Service device management method, apparatus, device, storage medium, and program product

Abstract

Embodiments of the present application disclose a service device management method and device, equipment, storage medium and program product. In the method, for network devices logging in a same service account, current running environment information of each network device is obtained, and the network devices corresponding to the service account are clustered based on the obtained running environment information to obtain a number of device clusters corresponding to the service account. When the number of device clusters is two or more, network relationship chain analysis is performed based on network configuration records of each network device to determine whether the corresponding network devices cross-use different service accounts, and the network devices cross-using different service accounts are taken as blacklisted devices to prohibit the blacklisted devices from accessing corresponding services through the service account. In this way, network devices that fraudulently use service accounts can be accurately detected with low resource consumption, and the rights and security of related business services can be effectively maintained.

Description

Technical Field

[0001] This application relates to the fields of computer technology and network communication technology, and in particular to a service equipment management method, apparatus, device, storage medium and program product. Background Technology

[0002] To reduce the management complexity of service devices (hereinafter referred to as service devices) for business services, service providers can allocate service accounts according to device clusters, so that each device in the cluster can access the business service through the service account. However, precisely because such service accounts are shared by multiple devices, they are more easily impersonated by other devices outside the designated device cluster, resulting in damage to the rights and interests of the business service and security risks. Current technical solutions require the business service to pre-store the device information of each authorized network device when detecting such network devices impersonating service accounts. This not only limits the reference information during device detection but also consumes a significant amount of storage and computing resources. Summary of the Invention

[0003] This application provides a service device management method, apparatus, device, storage medium, and program product that can accurately detect network devices that impersonate service accounts with low resource consumption, thereby protecting the rights and security of related business services.

[0004] On one hand, embodiments of this application provide a service device management method, including:

[0005] For network devices logged into the same service account, obtain the current operating environment information of each network device;

[0006] Based on the obtained operating environment information, the network devices corresponding to the service account are clustered to obtain the number of device clusters corresponding to the service account.

[0007] If the number of devices in the cluster is two or more, network relationship chain analysis is performed based on the network configuration records of each network device to obtain the relationship chain analysis results. The relationship chain analysis results are used to indicate whether each network device uses different service accounts.

[0008] Based on the relationship chain analysis results, network devices that use different service accounts interchangeably are designated as blacklisted devices, and these blacklisted devices are prohibited from accessing the corresponding services through the service accounts.

[0009] Furthermore, embodiments of this application provide a service device management apparatus, including:

[0010] The acquisition unit is used to acquire the current operating environment information of each network device that is logged into the same service account.

[0011] The clustering unit is used to perform clustering processing on the network devices corresponding to the service account based on the obtained operating environment information, so as to obtain the number of device clusters corresponding to the service account.

[0012] The data analysis unit is used to perform network relationship chain analysis based on the network configuration records of each network device if the number of device clusters is two or more, so as to obtain the relationship chain analysis results. The relationship chain analysis results are used to indicate whether each network device uses different service accounts.

[0013] The device management unit is used to, based on the relationship chain analysis results, designate network devices that use different service accounts as blacklisted devices and prohibit the blacklisted devices from accessing the corresponding services through the service accounts.

[0014] In one implementation, the data analysis unit can also be used to perform:

[0015] Obtain the current attribution information of each network device under at least one attribution dimension, wherein the attribution dimension includes at least one of a geographic location dimension and a service object dimension;

[0016] Query the registration information of the service account under at least one attribution dimension;

[0017] Based on the attribution and registration information of each network device, service attribution detection is performed on each network device to obtain attribution detection results. The attribution detection results are used to indicate whether the network device being detected belongs to the authorized service device of the service account.

[0018] Based on the attribution detection results, the network relationship chain analysis is performed on network devices that do not belong to the authorized service devices.

[0019] In another implementation, the network configuration records are collected from a first historical time period, and the data analysis unit can also be used to perform:

[0020] Based on the attribution information of each network device and the registration information of the service account, service attribution detection is performed on each network device to obtain attribution detection results. The attribution detection results are used to indicate whether the detected network device belongs to the service device of the service account.

[0021] Based on the attribution detection results and the relationship chain analysis results, retesting devices are selected from the network devices. The retesting devices include network devices that are not authorized service devices and do not use different service accounts, as well as network devices that are authorized service devices and use different service accounts.

[0022] Obtain the network configuration records and network performance information of the retesting device during a second historical time period, wherein the duration of the second historical time period is longer than the duration of the first historical time period;

[0023] Based on the obtained network configuration records and network performance information, network behavior analysis is performed on the retesting device to obtain behavior analysis results. The behavior analysis results are used to indicate whether the retesting device has engaged in forging network information.

[0024] The device used to retest forged network information will be included in the blacklist.

[0025] In yet another implementation, the data analysis unit can also be used to perform:

[0026] Poll the network devices in each device cluster and perform service affiliation detection on the currently polled network device to obtain the affiliation detection result. The affiliation detection result is used to indicate whether the detected network device belongs to the authorized service device of the service account.

[0027] Record the number of network devices that do not belong to the authorized service devices corresponding to each device cluster;

[0028] If the number of devices corresponding to a target device cluster reaches a preset number, then the network relationship chain analysis is performed on each network device in the target device cluster.

[0029] In another implementation, the network configuration record is the network configuration record within a first historical time period. When the data analysis unit performs the network relationship chain analysis on the network devices to obtain the relationship chain analysis results, it can specifically perform the following:

[0030] Based on the network configuration records of the network device in the first historical time period, the network configuration change rate of the network device is determined;

[0031] If the network configuration change rate is greater than or equal to a preset threshold, then the service account sequence of the network device in the third historical time period is obtained. The third historical time period is composed of the adjacent time period of the first historical time period and the first historical time period.

[0032] Based on the number of service accounts in the service account sequence and the order in which each service account is used, the relationship chain analysis results of the network device are generated.

[0033] In another implementation, the operating environment information is acquired according to an information collection cycle, and the acquisition unit can also be used to perform:

[0034] If the number of blacklisted devices corresponding to the service account is detected to be greater than the number threshold, the period shortening range is determined based on the number of blacklisted devices, and the number of blacklisted devices is positively correlated with the period shortening range;

[0035] The information collection cycle is updated according to the stated cycle shortening rate.

