CN110197435A

CN110197435A - Object identifying method and device, storage medium and electronic device

Info

Publication number: CN110197435A
Application number: CN201810368880.6A
Authority: CN
Inventors: 潘杰; 魏雪
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2018-04-23
Filing date: 2018-04-23
Publication date: 2019-09-03
Anticipated expiration: 2038-04-23
Also published as: CN110197435B

Abstract

The invention discloses a kind of object identifying methods and device, storage medium and electronic device.Wherein, this method comprises: obtaining the object run characteristic value of the specified operating characteristics of specified object, wherein the specified operating characteristics are used to identify the operation information for the specified operation that the specified object executes；According to the object run characteristic value and object module, determine that the specified object belongs to the destination probability of targeted packets, wherein the object module is the model being trained using the sample operations characteristic value of sample object to initial model；Object identifying result is determined according to the determining destination probability, wherein the Object identifying result is used to indicate whether the specified object belongs to the targeted packets.The present invention solves the technical problem for causing recognition result accuracy poor due to the personal information that user's identification method relies on user registration.

Description

Object identifying method and device, storage medium and electronic device

Technical field

The present invention relates to computer fields, in particular to a kind of object identifying method and device, storage medium and electricity Sub-device.

Background technique

Currently, needing to obtain social network used in login application program to identify whether user belongs to special group Then the account of network platform inquires user and uses the personal information registered when the account, determines whether the user belongs to particular cluster Body.

Since above-mentioned user's identification method depends on the personal information of user registration, and the registration of personal information has subjectivity Property, the problem for causing recognition result accuracy poor.

For above-mentioned problem, currently no effective solution has been proposed.

Summary of the invention

The embodiment of the present invention provides a kind of object identifying method and device, storage medium and electronic device, at least to solve The technical problem for causing recognition result accuracy poor due to the personal information that user's identification method relies on user registration.

According to an aspect of an embodiment of the present invention, a kind of object identifying method is provided, comprising: obtain specified object The object run characteristic value of specified operating characteristics, wherein the specified operating characteristics are used to identify what the specified object executed The operation information of specified operation；According to the object run characteristic value and object module, determine that the specified object belongs to target The destination probability of grouping, wherein the object module is to be carried out using the sample operations characteristic value of sample object to initial model The model that training obtains；Object identifying result is determined according to the determining destination probability, wherein the Object identifying result is used Whether belong to the targeted packets in the instruction specified object.

According to another aspect of an embodiment of the present invention, a kind of object recognition equipment is additionally provided, comprising: first obtains list Member, the object run characteristic value of the specified operating characteristics for obtaining specified object, wherein the specified operating characteristics are for marking Know the operation information for the specified operation that the specified object executes；First determination unit, for according to the object run feature Value and object module, determine that the specified object belongs to the destination probability of targeted packets, wherein the object module is using sample The model that the sample operations characteristic value of this object is trained initial model；Second determination unit, for according to determination The destination probability determine Object identifying result, wherein whether the Object identifying result is used to indicate the specified object Belong to the targeted packets.

Another aspect according to an embodiment of the present invention, additionally provides a kind of storage medium, and meter is stored in the storage medium Calculation machine program, wherein the computer program is arranged to execute the above method when operation.

Another aspect according to an embodiment of the present invention, additionally provides a kind of electronic device, including memory, processor and deposits Store up the computer program that can be run on a memory and on a processor, wherein above-mentioned processor passes through computer program and executes Above-mentioned method.

In embodiments of the present invention, by the way of automatic identification, the specified operating characteristics of object are specified by acquisition Object run characteristic value, wherein specified operating characteristics are used to identify the operation information for the specified operation that specified object executes；According to Object run characteristic value and object module determine that specified object belongs to the probability of targeted packets, and according to determining determine the probability Whether specified object belongs to targeted packets, has achieved the purpose that whether automatic identification object belongs to targeted packets, due to according to finger Object to be determined to the operation information of specified operation, and automatic identification is carried out to object, the foundation of identification is the operation information of object, thus The technical effect for improving recognition result accuracy is realized, and then is solved since user's identification method relies on of user registration The technical problem that people's data causes recognition result accuracy poor.

Detailed description of the invention

The drawings described herein are used to provide a further understanding of the present invention, constitutes part of this application, this hair Bright illustrative embodiments and their description are used to explain the present invention, and are not constituted improper limitations of the present invention.In the accompanying drawings:

Fig. 1 is a kind of schematic diagram of the application environment of object identifying method according to an embodiment of the present invention；

Fig. 2 is a kind of flow diagram of optional object identifying method according to an embodiment of the present invention；

Fig. 3 is a kind of schematic diagram of optional logistic regression according to an embodiment of the present invention；

Fig. 4 is a kind of schematic diagram of optional Sigmoid function according to an embodiment of the present invention；

Fig. 5 is the schematic diagram of another optional object identifying method according to an embodiment of the present invention；

Fig. 6 is the flow diagram of another optional object identifying method according to an embodiment of the present invention；

Fig. 7 is a kind of structural schematic diagram of optional object recognition equipment according to an embodiment of the present invention；

Fig. 8 is a kind of structural schematic diagram of optional electronic device according to an embodiment of the present invention.

Specific embodiment

In order to enable those skilled in the art to better understand the solution of the present invention, below in conjunction in the embodiment of the present invention Attached drawing, technical scheme in the embodiment of the invention is clearly and completely described, it is clear that described embodiment is only The embodiment of a part of the invention, instead of all the embodiments.Based on the embodiments of the present invention, ordinary skill people The model that the present invention protects all should belong in member's every other embodiment obtained without making creative work It encloses.

It should be noted that description and claims of this specification and term " first " in above-mentioned attached drawing, " Two " etc. be to be used to distinguish similar objects, without being used to describe a particular order or precedence order.It should be understood that using in this way Data be interchangeable under appropriate circumstances, so as to the embodiment of the present invention described herein can in addition to illustrating herein or Sequence other than those of description is implemented.In addition, term " includes " and " having " and their any deformation, it is intended that cover Cover it is non-exclusive include, for example, the process, method, system, product or equipment for containing a series of steps or units are not necessarily limited to Step or unit those of is clearly listed, but may include be not clearly listed or for these process, methods, product Or other step or units that equipment is intrinsic.

