtain a time-series kinship chain; forming a time-series kinship database by indexing all time-series kinship chains using the root fingerprint of the kinship chain; collecting feature data corresponding to the feature factors in the current data entity; performing kinship fingerprint retrieval on the feature data using the time-series kinship database; and generating a root data fingerprint. This invention utilizes publicly collectable information to ensure fingerprint stability.

Description

Technical Field

[0001] This invention relates to the field of fingerprint tracking technology, and in particular to a temporal bloodline fingerprint tracking method and system that resists feature drift. Background Technology

[0002] A data fingerprint is a short string or bit vector, much shorter than the original data, that uniquely identifies a data instance after unidirectional compression and collision-resistant transformation of data content or its derived features. Data fingerprints have a wide range of applications. "Device fingerprints," generated from information extracted from hardware devices, can be used for device authentication, network security, and device behavior analysis. "Browser fingerprints," generated from information extracted from browsers, can be used for user tracking and personalized advertising. "Behavioral fingerprints," generated from user behavior data, can be used for abnormal behavior detection and account security verification. "Application fingerprints," generated from information extracted from software applications, can be used for software version management and piracy detection, among other applications.

[0003] Current fingerprinting schemes generally adopt a "collect feature data first, then calculate weights" approach. This involves collecting as many fingerprint features as possible, filtering and weighting them, then compressing them into hash values, or using clustering / classification models for similarity analysis to determine fingerprint merging and splitting. For example, existing technologies achieve accurate data behavior tracing by constructing multidimensional discrete data fingerprints and data lineage relationships. However, this method may still lead to fingerprint instability due to feature drift when facing dynamic changes in data features. Existing technologies generate data fingerprints using statistical value matrices and cosine distance normalization values, which can effectively identify stolen and fine-tuned data. However, in scenarios with frequent feature drift, the dynamic stability and recall rate of these fingerprints still need improvement. Existing technologies also propose a device fingerprint generation method based on cumulative weight values, which determines the target fingerprint by calculating the matching weights between the initial fingerprint and historical fingerprints. While this improves fingerprint stability, it may still lead to fingerprint changes due to unreasonable weight allocation when facing feature drift. Existing technologies determine device fingerprints through similarity calculations and supervised learning models. While these methods offer some adaptability within privacy policy constraints, their similarity calculation methods may not effectively address feature tampering by malicious actors in scenarios involving feature drift. Furthermore, existing technologies employ Simhash and Hamming code distance to calculate similarity. Although these methods can quickly generate device fingerprints, they lack a dynamic update mechanism to address fingerprint changes caused by feature drift. They also lack an effective self-healing mechanism.

[0004] In real-world scenarios, local changes in data lead to feature drift, a problem that alters fingerprints generated using traditional methods, thus affecting their stability and uniqueness. For example, in device authentication, traditional fingerprinting methods rely on hardware identifiers (such as MAC addresses, IMEI numbers, and device serial numbers) to generate fingerprints. However, with increasingly stringent privacy compliance requirements, these unique and stable identifiers are often masked or forcibly anonymized by operating systems. Many features also change during normal evolution processes such as system updates, network configuration adjustments, and changes in user behavior. This feature drift amplifies recall errors, causing a sharp decline in fingerprint stability.

[0005] Especially in business security fraud scenarios, malicious tools can tamper with key features, causing fingerprints to split instantly and significantly reducing their stability. Because the original fingerprint cannot be traced, businesses relying on fingerprints are severely impacted. For example, in financial risk control scenarios, traditional fingerprint technology frequently makes false judgments due to its inability to handle malicious tampering, leading to legitimate users being falsely flagged for risk control, seriously affecting user experience and business security.

[0006] Besides uniqueness, stability is also a crucial indicator for data fingerprints—the ability to maintain the fingerprint's integrity even after normal data evolution. However, current technologies, when faced with privacy regulations (such as the General Data Protection Regulation (GDPR) and the Personal Information Protection Act (PIPL), cannot collect highly sensitive hardware IDs (e.g., MAC addresses, IMEI numbers), making it difficult to maintain fingerprint stability. Therefore, there is an urgent need for a method to achieve fingerprint stability using publicly available information without touching highly sensitive IDs. Summary of the Invention

[0007] To address the problems existing in the prior art, the purpose of this invention is to provide a temporal lineage fingerprint tracking method and system that resists feature drift, thereby achieving fingerprint stability using publicly available information without touching highly sensitive IDs.