[0036] In another implementation, when the clustering unit performs clustering processing on the network devices under the service account based on the acquired runtime environment information to obtain the number of device clusters corresponding to the service account, it can specifically be used to perform:

[0037] Select environment information under a preset information type from the operating environment information;

[0038] A clustering algorithm associated with various preset information types is used to cluster network devices that log in to the service account based on the environmental information under the corresponding preset information type, so as to obtain the number of device clusters corresponding to the service account under the corresponding preset information type.

[0039] The number of device clusters corresponding to the service account is determined from the number of device clusters corresponding to each preset information type.

[0040] Furthermore, embodiments of this application provide a management device, including:

[0041] A memory, wherein a computer program is stored;

[0042] A processor for loading the computer program to implement the method as described in the first aspect.

[0043] In another aspect, embodiments of this application also provide a computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed as described in the first aspect.

[0044] In another aspect, embodiments of this application also provide a computer program product, the computer program product including computer instructions, wherein a processor of a computer device reads the computer instructions and executes the method as described in the first aspect.

[0045] In this embodiment, for network devices logging into the same service account, clustering is first performed on each device based on its current operating environment information. The number of device clusters indicated by the clustering results is used to determine whether the current service account is likely to be impersonated. If impersonation is suspected, network relationship chain analysis is further performed based on the network configuration records of each device to detect whether the device is impersonating the current service account. Devices exhibiting impersonation are then blacklisted to prevent further impersonation of the service account. Since the information used to detect blacklisted devices can be obtained in real time, storage resource consumption is reduced. Furthermore, the network relationship chain analysis for blacklisted device detection is triggered by the clustering results, coupling detection tasks across different detection dimensions. This ensures that the detected blacklisted devices are confirmed by multiple detection dimensions, resulting in high accuracy in the detected blacklisted devices. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a schematic diagram of a service device management scenario provided in an embodiment of this application;

[0048] Figure 2 This is a schematic diagram illustrating the management principle of a service device provided in an embodiment of this application;

[0049] Figure 3 This is a schematic flowchart of a service equipment management method provided in an embodiment of this application;

[0050] Figure 4 This is a schematic diagram of a clustering method provided in an embodiment of this application;

[0051] Figure 5 This is a schematic diagram illustrating a method for determining a blacklisted device according to an embodiment of this application;

[0052] Figure 6 This is a schematic diagram of a service attribution detection method provided in an embodiment of this application;

[0053] Figure 7 This is a schematic diagram illustrating another method for determining blacklisted devices provided in an embodiment of this application;

[0054] Figure 8This is a schematic diagram illustrating another method for determining a blacklist device provided in an embodiment of this application;

[0055] Figure 9 This is a schematic diagram of the implementation architecture of a service equipment management system provided in an embodiment of this application;

[0056] Figure 10 This is a schematic diagram of the structure of a service equipment management device provided in an embodiment of this application;

[0057] Figure 11 This is a schematic diagram of the structure of a management device provided in an embodiment of this application. Detailed Implementation

[0058] It should be noted in advance that, in order to enable those skilled in the art to better understand the technical solutions proposed in the embodiments of this application, the embodiments of this application will be described clearly and completely in conjunction with one or more accompanying drawings. Furthermore, the accompanying drawings shown in the embodiments of this application are merely illustrative examples; for instance, the execution order of each step in the drawings can be adaptively adjusted according to the actual application scenario.

[0059] Furthermore, in the embodiments of this application, the block diagrams, modules, and units shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. Each module or unit can be part of a larger module or unit that includes the functionality of that module or unit. That is, the terms "module" or "unit" mentioned in the embodiments of this application refer to a computer program or part of a computer program with a predetermined function, which can work together with other related parts to achieve a predetermined goal. It can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof, or implemented in different network and / or processor devices and / or microcontroller devices. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units.

[0060] Specifically, this application provides a service device management solution for business services where multiple devices share the same service account. This solution can accurately detect devices that access business services by impersonating service accounts. For example, a service management scenario involving multiple devices sharing the same service account can be found in [reference needed]. Figure 1 As shown. Figure 1 The service provider of the business service (such as Figure 1Devices marked with 101 can be assigned service accounts on a cluster basis, allowing network devices within the same cluster to use the same service account to access services. Different clusters can correspond to different service accounts, and different service accounts can provide different service permissions. For example, if network devices accessing service account 1 and network devices accessing service account 2 enjoy different services, the service provider can... Figure 1 The device cluster marked with 102 is assigned service account 1, which is... Figure 1 The device cluster marked with 103 is assigned service account 2.

[0061] In practical applications, a device cluster can consist of various electronic devices included in a service scenario (such as an internet cafe, e-sports arena, coffee shop, or auto showroom), so that the device cluster includes at least one network device. Optionally, the network device can include one or more of terminal devices, servers, and intermediate devices for network interaction. Terminal devices can be, for example, smartphones, tablets, laptops, desktop computers, and in-vehicle terminals; servers can be, for example, physical servers and cloud servers providing cloud computing services; intermediate devices can be, for example, routers, repeaters, and gateway devices. This application does not specifically limit the type of network device; for example, Figure 1 The device cluster marked with 102 in the middle contains two types of network devices: terminal devices and routers. Figure 1 The device cluster marked with 103 contains only one type of network device: terminal devices.

[0062] In one implementation, the service provider can designate a management device from the device cluster assigned to the service account, so that the management device can manage the network devices served by the service account. For example, the gateway device in the device cluster can be designated as the management device. Of course, in other implementations, the service provider itself can also manage the network devices served by the service account; no specific restrictions are made here. For ease of explanation, the device used to manage the service devices will be referred to as the management device below.

[0063] In the aforementioned service device management scenario, if it is necessary to detect network devices impersonating a specific service account, the various network devices logging into that service account can be identified first. Then, static and dynamic detection can be combined to detect whether each identified network device is impersonating the current service account. Static detection refers to detection based on statically configured device information, such as network connection parameters and hardware configuration parameters. Dynamic detection refers to detection based on dynamic behavior of the network device (such as network configuration changes), such as records of network configuration changes.