According to an aspect of an embodiment of the present invention, a kind of object identifying method is provided.Optionally, above-mentioned Object identifying Method can be, but not limited to be applied in application environment as shown in Figure 1.As shown in Figure 1, obtaining specified object in terminal 102 The object run characteristic value of specified operating characteristics, wherein specified operating characteristics are used to identify the specified operation that specified object executes Operation information, and the object run characteristic value that will acquire is sent to server 104 by network.Server 104 is according to target Operating characteristics value and object module determine that specified object belongs to the destination probability of targeted packets, wherein object module is using sample The model that the sample operations characteristic value of this object is trained initial model；Object is determined according to determining destination probability Recognition result, wherein Object identifying result is used to indicate whether specified object belongs to targeted packets.

Optionally, after determining Object identifying result according to determining destination probability, server 104 can be known in object Other result is that in the case that specified object belongs to targeted packets, target information is sent to processing equipment 106 by network, to refer to Show that processing equipment 106 is that specified object configures business corresponding with target information, wherein target information includes the mark of specified object Know the mark with targeted packets.

Optionally, in the present embodiment, above-mentioned terminal can include but is not limited at least one of: mobile phone, plate electricity Brain etc..Above-mentioned network can include but is not limited to wireless network, wherein the wireless network includes: bluetooth, WIFI and other realizations The network of wireless communication.Above-mentioned server can include but is not limited at least one of: PC machine and other for calculate service Equipment.Above-mentioned only a kind of example, the present embodiment do not do any restriction to this.

Optionally, in the present embodiment, as an alternative embodiment, as shown in Fig. 2, above-mentioned object identifying method May include:

S202 obtains the object run characteristic value of the specified operating characteristics of specified object, wherein specified operating characteristics are used for Identify the operation information for the specified operation that specified object executes；

S204 determines that specified object belongs to the destination probability of targeted packets according to object run characteristic value and object module, Wherein, object module is the model being trained using the sample operations characteristic value of sample object to initial model；

S206 determines Object identifying result according to determining destination probability, wherein Object identifying result is used to indicate specified Whether object belongs to targeted packets.

Optionally, above-mentioned object identifying method can be, but not limited to the process for whether belonging to targeted packets of identification object. Such as in researching and developing and promoting applied to business, for example, by taking business is researched and developed as an example, by going out to belong to the object of targeted packets, to mesh The identification characteristics of mark grouping are analyzed, and " portrait " (common characteristic) of the targeted packets of targeted packets is formed.To more precisely The hobby and demand of the object of targeted packets are positioned, to research and develop for the business of target object.

It should be noted that in the related art, personal information of the Object identifying dependent on user registration, and personal information Registration have subjectivity, there are recognition result accuracy is poor.And in this application, by the specified behaviour for obtaining specified object Make the object run characteristic value of feature, wherein specified operating characteristics are used to identify the operation for the specified operation that specified object executes Information；According to object run characteristic value and object module, determine that specified object belongs to the probability of targeted packets, and according to determining Determine the probability specifies whether object belongs to targeted packets, the purpose identified automatically to object may be implemented, due to according to right The specified operating characteristics of elephant identify object, and the accuracy of Object identifying can be improved, so solve in the related technology due to Family identification method relies on the problem that the personal information of user registration causes recognition result accuracy poor.

Optionally, in the present embodiment, the object run characteristic value of the specified operating characteristics of specified object is obtained, wherein Specified operating characteristics are used to identify the operation information for the specified operation that specified object executes.

Optionally, specified object can be obtaining using user by installing the terminal of the target software for target software The operation behavior of specified object.Specified operation can be any operation of designated user's execution.Specified operating characteristics can be used for The operation information of specified operation performed by specified object is identified, aforesaid operations information can be related any with specified operation Information, such as, if the instruction information for executing specified operation executes the information such as number, frequency, the time of specified operation.

Optionally, specified operating characteristics can include but is not limited to:

(1) fisrt feature, wherein fisrt feature is for identifying what specified object operated use performed by target software Operation information；

Target software can be software related with targeted packets.For different targeted packets, corresponding target software It can be different.Optionally, target software can include but is not limited to: dialer software, free WIFI software, Games Software, video Software etc..

Optionally, fisrt feature can be using the relevant operation information of target software, and aforesaid operations information may include But it is not limited to: using the instruction information of target software, using the number of target software, frequency, time interval etc..For example, first Feature may is that the instruction information for the use operation that specified object executes target software, then target corresponding with fisrt feature Operating characteristics value may is that 1, indicate to use target software；0, it indicates that target software is not used.

Optionally, the object run characteristic value of fisrt feature can be obtains in the following manner: timed enumeration target is set The current process of standby (corresponding with specified object).

For example, specified operating characteristics include: fisrt feature, fisrt feature are as follows: designated user makes dialer software execution With the operation information of operation, operation information are as follows: the instruction information (instruction that specified object operates use performed by dialer software Whether use dialer software), the current process of timed enumeration target device, using target API (for example, NtQuerySystemInformation etc.), if it is target software, then designated user uses dialer software, and object run is special Value indicative is 1；If not target software, then the dialer software is not used in designated user, and object run characteristic value is 0.

(2) second feature, wherein second feature is used to identify the behaviour for the access operation that specified object executes target network address Make information；

Target network address can be software related with targeted packets.For different targeted packets, corresponding target network address It can be different.Optionally, target network address may is that network address or particular web site comprising specific fields.

For example, if targeted packets are as follows: university student, then target network address can include but is not limited to: having edu.cn domain name Network address, the internal address of edu.cn, teaching class network address etc..In another example if targeted packets are as follows: have the mother of child, then mesh Mark website may is that the website for selling mother and baby's articles.

Optionally, second feature can be the relevant operation information of access target network address, and aforesaid operations indicate that information can be with Including but not limited to: the instruction information of access target network address, the number of access target network address, frequency, time interval etc..For example, Second feature may is that the instruction information for the access operation that specified object executes target network address, mesh corresponding with second feature Mark operating characteristics value may is that 1, indicate access target network address；0, indicate non-access target network address.