[0008] To achieve the above objectives, the present invention provides the following solution: A temporal lineage fingerprinting method resistant to feature drift includes: The field information in the identification data entity that can be used for fingerprint recognition is used as a feature factor, and the original feature data corresponding to the feature factor is preprocessed to obtain multidimensional vector data. The multidimensional vector data is divided into base blocks of target length according to time slices. The time slices are collected at regular intervals or triggered when features change. The timestamps are in UTC millisecond format. The target length is set as needed according to the number of feature factors and the type of hash algorithm in the actual scenario. The base blocks are concatenated into a one-way hash chain to obtain a time-series lineage chain. All time-series lineage chains are indexed by the root fingerprint of the lineage chain to form a time-series lineage library. Collect feature data corresponding to feature factors in the current data entity, and use the time-series kinship database to perform kinship fingerprint retrieval on the feature data to generate root data fingerprint.

[0009] Optionally, obtaining the multidimensional vector data includes: The original feature data is validated to remove invalid data that does not conform to the format rules and the format is standardized. The numerical data in the original feature data is further discretized, and the string data is processed to unify the case and filter special characters. The feature values ​​of all feature factors are obtained and stored to generate the multidimensional vector data.

[0010] Optionally, the temporal lineage chain includes: a characteristic validity index of the characteristic factor, a base block, and a lineage pointer; The base block includes: feature value, timestamp, fingerprint, and root fingerprint.

[0011] Optionally, calculating the feature efficiency index of the feature factor includes: For all eigenvalues ​​of the same feature factor, deduplication is performed, and a stability index and a uniqueness index are calculated. Then, the feature effectiveness index is calculated using the stability index and the uniqueness index. ; in, For stability weights, This is a uniqueness weight.

[0012] Optionally, calculating the stability index and the uniqueness index includes: ; ; in, As a stability index, For the total number of all eigenvalues, This represents the number of eigenvalues ​​after deduplication. As a uniqueness index, Let x be the probability of feature x appearing in the current chain A. Let x be the probability that feature x does not appear in other chains.

[0013] Optionally, generating the root data fingerprint includes: The feature data corresponding to the feature factors in the current data entity are collected, and a feature value array is formed according to the order of the feature factors in the time-series kinship database. The kinship fingerprint is retrieved by using the time-series kinship database, that is, by comparing the data block fingerprints in the time-series kinship database, the root data fingerprint is generated.

[0014] Optionally, comparing the data block fingerprints in the time-series lineage database includes: Determine if a data block fingerprint exists that is identical to the feature value array. If no identical data block fingerprint exists, calculate the similarity between the tail data blocks of all temporal lineage chains and the current data entity, and determine if the similarity is greater than a target threshold. The target threshold is determined experimentally based on the application scenario, i.e., device authentication, financial risk control, and advertising push, and is a similarity threshold of 0-1, preferably 0.7-0.9. If the similarity is greater than the target threshold, take the temporal lineage chain with the highest similarity as the kinship chain, and append the current data entity as a new data block to the end of the kinship chain. Recalculate the feature effectiveness index of the feature factors, generate the appended kinship chain, and return it to the temporal lineage database. If the similarity is less than the target threshold, then the current data entity is... The entity is used as a new temporal lineage chain, returned to the temporal lineage database, and the corresponding feature validity index is added. If the same data block fingerprint exists, it is determined whether the fingerprint equality region is at the end of the chain. If the fingerprint equality region is at the end of the chain, the current temporal lineage chain is used as a kinship chain, and the current data entity is added as a new data block to the end of the kinship chain. The feature validity index of the feature factor is recalculated, and the appended kinship chain is generated and returned to the temporal lineage database. If the fingerprint equality region is not at the end of the chain, the current temporal lineage chain is used as a kinship chain, and the chain is disassembled and reassembled at the fingerprint equality region position. Kinship chains are re-found from all blocks after the chain is broken at this position. The rules for re-finding kinship chains are consistent with the original retrieval rules. After the chain is built, it is returned to the temporal lineage database.

[0015] Optionally, calculating the similarity between the tail data blocks of all temporal lineages and the current data entity includes: The eigenvalue hashes of the tail data blocks of all time-series lineage chains and the feature factors in the current data entity are converted into feature vectors. The feature vectors are weighted and calculated. The weighted results are accumulated and dimensionality reduced to obtain the final 64-bit SimHash value. The Hamming distance is calculated using the final SimHash value between the tail data blocks of all temporal lineage chains and the current data entity. Based on the Hamming distance, the similarity between the tail data blocks of all temporal lineage chains and the current data entity is obtained.

[0016] To achieve the above objectives, the present invention also provides a temporal bloodline fingerprinting system resistant to feature drift, comprising: The temporal lineage chain generation module is used to take the field information in the identification data entity that can be used for fingerprint recognition as feature factors, and preprocess the original feature data corresponding to the feature factors to obtain multi-dimensional vector data. The multidimensional vector data is divided into base blocks of target length according to time slices. The time slices are collected at regular intervals or triggered when features change. The timestamps are in UTC millisecond format. The target length is set as needed according to the number of feature factors and the type of hash algorithm in the actual scenario. The base blocks are concatenated into a one-way hash chain to obtain a time-series lineage chain. All time-series lineage chains are indexed by the root fingerprint of the lineage chain to form a time-series lineage library. The time-series kinship database management module is used to collect feature data corresponding to feature factors in the current data entity, and to perform kinship fingerprint retrieval on the feature data using the time-series kinship database to generate root data fingerprints.