[0064] Based on this, this application proposes the following: Figure 2 This illustrates a management principle for a service facility. For example... Figure 2 As shown, when detecting network devices impersonating a specific service account, the process first involves clustering these network devices based on their runtime environment information (equivalent to static detection based on runtime environment information). If the clustering results indicate that these network devices should be divided into two or more device clusters, it suggests that the current service account may be impersonated. Then, based on the network configuration records of each network device, a network relationship chain analysis is performed (equivalent to dynamic detection based on network configuration records) to determine whether each network device is impersonating the current service account by judging whether there is cross-use of different service accounts. Finally, network devices exhibiting cross-use of different service accounts are blacklisted as impersonating service accounts to prevent them from impersonating the service account again to access business services.

[0065] Both network configuration records and operating environment information can be obtained from network devices during detection, eliminating the need for pre-storage by related business services. This results in lower resource consumption (such as storage and computing resources) when identifying network devices impersonating service accounts. Furthermore, combining network device configuration records with current operating environment information to detect whether a network device is impersonating a service account reduces the impact of information forgery on detection accuracy, thus improving the credibility of detected blacklisted devices. On the other hand, when multiple device clusters are obtained based on operating environment information, triggering network relationship chain analysis on each network device and selecting blacklisted devices based on the analysis results provides double confirmation of the selected blacklisted devices from both the operating environment and network relationship dimensions, thereby improving the accuracy of blacklisted device detection.

[0066] Based on the aforementioned management principles of service equipment, this application specifically proposes a management method for service equipment. A schematic flowchart of this method can be found here. Figure 3 Furthermore, each step in this method can be executed by the aforementioned management device. Specifically, such as... Figure 3 As shown, the method may include steps S301-S304:

[0067] S301. For network devices logged into the same service account, obtain the current operating environment information of each network device.

[0068] In a specific embodiment, runtime environment information can be collected upon receiving an account detection command to enable on-demand access to detection resources and reduce resource waste. As an example, the account detection command can be manually triggered by the service account administrator or automatically generated by the management device when a detection request is detected. Alternatively, runtime environment information can be collected according to a preset information collection cycle to periodically detect network devices impersonating the service account from among those logged into that service account. The runtime environment information describes the runtime environment of the business client within the network device; this business client refers to a client that can access the business service by logging into the service account.

[0069] In one implementation, the runtime environment information includes at least network parameter information and hardware configuration information. The network parameter information indicates the parameters used by the network device during network communication, and may specifically include network connection parameters such as LAN IP, public IP, and MAC address prefix, as well as network performance parameters such as transmission latency (e.g., ping value) and routing hop count. The hardware configuration information indicates the parameters of each hardware module in the network device, and may include the number of pulses per second that the central processing unit can generate (i.e., CPU clock speed, CPU stands for Central Processing Unit), and the memory size of the graphics processing unit (GPU) (i.e., video memory size).

[0070] In another implementation, the runtime environment information may also include scenario affiliation information, which describes the service scenario to which the network device belongs. As an example, scenario affiliation information may include a scenario identifier, a device identifier, program information for the scenario management program, and the deployment path of the scenario management program. For instance, when the service scenario is an internet cafe, the network device could be a computer in the internet cafe, the scenario identifier could be the internet cafe name, the device identifier could be a computer name, and the scenario management program could be the internet cafe's billing program.

[0071] It is worth mentioning that in practical application scenarios, runtime environment information can be divided into three main types: character information, numerical information, and performance parameter information. Character information refers to information composed of strings, numerical information refers to information composed of numbers and symbols, and performance parameter information specifically refers to ping values ​​and routing hop counts.

[0072] S302. Based on the obtained operating environment information, cluster the network devices corresponding to the service account to obtain the number of device clusters corresponding to the service account.

[0073] In specific embodiments, the management device can pre-configure clustering algorithms that are adept at clustering information of different types. When clustering based on runtime environment information is required, the appropriate clustering algorithm can be selected according to the information type corresponding to the runtime environment information, thereby achieving efficient and accurate clustering. For example, the management device can configure the K-modes clustering algorithm for character clusters, the K-means algorithm for numerical clusters, and the density-based spatial clustering of applications with noise (DBSCAN) algorithm for performance parameter clusters.

[0074] Therefore, when the operating environment information includes multiple types of environmental information, the management device can, for example, follow the following... Figure 4 The method shown is used for clustering to determine the number of device clusters indicated by the final clustering results. For example... Figure 4 The management device can first select environment information under preset information types from the operating environment information. Then, based on the environment information under each preset information type, it uses the corresponding clustering algorithm to cluster the network devices of the logged-in service account to obtain the number of device clusters corresponding to the service account under each preset information type. Finally, it determines the number of device clusters corresponding to the service account from the number of device clusters corresponding to each preset information type. Each clustering algorithm can correspond to a clustering weight, and the weight of the clustering result (i.e., the number of device clusters) obtained by each clustering algorithm is the same as the clustering weight corresponding to that algorithm. When multiple clustering algorithms yield clustering results, the clustering weight of each device cluster number can be determined based on the clustering weight of each algorithm, and the number of device clusters with the highest weight can be taken as the final number of device clusters corresponding to the service account.

[0075] If the number of device clusters is greater than 1, it indicates that there are significant differences in the operating environments among the network devices logged into the current service account. However, under normal circumstances, the operating environments of network devices within the same service scenario are usually similar or only slightly different. Therefore, if the clustering results show that the network devices logged into this service account should be divided into multiple device clusters, it indicates that the service account may be impersonated. If the number of device clusters is equal to 1, it indicates that the service account is almost impossible to impersonate at present. In this case, no action can be taken, and the system can simply wait for the next detection to trigger.

[0076] S303. If the number of devices in the cluster is two or more, network relationship chain analysis is performed based on the network configuration records of each network device to obtain the relationship chain analysis results. The relationship chain analysis results are used to indicate whether each network device uses different service accounts.