Optionally, the object run characteristic value of second feature can be obtains in the following manner: by entering browser Process, determine designated user access network address.

For example, specified operating characteristics include: second feature, second feature are as follows: designated user executes teaching class website The operation information of access operation, operation information are as follows: instruction information of the specified object to access operation performed by teaching class website (indicating whether access teaching class website), the process of browser is entered by injection module, if having accessed teaching class website, Object run characteristic value is 1；If not target software, if not accessing teaching class website, object run characteristic value is 0.

(3) third feature, wherein third feature is for identifying specified object to the first mesh comprising the first special key words Mark the operation information for the down operation that file executes；

First object file can be file related with targeted packets.For different targeted packets, corresponding first File destination can be different.It include relevant first special key words of targeted packets in first object file.First specific pass Key word may be embodied in: in the filename of first object file, in document text, document it is medium.

For example, if targeted packets are as follows: university student, then the special key words for including in first object file may include but It is not limited to: operation, school timetable, laboratory report etc..In another example if targeted packets are as follows: have the mother of child, then first object file In include special key words can include but is not limited to: infant, milk powder, children's garment brand etc..

Third feature can be the relevant operation information of downloading first object file, and optionally, aforesaid operations information can be with Including but not limited to: the instruction information of downloading first object file, number, frequency, the time interval for downloading first object file Deng.For example, third feature may is that the instruction information for the down operation that specified object executes first object file, with third The corresponding object run characteristic value of feature may is that 1, indicate downloading first object file；0, first object text is not downloaded in expression Part.

For example, specified operating characteristics include: third feature, third feature are as follows: specify object to first comprising " course " The operation information of down operation performed by file destination, operation information are as follows: specify object to the first object comprising " course " The instruction information (indicate whether download first object file) of down operation performed by file, if designated user has downloaded the One file destination, then object run characteristic value is 1；If not downloading first object file, object run characteristic value is 0.

(4) fourth feature, wherein fourth feature is for identifying specified object to the second mesh comprising the second special key words Mark the operation information for the opening operation that file executes；

Second file destination can be file related with targeted packets.For different targeted packets, corresponding second File destination can be different.It include relevant second special key words of targeted packets in second file destination.Second specific pass Key word may be embodied in: in the filename of the second file destination, in document text, document it is medium.

For example, if targeted packets are as follows: university student, then the special key words for including in the second file destination may include but It is not limited to: operation, school timetable, laboratory report etc..In another example if targeted packets are as follows: have the mother of child, then the second file destination In include special key words can include but is not limited to: infant, milk powder, children's garment brand etc..

Fourth feature, which can be, opens the relevant operation information of the second file destination, and optionally, aforesaid operations information can be with Including but not limited to: opening the instruction information of the second file destination, open number, frequency, the time interval of the second file destination Deng.For example, fourth feature may is that the instruction information for the opening operation that specified object executes the second file destination, with the 4th The corresponding object run characteristic value of feature may is that 1, indicate to open the second file destination；0, expression is not switched on the second target text Part.

For example, specified operating characteristics include: fourth feature, fourth feature are as follows: specify object to second comprising " course " The operation information of opening operation performed by file destination, operation information are as follows: specify object to the second target comprising " course " The instruction information (indicate whether open the second file destination) of opening operation performed by file, if designated user opens the Two file destinations, then object run characteristic value is 1；If being not switched on the second file destination, object run characteristic value is 0.

(5) fifth feature, wherein for identifying specified object to the target window execution comprising third special key words The operation information of opening operation；

The third special key words for including in target window are keywords related with targeted packets.For different targets Grouping, corresponding target window can be different.Third special key words are included in: the title of target window, target window it is aobvious Show content etc..

For example, if targeted packets are as follows: university student, the then special key words for including in target window may include but unlimited In: operation, school timetable, laboratory report etc..In another example if targeted packets are as follows: have the mother of child, then include in target window Special key words can include but is not limited to: infant, milk powder, children's garment brand etc..

Fifth feature, which can be, opens the relevant operation information of target window, for example, the instruction information of opening target window, Open number, frequency, the time interval etc. of target window.Optionally, fifth feature may is that specified object holds target window The instruction information (indicating whether to open target window) of capable opening operation, object run characteristic value corresponding with fifth feature can With are as follows: 1, it indicates to open target window；0, expression is not switched on target window.

Optionally, the object run characteristic value of fifth feature can be obtains in the following manner: by timed enumeration window Mouth title obtains the keyword for including in current window using API such as EnumWindows and EnumChildWindows.

For example, specified operating characteristics include: fifth feature, fifth feature are as follows: specify object to the target comprising " course " The operation information of opening operation performed by window, operation information are as follows: specified object holds the target window comprising " course " The instruction information (indicating whether to open target window) of capable opening operation, timed enumeration window title, if designated user beats Target window is opened, then object run characteristic value is 1；If being not switched on target window, object run characteristic value is 0.

Optionally, specified operating characteristics can also include: the operation information of addition operation of the designated user to target group (sixth feature), for example, target group can be the group comprising the 4th special key words.4th special key words can be with The relevant keyword of targeted packets.For example, targeted packets are university student, the 4th special key words can be " class ", " ".

Optionally, the object run characteristic value of sixth feature can be obtains in the following manner: by timed enumeration window Mouth title, using API such as EnumWindows and EnumChildWindows, if current window is flat for specific the Internet media Platform (corresponding with target group) obtains the pass for including in current window or process corresponding with the specific the Internet media platform Key word.

Optionally, specified operating characteristics can also include: that designated user believes the operation of access operation performed by network It ceases (seventh feature), aforesaid operations information can include but is not limited to: the time that network is added, the time to exit network, access The duration etc. of network.