[0017] The beneficial effects of this invention are as follows: This invention upgrades the traditional "one-time snapshot" fingerprint to an appendable and traceable "time-series lineage chain" structure, transforming the data fingerprint stability problem caused by feature drift into a "chain-like drift self-healing" problem. Specifically, it collects publicly available hardware information, software information, network and behavioral features, etc., and generates fixed-length "base blocks" in time slices. These blocks are then chained together into a one-way hash chain, with mutation features, timestamps, and the hash from the previous moment written to the chain in an append-only manner. Hash pointers ensure the chain relationship is irreversible, and the current fingerprint is recalculated based on the chain head. This ensures that every "mutation" (system upgrade, network switch, user behavior evolution) leaves an irreversible pointer along the timeline. Even in extreme scenarios where highly sensitive IDs are completely invisible and features are continuously tampered with by malicious actors, the fingerprint can still be verified using 64-bit SimHash, and the original fingerprint can be quickly retrieved using "Hamming distance" to calculate similarity.

[0018] When feature drift occurs, the new fingerprint is linked to historical fingerprints via lineage pointers, forming a complete lineage chain. Through this chain, the system can quickly locate the latest fingerprint and reconstruct its complete historical evolution path. Simultaneously, the new fingerprint also becomes a new block, dynamically updating the lineage chain through chain completion or discontinuation. This "chain-like drift self-healing" mechanism allows data fingerprints to "self-heal" after feature drift. By continuously updating the hash chain and dynamically adjusting the lineage pointers, it ensures that data fingerprints still possess strong tracking capabilities after feature drift. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of a temporal lineage fingerprinting method with resistance to feature drift, according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the temporal lineage chain according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a time-series lineage bank according to an embodiment of the present invention; Figure 4 This is a flowchart illustrating the time-series kinship database fingerprint retrieval process according to an embodiment of the present invention. Figure 5 This is a flowchart illustrating the SimHash value calculation process according to an embodiment of the present invention. Figure 6 This is a schematic diagram of a temporal bloodline fingerprint tracking system that resists feature drift, according to an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] like Figure 1As shown, this embodiment discloses a time-series kinship chain fingerprinting method resistant to feature drift, including: using field information in the identified data entity that can be used for fingerprint recognition as feature factors, and preprocessing the original feature data corresponding to the feature factors to obtain multi-dimensional vector data; generating base blocks of target length according to time slices of the multi-dimensional vector data, where time slices are collected periodically or triggered when features change, timestamps are in UTC millisecond format, and the target length is set as needed according to the number of feature factors and hash algorithm type in the actual scenario; the base blocks are concatenated into a one-way hash chain to obtain a time-series kinship chain; forming a time-series kinship database by indexing all time-series kinship chains with the root fingerprint of the kinship chain; collecting feature data corresponding to the feature factors in the current data entity, and using the time-series kinship database to perform kinship fingerprint retrieval on the feature data to generate a root data fingerprint.

[0024] Furthermore, obtaining multidimensional vector data includes: validating the original feature data, removing invalid data that does not conform to the format rules, and unifying the format; further discretizing the numerical data in the original feature data; unifying the case and filtering special characters for string data; obtaining the feature values ​​of all feature factors; storing the feature values ​​of all feature factors; and generating multidimensional vector data.

[0025] The temporal lineage chain includes: the feature validity index of the feature factor, the base block, and the lineage pointer; wherein, the base block includes: feature value, timestamp, fingerprint, and root fingerprint.

[0026] Calculating the eigenvalue efficiency index of a eigenfactor involves: removing duplicate eigenvalues ​​from all eigenvalues ​​of the same eigenfactor, calculating the stability index and the uniqueness index, and then using the stability index and the uniqueness index to calculate the eigenvalue efficiency index. Specifically, the following steps are taken: s1. Constructing a time-series lineage database may include the following steps: s11. Select effective feature factors from the data that can be used for fingerprint recognition: The goal of this step is to select a set of field information that can effectively identify data entities as feature factors, based on the characteristics of the data entities and the application scenarios.

[0027] Device fingerprinting is typically generated based on the device's hardware and software information. Extractable factors include: hardware information (MAC address, CPU model, hard drive serial number, graphics card model, motherboard information, etc.), software information (operating system version, list of installed software, system language, time zone settings, etc.), network information (IP address, DNS server, network interface information, etc.), and other information (battery status, list of Bluetooth devices, list of installed fonts, etc.).