[0077] In a specific embodiment, network configuration records are used to indicate changes in the network configuration of network devices over a period of time. Specifically, this may include information such as used IP addresses, routing information, gateway IPs, and specific time periods. Network relationship chain analysis primarily relies on changes in the network configuration of network devices to determine whether the network device is engaging in impersonation of service accounts. The temporal nature of network configuration records can assist management devices in detecting more subtle impersonation behaviors during network relationship chain analysis, thereby reducing false positive and false negative rates.

[0078] As an example, network relationship chain analysis can be triggered when the number of device clusters obtained from clustering is two or more, because generally, when the number of device clusters is two or more, it indicates that the current service account may be impersonated. Therefore, it is necessary to further search for the network devices that impersonate the service account from the network devices that have logged into the service account.

[0079] Specifically, when performing network relationship chain analysis, the management device can first obtain the network configuration records of each network device within the first historical time period, and then determine the network configuration change rate (such as IP change rate) of the network device within the first historical time period based on these records. Generally, network devices use similar network configurations when logging into the same service account. Therefore, network devices with a high network configuration change rate (e.g., greater than or equal to a preset threshold) may be logging into different service accounts. In this case, it is necessary to combine the service account sequence corresponding to the network device within the third historical time period to determine whether the network device is using different service accounts interchangeably, and generate the corresponding relationship chain analysis results for that network device.

[0080] For example, the third historical time period can be composed of the first historical time period and adjacent time periods of the first historical time period. For instance, the first historical time period can be the most recent week, and the third historical time period can be the most recent two weeks. The management device can consider that the network device is engaging in cross-use of different service accounts when the number of service accounts in the service account sequence is greater than 2 and there are overlapping records among the service accounts in the service account sequence. Here, overlapping records refer to the existence of other service accounts between the same service accounts located in two different sequence positions. For example, when the i-th service account in the service account sequence is service account 1, the (i+1)-th service account is service account 2, and the (i+2)-th service account is service account 1, then overlapping records are considered to exist among the service accounts in the service account sequence.

[0081] S304. Based on the relationship chain analysis results, network devices that use different service accounts interchangeably are blacklisted devices, and blacklisted devices are prohibited from accessing the corresponding services through the service accounts.

[0082] In a specific embodiment, the management device can identify network devices that use different service accounts interchangeably as network devices impersonating service accounts and add them to the blacklist of the current service account to prevent them from accessing the corresponding service again through the current service account. Optionally, the management device can also adjust the information collection period in step S301 based on the number of blacklisted devices detected this time to adjust the frequency of detecting network devices impersonating service accounts.

[0083] For example, when the number of blacklisted devices corresponding to a service account exceeds a threshold, the management device can determine the period reduction margin based on the number of blacklisted devices and then update the information collection period accordingly. The number of blacklisted devices is positively correlated with the period reduction margin. Since a larger number of blacklisted devices indicates a more severe case of service account misuse, and a larger number of devices results in a greater period reduction margin, it allows for intensive device detection of the service account over a period of time, thereby quickly preventing widespread misuse of the service account.

[0084] In this embodiment, for network devices logging into the same service account, clustering is first performed on each device based on its current operating environment information. The number of device clusters indicated by the clustering results is used to determine whether the current service account is likely to be impersonated. If impersonation is suspected, network relationship chain analysis is further performed based on the network configuration records of each device to detect whether the device is impersonating the current service account. Devices exhibiting impersonation are then blacklisted to prevent further impersonation of the service account. Since the information used to detect blacklisted devices can be obtained in real time, storage resource consumption is reduced. Furthermore, the network relationship chain analysis for blacklisted device detection is triggered by the clustering results, coupling detection tasks across different detection dimensions. This ensures that the detected blacklisted devices are confirmed by multiple detection dimensions, resulting in high accuracy in the detected blacklisted devices.

[0085] exist Figure 3 In one implementation of the method embodiment shown, the management device may, after obtaining two or more device clusters through clustering, first perform service affiliation detection on each network device to determine whether the network device belongs to the authorized service device of the service account. Then, for network devices that do not belong to the authorized service device, the network relationship chain analysis in step S303 is triggered, so that blacklisted devices can be processed according to... Figure 5 The method shown is used to determine this. In this case, the identified blacklisted devices are at least those that are considered to have engaged in service account impersonation under both the service attribution detection dimension and the network relationship chain detection dimension. This method can identify network devices that impersonate service accounts by forging device information (such as hardware machine codes), network bridging, data forwarding, etc., and therefore has high accuracy and reliability.

[0086] In this context, "authorized service equipment" refers to the computer equipment included in the device cluster allocated to the service account by the business service. The network device's attribution information can be the network device's current attribution information under at least one attribution dimension. Correspondingly, the service account's registration information can be the service account's registration information under that at least one attribution dimension. The attribution dimension can include at least one of a geographic location dimension and a service object dimension. The attribution information under the geographic location dimension indicates the current geographic location of the network device, such as longitude x and latitude y. For example, this geographic location can be determined based on the network device's public IP address. The attribution information under the service object dimension indicates the service scenario to which the network device belongs, such as XX Speed ​​Internet Cafe, YY Esports Arena, etc.

[0087] For example, in Figure 5In the illustrated manner, the management device can, after obtaining the network device's attribution and registration information under various attribution dimensions, specifically, follow the steps shown below. Figure 6 The method shown is used to perform service affiliation detection on the network device to obtain the affiliation detection result. This result is then used to indicate whether the detected network device belongs to the authorized service device of the service account. Based on the affiliation detection results of each network device, network relationship chain analysis is performed on network devices that do not belong to the authorized service device category. For example... Figure 6 Service attribution detection at the service object level can be specifically determined by performing fuzzy matching between the registered object of the service account and the attribution object of the network device; service attribution detection at the geographical location level can be specifically determined by calculating the distance between the geographical location corresponding to the registered address and the geographical location corresponding to the public IP address of the network device.

[0088] exist Figure 3 In another implementation of the method embodiment shown, the management device can also perform service attribution detection and network relationship chain analysis on each network device in parallel after the number of device clusters obtained by clustering is two or more, so that blacklisted devices can be processed according to... Figure 7 The principle shown is used to determine this.