Optionally, specified operating characteristics can also include: designated user to opening operation performed by target device or The operation information (eighth feature) of shutoff operation, aforesaid operations information can include but is not limited to: open or close target device Time, the total opening duration of target device etc..The opening operation of target device can be divided by the event information of system Analysis obtains, and the shutoff operation of target device can be obtained by GetTicketCount,

Optionally, specified operating characteristics can also include: designated user to performed by target game or target video The operation information (ninth feature) of opening operation or shutoff operation, aforesaid operations information can include but is not limited to: open or The total opening duration etc. of the time of closing target game, target game.The opening operation of target game or target video or Shutoff operation can be obtained by the similar mode of such as aforementioned performed specified operation to target software.

Optionally, for different targeted packets, different specified operating characteristics can be used.For a kind of target point Group, the specified operating characteristics used can have one or more.For example, specified operating characteristics may include one or more first Feature, one or more second feature, one or more third feature, one or more fourth feature, one or more the 5th Feature.It above are only a kind of example, this be not construed as limiting in the present embodiment.

For example, targeted packets are as follows: university student specifies operating characteristics are as follows: (1) uses dialer software；(2) domain edu.cn is accessed The website of name；(3) teaching class website was accessed；(4) file comprising " school timetable ", " operation " or " laboratory report " downloaded.

Optionally, for different specified operating characteristics, the object run characteristic value of the specified operating characteristics of object is specified Value range may be the same or different, specific object run characteristic value, according to user to the execution feelings of specified operation Condition is determined.

Optionally, in the present embodiment, according to object run characteristic value and object module, determine that specified object belongs to target The destination probability of grouping, wherein object module is to be trained using the sample operations characteristic value of sample object to initial model Obtained model.

Optionally, object module can be for determining that sample output is the mathematical algorithm model of the probability of particular value, can With the data algorithm model for classifying to sample.In object module, the object run feature to specify object is inputted Be worth (can be multiple), the domain of input can be [- ∞ ,+∞], export for specify object belonging to grouping, usually from Scattered, i.e., only limited multiple output valves, for example, its codomain can be only there are two { 0,1 } be worth, 1 indicates that specified object belongs to mesh Mark grouping, 0 indicates that specified object is not belonging to targeted packets.The result of output are as follows: specified object belongs to the probability of targeted packets.

Optionally, the sample value that sample object can be used in object module is trained to obtain to initial model.In training When obtaining object module, it can establish two groups of sample objects first, one group is the first sample object for belonging to targeted packets, another Group is to be not belonging to the second sample object of targeted packets, and the quantity of two groups of sample objects can be identical.Obtain two class sample objects Mode can include but is not limited to following one:

1) two class sample objects can be obtained by way of investigation, firstly, by receiving sample object for whether belonging to In the feedback information of targeted packets, determine that each sample object belongs to targeted packets, or be not belonging to targeted packets；

2) by receiving the grouping information of sample object from other equipment or target database, each sample object category is determined In targeted packets, or it is not belonging to targeted packets.

Optionally, after getting two groups of sample objects, the sample object of two groups of sample objects can be continued respectively Grouping, one group is used for training data model (training sample), and one group for testing the data model (test specimens obtained after training This).The rule of classification of two groups of sample datas (belong to the sample object of targeted packets and be not belonging to the sample of targeted packets) can be with It is identical, be used in training data model and sample object for test data model in, belong to the sample pair of targeted packets As equal with the number for the sample object for being not belonging to targeted packets.

Optionally, in the present embodiment, the first specified operating characteristics for belonging to the first sample object of targeted packets are obtained The first operating characteristics value, and be not belonging to the second specified operating characteristics of the second sample object of targeted packets the second operation it is special Value indicative, wherein the first specified operating characteristics are used to identify the operation information of the specified operation of first sample object execution, and second refers to Determine the operation information of specified operation of the operating characteristics for identifying the execution of the second sample object；Use the first operating characteristics value and Two operating characteristics values are trained initial model, obtain object module.

When optionally, for initial model, the number of variable (specified operating characteristics) can be variation, each variable It is corresponding with a specified operating characteristics.The occurrence of variable number, can according to need and set.

Optionally, when being trained to initial model, the input of initial model is to belong to the first sample of targeted packets First operating characteristics value of the specified operating characteristics of the first of object, and it is not belonging to the second finger of the second sample object of targeted packets Determine the second operating characteristics value of operating characteristics, the first specified operating characteristics and the second operating characteristics are that object executes specified operation Operation information, but object corresponding to the two is different.First sample object and the second sample object can be one, can also Be it is multiple, the quantity of sample object can be set according to actual needs, is not construed as limiting in the present embodiment to this.It uses First operating characteristics value of first sample object and the second operating characteristics value of the second sample object are trained initial model, To obtain object module.

Optionally, in the present embodiment, initial model is carried out using the first operating characteristics value and the second operating characteristics value Training, obtain object module include: using the first operating characteristics value and the second operating characteristics value and specified operating characteristics just Beginning weight is trained initial model, obtains object module, wherein initial weight refers to according to executing in first sample object Surely the quantity that the sample object of specified operation was executed in the quantity of the sample object operated and the second sample object is calculated.

In an initial model case, each specified operating characteristics have a corresponding coefficient (that is, weight, weight), respectively The initial value of coefficient can be according to the number for the sample object for executing specified operation corresponding with the coefficient in first sample object The quantity for the sample object for executing specified operation corresponding with the coefficient in amount and the second sample object is calculated.Example Such as, test specimens can be accounted for according to the quantity for the sample object for executing specified operation corresponding with the coefficient in first sample object The sample object of specified operation corresponding with the coefficient was executed in this (including first sample object and the second sample object) The ratio of quantity.

Specifically following example is combined to be illustrated initial model and object module.Initial model and object module can be Logic Regression Models, logistic regression are a kind of statistical learning methods for having supervision, and Logic Regression Models are a kind of the linear of broad sense Regression analysis model is usually used in data mining, and disease diagnoses automatically, the fields such as economic forecasting.

In linear regression model (LRM), output is usually continuous, such as: y=f (x)=ax+b, for each input X has a corresponding y output.The domain and codomain of model can be [- ∞ ,+∞].