[0028] Browser fingerprinting is generated based on the user's browser configuration and behavior. Extractable factors include: browser information (browser type, browser version, browser language, browser plugins, etc.), system information (operating system, system font, screen resolution, user agent string, etc.), network information (IP address, communication protocol, etc.), and behavioral information (mouse movement pattern, keyboard input habits, click pattern, etc.).

[0029] Behavioral fingerprinting is generated based on user behavior data. Extractable factors include: interaction behavior (click rate, page dwell time, scrolling behavior, input speed, etc.), biometric information (typing rhythm, facial recognition data, etc.), device usage patterns (device usage time, application usage frequency, battery usage patterns, etc.), and geolocation information (GPS data, network base station information, etc.).

[0030] Application fingerprints are generated based on information from software applications. Extractable factors include: application information (application name, application version, application digital signature, etc.), installation information (installation time, update history, application dependencies, etc.), usage information (application usage frequency, usage duration, usage of specific functions, etc.), and configuration information (application configuration settings, user-defined settings, etc.).

[0031] In addition to the example scenarios, this approach is applicable to many other scenarios, and appropriate feature factors can be selected based on specific business needs. The selected feature factors are used to extract the corresponding feature values ​​in step s12.

[0032] s12. Data Acquisition and Preprocessing: The purpose of data acquisition is to collect data in real time or to preprocess data based on existing training datasets, in order to solve problems such as format disorder, noise interference, and lack of integrity in the original data, and to output standardized data for use by subsequent modules.

[0033] The main processing steps include validating the data for each feature factor and removing invalid data that does not conform to the format rules. Data format is standardized by encoding the data uniformly to UTF-8 to avoid Chinese character encoding conflicts. Numerical data is discretized, with various methods such as equal-width discretization, equal-frequency discretization, and cluster-based discretization chosen depending on the specific situation. String data undergoes case unification (converting to uppercase) and special character filtering (removing newline characters and tabs).

[0034] After the above processing, the unit finally outputs standardized data, containing the feature values ​​of all feature factors, which are stored in multidimensional vector data and transmitted to step s13 to construct the temporal lineage chain.

[0035] s13. Construct a temporal lineage chain for the entity data corresponding to each known fingerprint according to the time series: like Figure 2 As shown, a time-series lineage chain is a time-series hash chain structure. It generates fixed-length base blocks based on time slices of the multidimensional features of data entities, and then concatenates these base blocks into a unidirectional hash chain. Its core function is to record the evolution of data, allowing the historical state of data to be traced back to any point in time through the chain structure. It is suitable for scenarios requiring long-term tracking of the evolution of data entity features, such as device authentication and data breach tracing. Step 1: Anchoring the starting node of the time-series lineage chain: Select the standardized feature value of the first data entity (multi-dimensional feature value after s12 data preprocessing, which corresponds one-to-one with the selected effective feature factors) to generate the first base block B1. This block contains the first feature value + the first collected UTC millisecond-level timestamp + fingerprint F1 (F1 is calculated by concatenating all the feature values ​​of B1 and then using a one-way hash algorithm such as SHA-256).

[0036] The fingerprint F1 of the first base block B1 is defined as the root fingerprint, which serves as the unique starting anchor point of the temporal lineage chain. The root fingerprint also becomes the index identifier of the entire subsequent lineage chain in the temporal lineage database.

[0037] Calculate an initial feature validity index for all valid feature factors in the lineage chain (calculated using the weighted formula of stability index + uniqueness index of s14), and bind this index to the first base block B1 as the initial benchmark for the validity of factors in the chain.

[0038] Step 2: Generate subsequent base blocks based on time sequence to construct the basic unit of a one-way hash chain: As time progresses, continuous feature collection and preprocessing are performed on the data entity. The 2nd, 3rd…nth base blocks (B2, B3…Bn) are generated according to time slicing rules (e.g., timed collection, collection triggered when features change). Each subsequent base block strictly follows a unified structure: the feature value at the current time point + the current UTC millisecond timestamp + the current fingerprint Fn (Fn is calculated by concatenating all current feature values ​​and then using a one-way hash algorithm). All base blocks are generated in chronological order, forming discrete, timestamped hash chain basic units. No modification to any content of historical base blocks is allowed, satisfying the "append-only" characteristic.

[0039] Step 3: Establish a one-way association between blocks through lineage pointers, linking them into a basic hash chain: The lineage pointer, as the fingerprint record of the previous chain, is the core association field for realizing block linking. Its assignment and association rules are as follows: For the second base block B2, assign its lineage pointer to the fingerprint F1 of the previous block B1, so that B2 points to B1 through the pointer; For the third base block B3, assign its lineage pointer to the fingerprint F2 of the previous block B2, so that B3 points to B2 through the pointer; Similarly, the lineage pointer of the nth base block Bn is assigned the fingerprint Fn-1 of the (n-1)th block Bn-1.

[0040] This rule ensures that all base blocks form a one-way, irreversible hash chain in chronological order.