[0089] like Figure 7 The management device can record the service attribution detection results of network devices after performing service attribution detection. Simultaneously, based on the network configuration records of the network device within the first historical time period, the management device can perform network relationship chain analysis on the network device and record the analysis results. Then, network devices that are not authorized service devices and do not use different service accounts, or network devices that are authorized service devices but use different service accounts, are designated as retest devices. Based on the network configuration records and network performance information of these retest devices within the second historical time period, network behavior analysis is performed on them to determine if they have engaged in falsified device information. Retest devices exhibiting falsification are then blacklisted.

[0090] When the relationship chain analysis results and the attribution detection results conflict, further network behavior analysis can be performed on the network device based on the network configuration records and network performance information in the second historical time period. This can achieve a deep scan of the network device's behavior, thereby detecting more covert impersonation behaviors (such as account impersonation achieved through forged information) or accurately excluding impersonation behaviors of the network device, thus improving the credibility of the detected blacklisted devices.

[0091] The duration of the second historical time period must be greater than or equal to the duration of the first historical time period. Generally, the first and second historical time periods are different time periods. However, in some special implementation scenarios, the second and first historical time periods can be the same to reduce the number of data queries and improve detection efficiency. Furthermore, network behavior analysis can specifically include two analysis tasks: network relationship chain analysis and network performance analysis. The implementation method for network relationship chain analysis can refer to the implementation method in step S303, only requiring a change in the network configuration record used for analysis. Network performance analysis can determine whether there are significant performance changes in a network device by calculating the variance of network latency or the variance of routing hops within the second historical time period.

[0092] If a network device's relationship chain analysis shows that it is not cross-using different service accounts, but the network performance analysis shows significant performance fluctuations, then the network device may be attempting to circumvent detection by falsifying device information to avoid being identified as impersonating service accounts. Therefore, this network device can be added to the blacklist. Other cases depend on specific requirements. For example, if it is necessary to strictly ensure that service accounts are only logged in by authorized service devices, then the network device can be added to the blacklist only if the network device's relationship chain analysis shows that it is cross-using different service accounts.

[0093] exist Figure 3 In another implementation of the illustrated method embodiment, the management device may also, after obtaining two or more device clusters through clustering, poll the network devices in each device cluster and perform service affiliation detection on the currently polled network devices to obtain affiliation detection results. The affiliation detection results are used to indicate whether the detected network device belongs to the authorized service device of the service account, and the implementation method of service affiliation detection can be found above. Figure 5 The implementation methods involved are not detailed here. Then, the number of network devices that are not authorized service devices corresponding to each device cluster is recorded. When a device cluster (which can be called a target device cluster) is detected with a device number reaching a preset number, network relationship chain analysis is performed on each network device in that device cluster. The implementation method of network relationship chain analysis can be found in [link to relevant documentation]. Figure 3 The implementation method in step S303 will not be described in detail here either.

[0094] Polling refers to repeatedly accessing different objects (such as network devices in different device clusters) in a certain order. Network devices that are not authorized service devices are usually potential blacklisted devices. By using polling to detect network devices in each device cluster, the distribution of potential blacklisted devices within each cluster can be quickly identified. Moreover, prioritizing network relationship chain analysis for device clusters with a large number of potential blacklisted devices can rapidly stop account misuse on a large scale, thereby quickly reducing the loss of corresponding service rights. Especially during periods when service accounts have limited-time service permissions (such as limited-time purchase of game skins), using this method to detect network devices can effectively avoid significant losses of rights.

[0095] exist Figure 3 In another implementation of the illustrated method embodiment, the management device may also, after the number of device clusters obtained by clustering is two or more, follow the procedure as follows: Figure 8 The principle shown is used to determine blacklisted devices. For example... Figure 8 The management device can calculate the average performance of network devices within each cluster (such as average route hops, average ping value, etc.), and then designate the cluster with the lowest average performance as the cluster to which the service account belongs, while other clusters are directly added to the blacklist. This method can quickly and effectively prevent account misuse on a large scale, rapidly reducing the loss of corresponding service rights. Of course, in practical applications, to minimize the false positive rate of network devices, the management device can also designate other clusters as those requiring network relationship chain analysis for further detection.

[0096] Based on the foregoing method embodiments, this application takes game privilege services as an example and, in conjunction with the scenario of providing privilege services to network devices in internet cafes, specifically proposes an implementation architecture for a service device management system. Here, privileged services refer to service permissions that are more advanced or richer than ordinary service permissions. For example, ordinary service permissions for network devices in an internet cafe in a game scenario include the permission to claim regular game gift packs and the permission to use game characters already owned in the game. Therefore, privileged services can include the permission to claim exclusive game gift packs (at least covering the contents of regular game gift packs) and the permission to use all game characters in the game.

[0097] In one exemplary implementation, the implementation architecture of the service device management system can be found in [reference needed]. Figure 9 .like Figure 9As shown, the service device management system can mainly include the following four functional modules: the internet cafe network environment (marked by 901), the data warehouse (marked by 902), the service sharing detection module (marked by 903), and the blacklist database (marked by 904). It can be understood that these functional modules can be merged into larger modules or split into smaller modules, and different functional modules can be integrated into the same or different programs (or devices); no restrictions are placed here.

[0098] Figure 9 The internet cafe network environment can specifically include a server and one or more client devices. Each client device has terminal software deployed, and the server has server-side software deployed to complement and communicate with the terminal software. The terminal software can report device data from the client devices to the server in real time. This reported device data can include data from one or more layers, such as hardware, application, network, and driver layers (specifically, it can be as follows). Figure 9 (Data marked with 905); The server software can collect device data from the server and report the collected device data and the device data received from the terminal software to the service sharing detection module in real time.

[0099] Furthermore, the server can manage various client devices and obtain access permissions for one or more privileged services (referred to as service access permissions) by logging into privileged accounts in the server software. It can also share these service access permissions with the client devices it manages, enabling the client devices to access the corresponding privileged services. Moreover, client devices can interact with the server through terminal software, sharing the server's service access permissions. It's worth noting that in practical applications, the server with the server software deployed can be considered a gateway device.