In conjunction with Fig. 3, logistic regression is in order to solve classification problem, according to some known training set (e.g., three in Fig. 3 Angle and snowflake) Logic Regression Models are trained, then new data (e.g., the circle in Fig. 3) is predicted, predict that the data belong to Which class.As it can be seen that the target of logistic regression is to find the decision boundary with enough discriminations, so as to by Various types of data into Row is distinguished well.

For Logic Regression Models, input be can be continuous [- ∞ ,+∞], but it is usually discrete for exporting, that is, only Limited multiple output valves.For example, its codomain can be only there are two { 0,1 } be worth, the two values can indicate certain point to sample Class (high/low, illness/health, feminine gender/positive etc.), here it is the recurrence of most common two sorted logic.Therefore, come on the whole It says, by Logic Regression Models, the x in entire real number range can be mapped on limited point, thereby realized Classification to x.For a certain x, using Logic Regression Models, it can determine that it is attributed to certain a kind of probability, and then pass through logic Regression analysis can be classified in certain one kind y.

Logistic regression is also referred to as generalized linear regression model, it is substantially the same with the form of linear regression model (LRM), all With ax+b (this is example, and the number of variable x may include multiple), wherein a and b is parameter to be asked.The difference of the two is Its dependent variable is different, and multiple linear regression is directly using ax+b as dependent variable, that is, y=ax+b, and logistic regression passes through function S Ax+b is corresponded into a hidden state p, p=S (ax+b), the value of dependent variable is then determined according to the size of p and 1-p.Here Function S is Sigmoid function:

One signal functional image of Sigmoid function is as shown in Figure 4.

Change t into ax+b, the parametric form of available Logic Regression Models:

By the effect of function S, output valve can be limited on section [0,1], p (x) can then be used to indicate Probability p (y=1 | x) (probability of y=1), i.e., when an x occurs, y is assigned to the probability of 1 that group, can set a threshold value, example Such as, 0.5, as y>0.5, this x is just grouped into 1 this kind, x is grouped into 0 this kind if y<0.5.Above-mentioned threshold value is can With adjustment, for example, it may be possible to which threshold value is set as 0.8, that is to say, that have more than 80% probability, just think this x belong to 1 this Class.

Initial model is instructed by using the operating characteristics value of the specified operating characteristics of sample object in test sample Practice, so that the coefficient value and constant value of each specified operating characteristics are obtained, to obtain object module.

Optionally, in the present embodiment, Object identifying result is determined according to determining destination probability, wherein Object identifying As a result it is used to indicate whether specified object belongs to targeted packets.

Optionally, after determining that specified object belongs to the destination probability of targeted packets, destination probability and pre- can be compared If threshold value, if destination probability is more than or equal to preset threshold, Object identifying result can be determined are as follows: default object belongs to Targeted packets can determine Object identifying result are as follows: default object is not belonging to target if destination probability is less than preset threshold Grouping.

Optionally, preset threshold, which can according to need, is set, and under default situations, preset threshold can be set as 0.5；If of less demanding to the prediction accuracy for belonging to targeted packets, preset threshold can be set as less than 0.5, for example, 0.4；If more demanding to the prediction accuracy belonged in targeted packets, preset threshold can be set greater than to 0.5, example Such as, 0.8.

Optionally, in the present embodiment, after determining Object identifying result according to determining destination probability, know in object Other result is in the case that specified object belongs to targeted packets, to determine target ip address range, wherein target ip address range packet Containing the first IP address used in specified object；It determines and belongs to targeted packets using the object of the second IP address, wherein the 2nd IP Address is included in IP address range.

Optionally it is determined that in the case that specified object belongs to targeted packets, it can be according to user's feature in targeted packets, such as IP address used by a user in fruit targeted packets has relevance, and (for example, IP address is identical, IP address is similar or IP Location is continuous), IP address diffusion can be carried out based on the IP address of specified object, determined comprising IP used in specified object The target ip address range of location.Using the object for including IP address in the target ip address range, targeted packets are also belonged to.

Optionally, it after determining that the object for using the second IP address belongs to targeted packets, can be based on using the 2nd IP The operating characteristics value of the specified operating characteristics of the object of address carries out various dimensions study to object module, so that Optimized model is joined Number.

Optionally, in the present embodiment, after determining Object identifying result according to determining destination probability, know in object Other result is in the case that specified object belongs to targeted packets, target information to be sent to processing equipment, to indicate processing equipment Business corresponding with target information is configured for specified object, wherein target information includes the mark and targeted packets of specified object Mark.

Optionally, in the case where determining that specified object belongs to targeted packets, can by comprising specify object mark and The targeted packets of the mark of targeted packets are sent to processing equipment, to indicate that processing equipment is specified object configuration and target information Corresponding business.It can be in target information:

1) the specified operating characteristics of object and the object run characteristic value of specified operating characteristics are specified；

2) the operating characteristics value of other operating characteristics of the specified object in addition to specified operating characteristics.

After receiving target information, processing equipment can specify object institute right according to the difference for belonging to targeted packets The information for including in the target information answered analyzes the behavioural habits (general character) of the object in targeted packets, is formed " targeted packets " User's portrait, to configure corresponding with targeted packets business (for example, carrying out product development, functional configuration), alternatively, in conjunction with User's portrait in the grouping of other objects, configuration and the business for being directed to targeted packets.Processing equipment receive target information it Afterwards, partial service therein can be selected to carry out for specified object according to target information, from business corresponding with targeted packets Configuration, user experience is turned up.

Through this embodiment, the object run characteristic value of the specified operating characteristics of object is specified by obtaining, wherein specified Operating characteristics are used to identify the operation information for the specified operation that specified object executes；According to object run characteristic value and target mould Type determines that specified object belongs to the probability of targeted packets, and specifies whether object belongs to target point according to determining determine the probability The purpose identified automatically to object may be implemented in group, to improve the accuracy of Object identifying.

As a kind of optional scheme, after determining Object identifying result according to determining destination probability, the above method Further include:

In the case where Object identifying result is that specified object belongs to targeted packets, target information is sent to processing and is set It is standby, to indicate that processing equipment is that specified object configures business corresponding with target information, wherein target information includes specified object Mark and targeted packets mark.