[0041] The chronological kinship chain is composed of the following components: 1. Feature Effectiveness Index for Each Factor: A feature effectiveness index is configured for each selected effective feature factor to identify the degree of effectiveness of the factor in the uniqueness and stability of the fingerprint. The higher the effectiveness, the more effective the factor is as a fingerprint feature.

[0042] 2. Base Block: The base block is the basic data unit of a temporal lineage chain, used to store the characteristic information of a data entity at a specific point in time. Each base block contains the following three core parts: Eigenvalue: The specific value of the multidimensional feature of a data entity at a given point in time, corresponding one-to-one with the feature factor.

[0043] Timestamp: Records the exact time when this base block was generated. The timestamp uses UTC time format and is accurate to the millisecond level.

[0044] Fingerprint: The hash value of this base block data, which is calculated by concatenating all feature values ​​and performing a one-way hash (such as SHA-256, the specific function is not required).

[0045] Root fingerprint: The fingerprint of the first recorded base block is the root fingerprint, which is the starting point of the temporal lineage and represents the initial fingerprint state of the data entity.

[0046] 3. Lineage pointer: The preceding chain fingerprint record, used to point to the block preceding each base block.

[0047] s14. Calculate and update the effective index of each factor in all temporal kinship chains: The goal of this step is to calculate a feature effectiveness index for each feature factor based on the specific characteristics of the fingerprint required by the business scenario. The feature effectiveness index is a value between 0 and 1, used to represent the effectiveness of the feature factor. A higher value indicates greater feature effectiveness.

[0048] Assume a set of eigenvalues Let be a multiset consisting of all eigenvalues ​​of the same factor in a temporal lineage, where elements may be repeated: ; for The set of duplicates, i.e., the set of duplicates obtained from The set consisting of all distinct elements in the set: ; Calculate the stability index: ; in, For the total number of all eigenvalues, This represents the number of eigenvalues ​​after deduplication. Calculate the uniqueness index: ; Among them, when At time: The current chain is empty and has no characteristics, therefore the uniqueness index is low. .

[0049] when Time: For each feature after deduplication Calculate the product of the two terms and sum them: The probability of feature x appearing in the current chain A, i.e. : .

[0050] The probability that feature x does not appear in other chains, i.e. : .

[0051] Calculate the eigenfactor efficiency index: ; in, For stability weights, For uniqueness weights, the following requirements must be met: .

[0052] Weight allocation is adjusted as needed based on actual business requirements. Generally, a balance between stability and uniqueness needs to be considered, and the weights can be distributed evenly. In special cases, depending on the business scenario, a preference may be placed on one characteristic between uniqueness and stability, and the weight ratio can be adjusted accordingly. For example, in a security risk control scenario, to avoid false positives, uniqueness is prioritized, and the weight ratio could be set to 0.3:0.7 for uniqueness and 0.7 for stability. If used for user advertising, to ensure accurate targeting and tracking of user behavior, uniqueness is prioritized, and the weight ratio could be set to 0.7:0.3 for uniqueness and 0.3 for stability.

[0053] s15. Enter all temporal lineage chains into the temporal lineage database: All temporal lineage chains are superimposed using the root fingerprint as an index to form a three-dimensional vector. The root fingerprint serves as the first-level index, feature factors as the second-level index, and the time dimension as the third-level index, thus completing the construction of the temporal lineage database. Figure 3 As shown.

[0054] Furthermore, generating the root data fingerprint includes: collecting the feature data corresponding to the feature factors in the current data entity, forming a feature value array according to the order of the feature factors in the time-series kinship database, and using the time-series kinship database to perform kinship fingerprint retrieval on the feature value array, that is, comparing the data block fingerprints in the time-series kinship database to generate the root data fingerprint.

[0055] The comparison of data block fingerprints in the temporal lineage database includes: determining whether a data block fingerprint exists that is identical to the feature value array; if no identical data block fingerprint exists, calculating the similarity between the tail data block of all temporal lineage chains and the current data entity, and determining whether the similarity is greater than a target threshold. The target threshold is determined experimentally based on the application scenario (device authentication / financial risk control / advertising push), and is a similarity threshold ranging from 0 to 1, preferably 0.7-0.9. If the similarity is greater than the target threshold, the temporal lineage chain with the highest similarity is taken as the kinship chain, and the current data entity is appended as a new data block to the end of this kinship chain. The feature effectiveness index of the feature factors is recalculated, and the appended kinship chain is generated and returned to the temporal lineage database. If the similarity is less than the target threshold, the current data entity is taken as a new temporal lineage chain, returned to the temporal lineage database, and the corresponding feature effectiveness index is added. If identical data block fingerprints exist, determining whether the fingerprint equality region is at the tail of the chain. If the fingerprint equality region is at the tail of the chain... The current time-series lineage chain is then used as the kinship lineage chain, and the current data entity is appended as a new data block to the end of the kinship lineage chain. The feature effectiveness index of the feature factors is recalculated, and the appended kinship lineage chain is generated and returned to the time-series lineage database. If the fingerprint equality region is not at the end of the chain, the current time-series lineage chain is used as the kinship lineage chain, and the chain is disassembled and reassembled at the fingerprint equality region. Kinship chains are re-found from all blocks after the chain is broken at that position. The rules for re-finding kinship chains are consistent with the original search rules. After the chain is built, it is returned to the time-series lineage database.