[0100] Figure 9 The data warehouse in the internet cafe can specifically include two types: environmental data warehouse and behavioral data warehouse. The environmental data warehouse stores the operating environment data (or operating environment information) of each network device in the internet cafe, while the behavioral data warehouse stores the network behavior data of each network device (such as network configuration records, user network behavior records, etc.). The data in each data warehouse is collected and reported in real time by the gateway devices in the internet cafe.

[0101] Figure 9 The service sharing detection module in the document can be used to detect services according to the following: Figure 3The illustrated method embodiment retrieves corresponding information from a data warehouse to detect whether each network device in the internet cafe is a blacklisted device based on the retrieved information, and adds the detected blacklisted devices to the blacklist database. It is worth noting that in practical applications, the service sharing detection module can be integrated into the server within the internet cafe network environment or into the backend device of the service software; no limitation is made here.

[0102] Figure 9 The blacklist database can be used to store the unique identifier (such as machine code) of blacklisted devices. Blacklisted devices are prohibited from accessing the corresponding privileged services.

[0103] For ease of understanding, the following section will discuss privileged services in game scenarios (hereinafter referred to as game privileged services). Figure 9 The implementation architecture shown is explained in detail, focusing on one application principle. Here, "game privilege services" refers to additional game service rights within the game scenario compared to regular game service rights. Optionally, these additional game rights could include access to all game characters, game acceleration permissions, access to claim various game gift packs, and so on.

[0104] In the management of game privilege services, internet cafe operators can pre-register service accounts with game privilege service permissions in the server-side software deployed on the server. These service accounts have access permissions for one or more game privilege services. After successful registration, the server will be designated as an authorized server for game privilege services. Only by logging into the service account on the authorized server can the corresponding game privilege service be accessed. The authorized server can share the corresponding service access permissions with various client devices (specifically, client devices authenticated by the server) through interaction between the server-side software and the terminal software, and can also manage the service access permissions of each client device individually. The terminal software on the client devices can be used to provide the shared service access permissions to the device users.

[0105] As an example implementation, when the terminal software on the client device detects that the target game has been launched, it can obtain device information (such as a unique device identifier, hardware identifier, internet cafe information, IP address, etc.) used to identify the client device. The target game refers to a game for which the server has access to privileged game services. After obtaining the device information, an authentication request is sent to the authorized server. The server, based on its blacklist and the received device information, jointly determines whether the client device is allowed to access the target game's privileged services. If access is allowed, the game account logged into the target game is obtained and connected to the target game's privileged services; if access is not allowed, an authentication failure message is returned (optional), and the game account logged into the client device is prohibited from accessing the game's privileged services.

[0106] In some cases, certain computer devices, after deploying terminal software, can forge identity information to gain authentication by an authorized server, thereby illegally sharing the server's service access permissions. To accurately identify such computer devices as blacklisted devices, all computer devices sharing the corresponding service access permissions (including the server logged into the service account and the client devices managed by that server) can be treated as computer devices logged into the same service account. Then, the server can obtain and report the device data (at least including operating environment information and network behavior information) of each computer device under that service account to the service sharing detection module, thereby enabling the service sharing detection module to perform the aforementioned actions. Figure 3 The method embodiments described herein detect various computer devices to determine whether any of them need to be blacklisted.

[0107] In other cases, certain computer devices, after deploying server-side software, can also log into service accounts with game privileges by forging the identity information of authorized servers, thereby obtaining access permissions for those privileged services. In this scenario, the server-side software can report various data from the logged-in server to the service sharing detection module in real time, and then the service sharing detection module can execute the aforementioned... Figure 3 The method embodiments described herein detect various computer devices to determine whether any of them need to be blacklisted.

[0108] In both of the above scenarios, if a computer device is detected that needs to be blacklisted, its unique device identifier can be added to the blacklist database. This prevents the computer device from subsequently accessing game privilege services or sharing corresponding service access permissions. Optionally, the service sharing detection module in both scenarios can be integrated into the server or other devices (such as the device providing the game privilege service). That is to say, the above... Figure 3 The method implementation in the example can be executed by a server logged into the aforementioned service account, or by other devices not logged into the aforementioned service account. That is to say, in this example, Figure 3 The management device involved in the method embodiments can be the server in this example, or other devices in this example. However, it is worth mentioning that, in order to prevent the server with forged identity information from "stealing from within," this application preferably integrates the service sharing detection module into other devices.

[0109] By applying the method embodiments provided in this application in the context of game privilege services, various computer devices that impersonate identity information can be accurately identified. By adding them to the blacklist, the computer devices can be prevented from continuing to illegally share the corresponding game privilege services, effectively protecting the rights and interests of the service provider.

[0110] Based on the aforementioned method embodiments, this application also proposes a service device management apparatus, which can be mounted on the aforementioned management device and used to implement the above-mentioned methods. Figure 3 The described method embodiments include some or all of the functionalities. Specifically, a schematic structure of the device can be found in [reference needed]. Figure 10 .like Figure 10 The device may include an acquisition unit 1001, a clustering unit 1002, a data analysis unit 1003, and a device management unit 1004, wherein:

[0111] The acquisition unit 1001 is used to acquire the current operating environment information of each network device that is logged into the same service account;

[0112] Clustering unit 1002 is used to perform clustering processing on the network devices corresponding to the service account based on the obtained operating environment information, so as to obtain the number of device clusters corresponding to the service account.

[0113] The data analysis unit 1003 is used to perform network relationship chain analysis based on the network configuration records of each network device if the number of device clusters is two or more, so as to obtain the relationship chain analysis result. The relationship chain analysis result is used to indicate whether each network device uses different service accounts.

[0114] The device management unit 1004 is used to, based on the relationship chain analysis results, designate network devices that use different service accounts as blacklisted devices and prohibit the blacklisted devices from accessing the corresponding services through the service accounts.