Through this embodiment, by will include that the mark of specified object and the target information of mark of targeted packets are sent to Processing equipment, to indicate that processing equipment is that specified object configures business corresponding with target information, to improve business configuration Specific aim, improve user experience.

S1 determines target ip address range in the case where Object identifying result is that specified object belongs to targeted packets, In, target ip address range includes the first IP address used in specified object；

S2 is determined and is belonged to targeted packets using the object of the second IP address, wherein the second IP address is included in IP address model In enclosing.

Through this embodiment, it is spread by IP address, to determine the more users in targeted packets, to facilitate carry out mesh Model optimization is marked, and the operating characteristics of the object in targeted packets are analyzed, and then guarantee the prediction of object module Accuracy and operating characteristics are analyzed comprehensive.

As a kind of optional scheme, before obtaining the object run characteristic value of specified operating characteristics of specified object, Method further include:

S1 obtains the first operating characteristics value for belonging to the first specified operating characteristics of first sample object of targeted packets, With the second operating characteristics value of the second specified operating characteristics of the second sample object for being not belonging to targeted packets, wherein first refers to Determine the operation information of specified operation of the operating characteristics for identifying the execution of first sample object, the second specified operating characteristics are for marking Know the operation information of the specified operation of the second sample object execution；

S2 is trained initial model using the first operating characteristics value and the second operating characteristics value, obtains object module.

Optionally, initial model is trained using the first operating characteristics value and the second operating characteristics value, obtains target Model includes:

Using the initial weight of the first operating characteristics value and the second operating characteristics value and specified operating characteristics to introductory die Type is trained, and obtains object module, wherein initial weight is according to the sample pair for executing specified operation in first sample object The quantity that the sample object of specified operation was executed in the quantity of elephant and the second sample object is calculated.

Through this embodiment, by using the operating characteristics of the specified operating characteristics for the sample object for belonging to targeted packets Value, and be not belonging to the operating characteristics values of the specified operating characteristics of the sample object of targeted packets and initial model is trained, from And object module is obtained, due to considering the operating characteristics for the sample object for belonging to targeted packets comprehensively and being not belonging to target molecule Sample object operating characteristics, it is ensured that object module determine reasonability, and then guarantee prediction result accuracy.

As a kind of optional scheme, specified operating characteristics include at least one of:

Fisrt feature, wherein fisrt feature is for identifying the behaviour that specified object operates use performed by target software Make information；

Second feature, wherein second feature is used to identify the operation for the access operation that specified object executes target network address Information；

Third feature, wherein third feature is used to identify the down operation that specified object executes first object file Operation information includes the first special key words in first object file；

Fourth feature, wherein fourth feature is used to identify the opening operation that specified object executes the second file destination Operation information includes the second special key words in the second file destination；

Fifth feature, wherein fifth feature is used to identify the operation for the opening operation that specified object executes target window Information includes third special key words in target window.

Through this embodiment, more from software features, network address feature, file characteristics etc. by analyzing different user behaviors A aspect accounts for, and to determine specified operating characteristics, to guarantee the reasonability of specified operating characteristics, and then guarantees prediction knot The accuracy of fruit.

Below in conjunction with Fig. 5 and Fig. 6, above-mentioned object identifying method is illustrated.In this example, targeted packets are " big Student ".

In conjunction with Fig. 5 and Fig. 6, object identifying method in this example the following steps are included:

S602, server filter out student users sample from user's big data.

To obtain student users sample, a collection of precision data is needed, that is, clearly know whether a collection of user is university It is raw.In this example, it is obtained by the way of questionnaire survey.Process is as follows:

Tips (note) is provided to a collection of user by channel first, user can open a page after clicking, this A page is exactly the questionnaire page, may include following problem in questionnaire: whether university student, any institute university etc..Thus sieve Select the accurate student users of a batch.

S604 is selected known users 50% (being university student and non-university student) after filtering out student users sample Data as sample set, to be calculated.

When selecting sample set, can also only select be university student user's sample as sample set, to carry out data calculation Method model training.

S606, the characteristic value of the operating characteristics of each sample in collecting sample set.

For a user, feature have very much, for designate whether be university student feature, choose it is as shown in Table 1 Feature is analyzed.

Table 1

By the characteristic course or specific API in terminal corresponding to sample, each sample is obtained to above-mentioned each feature Executive condition.

Different features is different the identification capability of " university student ", first analyzes the accuracy rate of single feature, analysis knot Fruit is as follows:

1) accessed school website: discrimination is very high, and overlay capacity also compares more.

After analyzing the operation that sample executes " accessing school website ", the sample for executing the operation has: 433, It wherein, is the sample of university student are as follows: 332, be not the sample of university student are as follows: 101, be that the number of the sample of university student is accounted for and held The ratio of the total sample number of the row operation are as follows: 76.7%.

2) dialer software: discrimination is high, and coverage rate also compares more.

After analyzing the operation that sample executes use " dialer software ", the sample for executing the operation has: 863, In, it is the sample of university student are as follows: 835, be not the sample of university student are as follows: 28, be that the number of the sample of university student accounts for execution The ratio of the total sample number of the operation are as follows: 96.8%.

3) available machine time, unused time, playtime, video time: university student and non-university student do not have significant difference.

4) title of wifi has keyword: library, class

Amount seldom, can not be verified.

5) downloading in file has corresponding keyword (operation, course, laboratory report): discrimination is higher, and coverage rate is relatively low.

The operation for executing the file of corresponding keyword (operation, course, laboratory report) " under be loaded with " to sample is analyzed Afterwards, the sample for executing the operation has: 77, wherein is the sample of university student are as follows: 60, be not the sample of university student are as follows: 17 It is a, it is that the number of the sample of university student accounts for the ratio for executing the total sample number of the operation are as follows: 77.9%.

6) the window keyword (university, institute) opened: after removing some keywords (for example, university student, university city etc.), Accuracy is general, and coverage rate is relatively more

After being analyzed the operation that sample executes " window that opening has keyword (university, institute) ", the operation is executed Sample have: 543, wherein be the sample of university student are as follows: 365, be not the sample of university student are as follows: 178, be university student Sample number account for execute the operation total sample number ratio are as follows: 67.2%.