[0056] Calculating the similarity between the tail data blocks of all temporal lineage chains and the current data entity includes: hashing the feature values ​​of feature factors in the tail data blocks of all temporal lineage chains and the current data entity into feature vectors; weighting the feature vectors; accumulating and reducing the dimensionality of the weighted results to obtain the final 64-bit SimHash value; calculating the Hamming distance using the final SimHash value between the tail data blocks of all temporal lineage chains and the current data entity; and obtaining the similarity between the tail data blocks of all temporal lineage chains and the current data entity based on the Hamming distance. Specifically, the following steps are taken: s2. Data fingerprinting: The core objective is to find the data fingerprint of the target data entity in the time-series lineage database.

[0057] In practice, the following steps may be included: s21. Obtain the data entity of the target to be tracked and extract the feature values ​​corresponding to the effective feature factors; This step collects corresponding feature data from the data entity based on the feature factors selected during fingerprint feature factor analysis. A feature value array is constructed according to the order of feature factors in the temporal kinship chain, and used as the data input for step s22, such as... Figure 4-5 As shown.

[0058] s22. Retrieve kinship fingerprints in the time-series kinship database and dynamically update the time-series kinship database based on the retrieval results: The core objective of this step is to retrieve the kinship chain to find the kinship fingerprint and dynamically update the time-series kinship database to achieve "chain-like drift self-healing." By continuously updating the hash chain and dynamically adjusting the kinship pointers, it ensures that the data fingerprint still has strong tracking capabilities after feature drift. Step 1: Compare all lineage chains in the database to find if there are data blocks (base blocks) with the same fingerprint.

[0059] Step 2: If no data block with the same fingerprint exists, it is necessary to determine whether the feature vector of the current data entity is related to the fingerprint in the time-series lineage database (i.e., it has a high similarity to a certain lineage chain). Generate 64-bit weighted SimHash verification fingerprints for the tail data blocks of the target data entity and all lineage chains respectively, and then use "Hamming distance" to quickly calculate the similarity. First, calculate SimHash.

[0060] Hash calculation: Perform a 64-bit hash transformation on the feature values ​​of the effective feature factors of the target data. Each result is a 64-bit result consisting of 0s and 1s.

[0061] Hash transformation: Transform the hash of all feature values ​​into a vector, and convert the bit value of 0 into -1.

[0062] Weighted: Calculates a weighted average for all feature vectors. The default weight is 100 times the effective exponent of the feature factor, but this can be adjusted as needed.

[0063] Accumulation and merging: The weighted results of all feature vectors are summed and merged into a single vector.

[0064] Dimensionality reduction: The merged vector is converted into a 64-bit bit vector. Each bit is set to 1 if it is greater than 0, and 0 otherwise, resulting in the final 64-bit SimHash value.

[0065] Finally, the Hamming distance is calculated: the Hamming distance is calculated using the SimHash of the target data entity and the data block at the tail of the lineage chain.

[0066] If a bloodline similarity exceeds a set threshold, it means that the current data entity is sufficiently similar to a bloodline in the database and can be considered a kinship. At the same time, the current data entity is added to the end of the bloodline with the highest similarity as a continuation of the kinship chain, and the factor effectiveness index is updated. The factor effectiveness index is calculated in the same way as s14.

[0067] If no kinship chain with similarity greater than the threshold exists, the process will add the current data block as a new temporal kinship chain to the temporal kinship database, calculate and add the factor effectiveness index, and calculate the factor effectiveness index in the same way as s14.

[0068] If it is a newly created bloodline, return the newly created bloodline; if it is an added bloodline, return the added bloodline.

[0069] Step 3: If data blocks with the same fingerprint exist, it proves that the data blocks are the same, meaning that all the feature values ​​of the data are identical. At this point, it is necessary to determine whether the blocks with the same fingerprint are at the end of the chain as the basis for deciding whether to break the chain.

[0070] If at the end of the chain, the system will append the current data block as a continuation of the kinship chain to the end of the direct kinship chain and update the factor effectiveness index.

[0071] If it is not at the end of the chain, then the chain needs to be broken and rebuilt here. The current data is appended to the broken chain point as the end of the chain. At the same time, all blocks after the current broken chain point are reconnected and reconnected. The process is the same as step 2.

[0072] Regardless of whether it is at the end of the chain, the current bloodline chain is used as the kinship bloodline chain for return.