[0115] In one implementation, the data analysis unit 1003 can also be used to perform:

[0116] Obtain the current attribution information of each network device under at least one attribution dimension, wherein the attribution dimension includes at least one of a geographic location dimension and a service object dimension;

[0117] Query the registration information of the service account under at least one attribution dimension;

[0118] Based on the attribution and registration information of each network device, service attribution detection is performed on each network device to obtain attribution detection results. The attribution detection results are used to indicate whether the network device being detected belongs to the authorized service device of the service account.

[0119] Based on the attribution detection results, the network relationship chain analysis is performed on network devices that do not belong to the authorized service devices.

[0120] In another implementation, the network configuration record is collected from a first historical time period, and the data analysis unit 1003 can also be used to perform:

[0121] Based on the attribution information of each network device and the registration information of the service account, service attribution detection is performed on each network device to obtain attribution detection results. The attribution detection results are used to indicate whether the detected network device belongs to the service device of the service account.

[0122] Based on the attribution detection results and the relationship chain analysis results, retesting devices are selected from the network devices. The retesting devices include network devices that are not authorized service devices and do not use different service accounts, as well as network devices that are authorized service devices and use different service accounts.

[0123] Obtain the network configuration records and network performance information of the retesting device during a second historical time period, wherein the duration of the second historical time period is longer than the duration of the first historical time period;

[0124] Based on the obtained network configuration records and network performance information, network behavior analysis is performed on the retesting device to obtain behavior analysis results. The behavior analysis results are used to indicate whether the retesting device has engaged in forging network information.

[0125] The device used to retest forged network information will be included in the blacklist.

[0126] In yet another implementation, the data analysis unit 1003 can also be used to perform:

[0127] Poll the network devices in each device cluster and perform service affiliation detection on the currently polled network device to obtain the affiliation detection result. The affiliation detection result is used to indicate whether the detected network device belongs to the authorized service device of the service account.

[0128] Record the number of network devices that do not belong to the authorized service devices corresponding to each device cluster;

[0129] If the number of devices corresponding to a target device cluster reaches a preset number, then the network relationship chain analysis is performed on each network device in the target device cluster.

[0130] In another embodiment, the network configuration record is the network configuration record within a first historical time period. When the data analysis unit 1003 performs the network relationship chain analysis on the network devices to obtain the relationship chain analysis results, it can specifically perform the following:

[0131] Based on the network configuration records of the network device in the first historical time period, the network configuration change rate of the network device is determined;

[0132] If the network configuration change rate is greater than or equal to a preset threshold, then the service account sequence of the network device in the third historical time period is obtained. The third historical time period is composed of the adjacent time period of the first historical time period and the first historical time period.

[0133] Based on the number of service accounts in the service account sequence and the order in which each service account is used, the relationship chain analysis results of the network device are generated.

[0134] In another embodiment, the operating environment information is acquired according to an information collection cycle, and the acquisition unit 1001 can also be used to perform:

[0135] If the number of blacklisted devices corresponding to the service account is detected to be greater than the number threshold, the period shortening range is determined based on the number of blacklisted devices, and the number of blacklisted devices is positively correlated with the period shortening range;

[0136] The information collection cycle is updated according to the stated cycle shortening rate.

[0137] In another implementation, when clustering unit 1002 performs clustering processing on network devices under the service account based on the acquired operating environment information to obtain the number of device clusters corresponding to the service account, it can specifically be used to perform:

[0138] Select environment information under a preset information type from the operating environment information;

[0139] A clustering algorithm associated with various preset information types is used to cluster network devices that log in to the service account based on the environmental information under the corresponding preset information type, so as to obtain the number of device clusters corresponding to the service account under the corresponding preset information type.

[0140] The number of device clusters corresponding to the service account is determined from the number of device clusters corresponding to each preset information type.

[0141] In one embodiment, Figure 10 Each unit in the illustrated device can be individually or entirely combined into one or more other units, or some of the units can be further divided into multiple functionally smaller units. This achieves the same operation without affecting the technical effects of the embodiments of this application. In other words, the above units are based on logical functional division. In practical applications, the function of one unit can be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of this application, Figure 10 The device shown may also include other units, and in practical applications, these functions may also be implemented with the assistance of other units, and may be implemented by multiple units working together.

[0142] According to another embodiment of this application, the following can be executed by running on a computing device including processing elements and storage elements such as a central processing unit (CPU), random access memory (RAM), and read-only memory (ROM). Figure 3 The computer program (including program code) for each step involved in the corresponding method shown, to construct such... Figure 10 The apparatus shown. A computer program may be recorded on, for example, a computer-readable storage medium, loaded onto the apparatus via the computer-readable storage medium, and executed therein.

[0143] Based on the descriptions of the above method and device embodiments, this application also provides a management device. Specifically, please refer to... Figure 11 , Figure 11 This is a schematic diagram of the structure of a management device provided in an embodiment of this application, such as... Figure 11 As shown, the management device may include a processor 1101, a memory 1102, and a communication interface 1103, and the processor 1101, memory 1102, and communication interface 1103 may be connected via a bus or other means.

[0144] The processor 1101 (or Central Processing Unit, CPU) is the computing and control core of the management device. It can parse various instructions within the management device and process various data of the management device.

[0145] Memory 1102 is a memory device in the management device used to store programs and data. It is understood that memory 1102 here may include the built-in memory of the management device, or it may include extended memory supported by the management device.

[0146] The communication interface 1103 may optionally include a standard wired interface or a wireless interface (such as Wi-Fi, mobile communication interface, etc.), and can be used to send and receive data under the control of the processor 1101; the communication interface 1103 can also be used to manage the transmission and interaction of data within the device.

[0147] In a specific embodiment, the processor 1101 may load and execute one or more computer programs stored in the memory 1102 to implement the steps in the method described in the above embodiments.

[0148] This application embodiment also provides a computer-readable storage medium (Memory), which is a memory device in a management device for storing programs and data. It is understood that the computer-readable storage medium here may include both the built-in storage medium in the management device and extended storage media supported by the management device. The computer-readable storage medium provides storage space that stores the processing system of the management device. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by the processor 1101, which may be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here may be high-speed RAM memory or non-volatile memory, such as at least one disk storage device; optionally, it may also be at least one readable storage medium located remotely from the aforementioned processor.