6) other keywords (for example, specified platform names) of the window opened: even if there is accuracy rate, coverage rate also compares It is low.

7) with following keyword (class) in specific social platform process: without significant difference

The operation " using the specific social platform with special key words (class) in process " is executed to sample to be divided After analysis, the sample for executing the operation has: 912, wherein is the sample of university student are as follows: 401, be not the sample of university student are as follows: 511, be that the number of the sample of university student accounts for the ratio for executing the total sample number of the operation are as follows: 44%.

8) window opened has following keyword: operation, course, in term, laboratory report, discrimination is higher, coverage rate ratio It is lower.

The operation for executing " window that opening has special key words (operation, course, term, laboratory report) " to sample carries out After analysis, the sample for executing the operation has: 106, wherein is the sample of university student are as follows: 69, be not the sample of university student Are as follows: 37, be that the number of the sample of university student accounts for the ratio for executing the total sample number of the operation are as follows: 65.1%.

S608 is trained data algorithm model using the characteristic value of the operating characteristics of the sample of collection.

By being trained to data algorithm model (initial model), all features (or Partial Feature) is mixed, is given Each characteristic weighing value (M₁,…,M_n).Above-mentioned analysis is as the result is shown: edu.cn and dialer software this 2 features was accessed, in standard The effect of true rate and coverage rate is maximum, and weighted value is bigger relative to the weighted value of other features.

S610 predicts test sample using the data algorithm model after training.

After training is completed, obtains the weighted value of each feature, the number of other 50% user of known users is selected According to being tested.Prediction result is 1, then it is assumed that is university student, prediction result 0, then it is assumed that be non-university.

After testing, the accuracy rate of model identification university student is very high, is capable of providing the service of precisely identification university student.

S612 carries out IP diffusion according to the IP address for the user in prediction result being " university student ", identifies more universities Raw user, and then data algorithm model is optimized.

This step is optional step.In view of the network IP of each colleges and universities, there is one section of IP range, if under an IP A user A be considered as university student, all IP users under a certain section can be believed to be university student.It therefore, can be with In such a way that IP is spread, more university students are identified.And then learnt by various dimensions, continue iteration to optimal algorithm and weights It is worth (M₁,…,M_n)。

It should be noted that for the various method embodiments described above, for simple description, therefore, it is stated as a series of Combination of actions, but those skilled in the art should understand that, the present invention is not limited by the sequence of acts described because According to the present invention, some steps may be performed in other sequences or simultaneously.Secondly, those skilled in the art should also know It knows, the embodiments described in the specification are all preferred embodiments, and related actions and modules is not necessarily of the invention It is necessary.

Through the above description of the embodiments, those skilled in the art can be understood that according to above-mentioned implementation The method of example can be realized by means of software and necessary general hardware platform, naturally it is also possible to by hardware, but it is very much In the case of the former be more preferably embodiment.Based on this understanding, technical solution of the present invention is substantially in other words to existing The part that technology contributes can be embodied in the form of software products, which is stored in a storage In medium (such as ROM/RAM, magnetic disk, CD), including some instructions are used so that a terminal device (can be mobile phone, calculate Machine, server or network equipment etc.) method that executes each embodiment of the present invention.

Other side according to an embodiment of the present invention additionally provides a kind of for implementing pair of above-mentioned object identifying method As identification device, as shown in fig. 7, the device includes:

(1) first acquisition unit 702, the object run characteristic value of the specified operating characteristics for obtaining specified object, In, specified operating characteristics are used to identify the operation information for the specified operation that specified object executes；

(2) first determination units 704, for determining that specified object belongs to according to object run characteristic value and object module The destination probability of targeted packets, wherein object module is to be carried out using the sample operations characteristic value of sample object to initial model The model that training obtains；

(3) second determination units 706, for determining Object identifying result according to determining destination probability, wherein object is known Other result is used to indicate whether specified object belongs to targeted packets.

Optionally, above-mentioned object recognition equipment can be, but not limited to the process for whether belonging to targeted packets of identification object. Such as in researching and developing and promoting applied to business, for example, by taking business is researched and developed as an example, by going out to belong to the object of targeted packets, to mesh The identification characteristics of mark grouping are analyzed, and " portrait " (common characteristic) of the targeted packets of targeted packets is formed.To more precisely The hobby and demand of the object of targeted packets are positioned, to research and develop for the business of target object.

It should be noted that in the related art, personal information of the Object identifying dependent on user registration, and personal information Registration have subjectivity, there are recognition result accuracy is poor.And in this application, by the specified behaviour for obtaining specified object Make the object run characteristic value of feature, wherein specified operating characteristics are used to identify the operation for the specified operation that specified object executes Information；According to object run characteristic value and object module, determine that specified object belongs to the probability of targeted packets, and according to determining Determine the probability specifies whether object belongs to targeted packets, the purpose identified automatically to object may be implemented, due to according to right The specified operating characteristics of elephant identify object, to improve the accuracy of Object identifying.

Optionally, specified object can be obtaining using user by installing the terminal of the target software for target software The operation behavior of specified object.Specified operation can be any operation of designated user's execution.Specified operating characteristics can be used for The operation information of specified operation performed by specified object is identified, aforesaid operations information can be related any with specified operation Information.

Optionally, specified operating characteristics can also include:

1) operation information (sixth feature) of the designated user to the addition operation of target group.

2) operation information (seventh feature) of the designated user to access operation performed by network.

3) operation information (eighth feature) of the designated user to opening operation performed by target device or shutoff operation；

4) designated user believes the operation of opening operation performed by target game or target video or shutoff operation It ceases (ninth feature).

Above-mentioned each feature can refer to above-described embodiment, and this will not be repeated here.

Optionally, object module can be for determining that sample output is the mathematical algorithm model of the probability of particular value, can With the data algorithm model for classifying to sample.In object module, the object run feature to specify object is inputted Be worth (can be multiple), the domain of input can be [- ∞ ,+∞], export for specify object belonging to grouping, usually from Scattered, i.e., only limited multiple output valves.The result of output are as follows: specified object belongs to the probability of targeted packets.