[0073] s23. Return the root data fingerprint corresponding to the target data entity: This step uses the root data fingerprint of the time-series lineage chain updated in step s22 as the final unified data fingerprint provided.

[0074] like Figure 6As shown, this embodiment also provides a time-series kinship chain fingerprinting system resistant to feature drift, including: a time-series kinship chain generation module, used to take the field information in the identified data entity that can be used for fingerprint recognition as feature factors, and preprocess the original feature data corresponding to the feature factors to obtain multi-dimensional vector data; the multi-dimensional vector data is divided into base blocks of target length according to time slices, the time slices are collected at regular intervals or triggered when features change, the timestamp adopts UTC millisecond format, the target length is set as needed according to the number of feature factors, hash algorithm type, etc. in the actual scenario, the base blocks are concatenated into a one-way hash chain in the form of blocks to obtain the time-series kinship chain, and all time-series kinship chains are indexed by the root fingerprint of the kinship chain to form a time-series kinship library; a time-series kinship library management module, used to collect the feature data corresponding to the feature factors in the current data entity, and use the time-series kinship library to perform kinship fingerprint retrieval on the feature data to generate root data fingerprint.

[0075] Specifically, this embodiment also provides a temporal lineage fingerprinting system resistant to feature drift, including: Edge acquisition layer: Responsible for collecting raw data from various sources to provide data support for upper-layer applications. The range of options may include, but is not limited to, the following: Terminal device data collection: Collecting data from various terminal devices, such as smartphones, tablets, and IoT devices.

[0076] Application software data collection: Collecting data from applications running on the device, which may include application usage, performance data, etc.

[0077] User behavior collection: monitoring and recording user behavior data, such as operating habits and interaction patterns.

[0078] Network communication data collection: Collecting network communication data, which may include network traffic, connection status, data packet information, etc.

[0079] Application Layer: Utilizing data collected from the edge acquisition layer, it initiates fingerprint tracking requests to the fingerprint tracking service and obtains the root fingerprint and temporal lineage data from the response to support specific business logic and functions within the application layer. This includes, but is not limited to: Device authentication: Root fingerprint is used to assist in verifying the identity of the device, ensuring that only authorized devices can access the system.

[0080] User behavior analysis: Root fingerprinting is used to analyze user behavior patterns for personalized services, user experience optimization, etc.

[0081] Financial risk control: Utilizing root fingerprint recognition and fraud prevention in financial transactions to reduce financial risk.

[0082] Software version management: Manage software versions and use root fingerprints to ensure that users are using the latest or correct version.

[0083] Anomaly detection: The monitoring system uses root fingerprints to track abnormal behavior and respond promptly to potential security threats.

[0084] Personalized ad delivery: Utilize root fingerprints to locate user behavior and preferences to deliver personalized ad content.

[0085] Data breach attribution: When a data breach occurs, root fingerprints are used to trace the source and path of the data breach.

[0086] Fingerprint tracking service layer: This is the core of the system and the main application of this invention. It is responsible for processing fingerprint tracking requests and generating and managing temporal lineage chains. It includes: Data receiving module: Receives fingerprint tracking requests from the application layer, which contain data characteristics.

[0087] The tracing response module generates a response based on the request, including the temporal lineage chain and the root fingerprint.

[0088] Temporal lineage generation module: Generates temporal lineages using the results of the feature effective factor calculation module.

[0089] Feature Effective Factor Calculation Module: Calculates the effectiveness of feature factors to provide a basis for generating time-series lineage chains.

[0090] The time-series lineage database management module manages the storage and retrieval of time-series lineages, ensuring data consistency and accessibility.

[0091] Storage layer: Provides persistent storage for data and supports read and write operations of the time-series lineage management module.

[0092] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A temporal lineage fingerprinting method resistant to feature drift, characterized in that, include: The field information in the identification data entity that can be used for fingerprint recognition is used as a feature factor, and the original feature data corresponding to the feature factor is preprocessed to obtain multidimensional vector data. The multidimensional vector data is divided into base blocks of target length according to time slices. The time slices are collected at regular intervals or triggered when features change. The timestamps are in UTC millisecond format. The target length is set as needed according to the number of feature factors and the type of hash algorithm in the actual scenario. The base blocks are concatenated into a one-way hash chain to obtain a time-series lineage chain. All time-series lineage chains are indexed by the root fingerprint of the lineage chain to form a time-series lineage library. Collect feature data corresponding to feature factors in the current data entity, and use the time-series kinship database to perform kinship fingerprint retrieval on the feature data to generate root data fingerprint.

2. The temporal lineage fingerprinting method with resistance to feature drift according to claim 1, characterized in that, Obtaining the multidimensional vector data includes: The original feature data is validated to remove invalid data that does not conform to the format rules and the format is standardized. The numerical data in the original feature data is further discretized, and the string data is processed to unify the case and filter special characters. The feature values ​​of all feature factors are obtained and stored to generate the multidimensional vector data.