[0149] This application also provides a computer program product, which includes computer instructions, and the processor of the management device can execute the above-described method embodiments by loading the computer instructions.

[0150] Based on the same inventive concept, the principles and beneficial effects of the devices, management equipment, computer-readable storage media and computer program products provided in the embodiments of this application are similar to those described in the foregoing corresponding method embodiments. Therefore, the corresponding method implementation principles and beneficial effects can be referred to, which will not be repeated here for the sake of brevity.

[0151] It should be further noted that the steps in the methods of this application embodiment can be adjusted, merged, and deleted according to actual needs, and the modules in the device of this application embodiment can be merged, divided, and deleted according to actual needs. Furthermore, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. It should also be particularly emphasized that when the above embodiments of this application are applied to specific products or technologies, the data acquisition involved in each specific implementation of this application requires the permission or consent of the relevant parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0152] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Those skilled in the art will understand that all or part of the processes for implementing the above embodiments and equivalent variations made in accordance with the claims of this application are still within the scope of this application.

Claims

1. A service equipment management method, characterized in that, include: For network devices logged into the same service account, obtain the current operating environment information of each network device; Based on the obtained operating environment information, the network devices corresponding to the service account are clustered to obtain the number of device clusters corresponding to the service account. If the number of devices in the cluster is two or more, network relationship chain analysis is performed based on the network configuration records of each network device to obtain the relationship chain analysis results. The relationship chain analysis results are used to indicate whether each network device uses different service accounts. Based on the relationship chain analysis results, network devices that use different service accounts interchangeably are designated as blacklisted devices, and these blacklisted devices are prohibited from accessing the corresponding services through the service accounts.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the current attribution information of each network device under at least one attribution dimension, wherein the attribution dimension includes at least one of a geographic location dimension and a service object dimension; Query the registration information of the service account under at least one attribution dimension; Based on the attribution and registration information of each network device, service attribution detection is performed on each network device to obtain attribution detection results. The attribution detection results are used to indicate whether the network device being detected belongs to the authorized service device of the service account. Based on the attribution detection results, the network relationship chain analysis is performed on network devices that do not belong to the authorized service devices.

3. The method according to claim 1, characterized in that, The network configuration records are collected from the first historical time period, and the method further includes: Based on the attribution information of each network device and the registration information of the service account, service attribution detection is performed on each network device to obtain attribution detection results. The attribution detection results are used to indicate whether the detected network device belongs to the service device of the service account. Based on the attribution detection results and the relationship chain analysis results, retesting devices are selected from the network devices. The retesting devices include network devices that are not authorized service devices and do not use different service accounts, as well as network devices that are authorized service devices and use different service accounts. Obtain the network configuration records and network performance information of the retesting device during a second historical time period, wherein the duration of the second historical time period is longer than the duration of the first historical time period; Based on the obtained network configuration records and network performance information, network behavior analysis is performed on the retesting device to obtain behavior analysis results. The behavior analysis results are used to indicate whether the retesting device has engaged in forging network information. The device used to retest forged network information will be included in the blacklist.

4. The method according to claim 1, characterized in that, The method further includes: Poll the network devices in each device cluster and perform service affiliation detection on the currently polled network device to obtain the affiliation detection result. The affiliation detection result is used to indicate whether the detected network device belongs to the authorized service device of the service account. Record the number of network devices that do not belong to the authorized service devices corresponding to each device cluster; If the number of devices corresponding to a target device cluster reaches a preset number, then the network relationship chain analysis is performed on each network device in the target device cluster.

5. The method according to any one of claims 1-4, characterized in that, The network configuration record is the network configuration record within the first historical time period. The methods for obtaining the relationship chain analysis results by performing the network relationship chain analysis on network devices include: Based on the network configuration records of the network device in the first historical time period, the network configuration change rate of the network device is determined; If the network configuration change rate is greater than or equal to a preset threshold, then the service account sequence of the network device in the third historical time period is obtained. The third historical time period is composed of the adjacent time period of the first historical time period and the first historical time period. Based on the number of service accounts in the service account sequence and the order in which each service account is used, the relationship chain analysis results of the network device are generated.

6. The method according to any one of claims 1-4, characterized in that, The operating environment information is acquired according to an information collection cycle; the method further includes: If the number of blacklisted devices corresponding to the service account is detected to be greater than the number threshold, the period shortening range is determined based on the number of blacklisted devices, and the number of blacklisted devices is positively correlated with the period shortening range; The information collection cycle is updated according to the stated cycle shortening rate.

7. The method according to any one of claims 1-4, characterized in that, The process of clustering network devices under the service account based on the acquired operating environment information to obtain the number of device clusters corresponding to the service account includes: Select environment information under a preset information type from the operating environment information; A clustering algorithm associated with various preset information types is used to cluster network devices that log in to the service account based on the environmental information under the corresponding preset information type, so as to obtain the number of device clusters corresponding to the service account under the corresponding preset information type. The number of device clusters corresponding to the service account is determined from the number of device clusters corresponding to each preset information type.

8. A service equipment management device, characterized in that, include: The acquisition unit is used to acquire the current operating environment information of each network device that is logged into the same service account. The clustering unit is used to perform clustering processing on the network devices corresponding to the service account based on the obtained operating environment information, so as to obtain the number of device clusters corresponding to the service account. The data analysis unit is used to perform network relationship chain analysis based on the network configuration records of each network device if the number of device clusters is two or more, so as to obtain the relationship chain analysis results. The relationship chain analysis results are used to indicate whether each network device uses different service accounts. The device management unit is used to, based on the relationship chain analysis results, designate network devices that use different service accounts as blacklisted devices and prohibit the blacklisted devices from accessing the corresponding services through the service accounts.

9. A management device, characterized in that, include: A memory, wherein a computer program is stored; A processor for loading the computer program to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer storage medium stores a computer program adapted to be loaded by a processor and executed as described in any one of claims 1-7.

11. A computer program product, characterized in that, The computer program product includes computer instructions, and the processor of the computer device reads the computer instructions and executes the method as described in any one of claims 1-7.

Images