3. The temporal lineage fingerprinting method with resistance to feature drift according to claim 1, characterized in that, The temporal lineage chain includes: a characteristic effective index of the characteristic factor, a base block, and a lineage pointer; The base block includes: feature value, timestamp, fingerprint, and root fingerprint.

4. The temporal lineage fingerprinting method with resistance to feature drift according to claim 3, characterized in that, Calculating the feature efficiency index of the feature factor includes: For all eigenvalues ​​of the same feature factor, deduplication is performed, and a stability index and a uniqueness index are calculated. Then, the feature effectiveness index is calculated using the stability index and the uniqueness index. ； in, For stability weights, This is a uniqueness weight.

5. The temporal lineage fingerprinting method with resistance to feature drift according to claim 4, characterized in that, Calculating the stability index and the uniqueness index includes: ； ； in, As a stability index, For the total number of all eigenvalues, This represents the number of eigenvalues ​​after deduplication. As a uniqueness index, Let x be the probability of feature x appearing in the current chain A. Let x be the probability that feature x does not appear in other chains.

6. The temporal lineage fingerprinting method with resistance to feature drift according to claim 1, characterized in that, Generating the root data fingerprint includes: The feature data corresponding to the feature factors in the current data entity are collected, and a feature value array is formed according to the order of the feature factors in the time-series kinship database. The kinship fingerprint is retrieved by using the time-series kinship database, that is, by comparing the data block fingerprints in the time-series kinship database, the root data fingerprint is generated.

7. The temporal lineage fingerprinting method with resistance to feature drift according to claim 6, characterized in that, The comparison of data block fingerprints in the time-series lineage database includes: Determine if a data block fingerprint exists that is identical to the feature value array. If no identical data block fingerprint exists, calculate the similarity between the tail data blocks of all temporal lineage chains and the current data entity, and determine if the similarity is greater than a target threshold. The target threshold is determined experimentally based on the application scenario, i.e., device authentication, financial risk control, and advertising push, and is a similarity threshold of 0-1, preferably 0.7-0.

9. If the similarity is greater than the target threshold, take the temporal lineage chain with the highest similarity as the kinship chain, and append the current data entity as a new data block to the end of the kinship chain. Recalculate the feature effectiveness index of the feature factors, generate the appended kinship chain, and return it to the temporal lineage database. If the similarity is less than the target threshold, then the current data entity is... The entity is used as a new temporal lineage chain, returned to the temporal lineage database, and the corresponding feature validity index is added. If the same data block fingerprint exists, it is determined whether the fingerprint equality region is at the end of the chain. If the fingerprint equality region is at the end of the chain, the current temporal lineage chain is used as a kinship chain, and the current data entity is added as a new data block to the end of the kinship chain. The feature validity index of the feature factor is recalculated, and the appended kinship chain is generated and returned to the temporal lineage database. If the fingerprint equality region is not at the end of the chain, the current temporal lineage chain is used as a kinship chain, and the chain is disassembled and reassembled at the fingerprint equality region position. Kinship chains are re-found from all blocks after the chain is broken at this position. The rules for re-finding kinship chains are consistent with the original retrieval rules. After the chain is built, it is returned to the temporal lineage database.

8. The temporal lineage fingerprinting method with resistance to feature drift according to claim 7, characterized in that, Calculating the similarity between the tail data blocks of all temporal lineages and the current data entity includes: The eigenvalue hashes of the tail data blocks of all time-series lineage chains and the feature factors in the current data entity are converted into feature vectors. The feature vectors are weighted and calculated. The weighted results are accumulated and dimensionality reduced to obtain the final 64-bit SimHash value. The Hamming distance is calculated using the final SimHash value between the tail data blocks of all temporal lineage chains and the current data entity. Based on the Hamming distance, the similarity between the tail data blocks of all temporal lineage chains and the current data entity is obtained.

9. A temporal lineage fingerprinting system resistant to feature drift, implemented according to any one of claims 1-8, characterized in that, include: The temporal lineage generation module is used to take the field information in the identification data entity that can be used for fingerprint recognition as feature factors, and preprocess the original feature data corresponding to the feature factors to obtain multi-dimensional vector data. The multidimensional vector data is divided into base blocks of target length according to time slices. The time slices are collected at regular intervals or triggered when features change. The timestamps are in UTC millisecond format. The target length is set as needed according to the number of feature factors and the type of hash algorithm in the actual scenario. The base blocks are concatenated into a one-way hash chain to obtain a time-series lineage chain. All time-series lineage chains are indexed by the root fingerprint of the lineage chain to form a time-series lineage library. The time-series kinship database management module is used to collect feature data corresponding to feature factors in the current data entity, and to perform kinship fingerprint retrieval on the feature data using the time-series kinship database to generate root data fingerprints.

Images