Optionally it is determined that in the case that specified object belongs to targeted packets, it can be according to user's feature in targeted packets, such as IP address used by a user in fruit targeted packets has relevance, and (for example, IP address is identical, IP address is similar or IP Address is continuous), IP address diffusion can be carried out based on the IP address of specified object, determined comprising IP used in specified object The target ip address range of location.Using the object for including IP address in the target ip address range, targeted packets are also belonged to.

As a kind of optional embodiment, above-mentioned apparatus further include:

Transmission unit, for after determining Object identifying result according to determining destination probability, in Object identifying result In the case where belonging to targeted packets for specified object, target information is sent to processing equipment, to indicate that processing equipment is specified Object configures business corresponding with target information, wherein target information includes the mark of specified object and the mark of targeted packets.

As a kind of optional scheme, above-mentioned apparatus further include:

(1) third determination unit, for being known after determining Object identifying result according to determining destination probability in object Other result is in the case that specified object belongs to targeted packets, to determine target ip address range, wherein target ip address range packet Containing the first IP address used in specified object；

(2) the 4th determination units belong to targeted packets using the object of the second IP address for determining, wherein the 2nd IP Address is included in IP address range.

As a kind of optional scheme, above-mentioned apparatus further include:

(1) second acquisition unit, for before obtaining the object run characteristic value of specified operating characteristics of specified object, The the first operating characteristics value for belonging to the first specified operating characteristics of first sample object of targeted packets is obtained, and is not belonging to target Second operating characteristics value of the second specified operating characteristics of the second sample object of grouping, wherein the first specified operating characteristics are used In the operation information for the specified operation that mark first sample object executes, the second specified operating characteristics are for identifying the second sample pair As the operation information of the specified operation of execution；

(2) training unit, for being trained using the first operating characteristics value and the second operating characteristics value to initial model, Obtain object module.

Optionally, training unit includes:

Training module, for using the initial of the first operating characteristics value and the second operating characteristics value and specified operating characteristics Weight is trained initial model, obtains object module, wherein initial weight is specified according to executing in first sample object The quantity that the sample object of specified operation was executed in the quantity of the sample object of operation and the second sample object is calculated.

The another aspect of embodiment according to the present invention, additionally provides a kind of storage medium, is stored in the storage medium Computer program, wherein the computer program is arranged to execute the step in any of the above-described embodiment of the method when operation.

Optionally, in the present embodiment, above-mentioned storage medium can be set to store by executing based on following steps Calculation machine program:

S1 obtains the object run characteristic value of the specified operating characteristics of specified object, wherein specified operating characteristics are for marking Know the operation information for the specified operation that specified object executes；

S2 determines that specified object belongs to the destination probability of targeted packets according to object run characteristic value and object module, In, object module is the model being trained using the sample operations characteristic value of sample object to initial model；

S3 determines Object identifying result according to determining destination probability, wherein Object identifying result is used to indicate specified pair As if no belong to targeted packets.

S1 is specified object in Object identifying result after determining Object identifying result according to determining destination probability In the case where belonging to targeted packets, target information is sent to processing equipment, with indicate processing equipment be specified object configuration with The corresponding business of target information, wherein target information includes the mark of specified object and the mark of targeted packets.

S1 is specified object in Object identifying result after determining Object identifying result according to determining destination probability In the case where belonging to targeted packets, target ip address range is determined, wherein target ip address range includes that specified object is used The first IP address；

S1 is determined and is belonged to targeted packets using the object of the second IP address, wherein the second IP address is included in IP address model In enclosing.

S1, before obtaining the object run characteristic value of specified operating characteristics of specified object, acquisition belongs to targeted packets First sample object the first specified operating characteristics the first operating characteristics value, and be not belonging to the second sample pair of targeted packets Second operating characteristics value of the specified operating characteristics of the second of elephant, wherein the first specified operating characteristics are for identifying first sample pair As the operation information of the specified operation of execution, the second specified operating characteristics are used to identify the specified operation of the second sample object execution Operation information；

Optionally, in the present embodiment, those of ordinary skill in the art will appreciate that in the various methods of above-described embodiment All or part of the steps be that the relevant hardware of terminal device can be instructed to complete by program, the program can store in In one computer readable storage medium, storage medium may include: flash disk, read-only memory (Read-Only Memory, ROM), random access device (Random Access Memory, RAM), disk or CD etc..

Another aspect according to an embodiment of the present invention additionally provides a kind of for implementing the electricity of above-mentioned object identifying method Sub-device, as shown in figure 8, the electronic device includes: processor 802, memory 804, transmitting device 806 etc..In the memory It is stored with computer program, which is arranged to execute the step in any of the above-described embodiment of the method by computer program Suddenly.

Optionally, in the present embodiment, above-mentioned electronic device can be located in multiple network equipments of computer network At least one network equipment.

Optionally, in the present embodiment, above-mentioned processor can be set to execute following steps by computer program:

Optionally, it will appreciated by the skilled person that structure shown in Fig. 8 is only to illustrate, electronic device can also To be smart phone (such as Android phone, iOS mobile phone), tablet computer, palm PC and mobile internet device The terminal devices such as (Mobile Internet Devices, referred to as MID), PAD.Fig. 8 its not to the knot of above-mentioned electronic device It is configured to limit.For example, electronic device may also include the more or less component (such as network interface) than shown in Fig. 8, Or with the configuration different from shown in Fig. 8.

Wherein, memory 804 can be used for storing software program and module, such as the Object identifying side in the embodiment of the present invention Method and the corresponding program instruction/module of device, processor 802 by the software program that is stored in memory 804 of operation and Module realizes above-mentioned object identifying method thereby executing various function application and data processing.Memory 804 may include High speed random access memory, can also include nonvolatile memory, as one or more magnetic storage device, flash memory or Other non-volatile solid state memories.In some instances, memory 804 can further comprise long-range relative to processor 802 The memory of setting, these remote memories can pass through network connection to terminal.The example of above-mentioned network includes but is not limited to Internet, intranet, local area network, mobile radio communication and combinations thereof.

Above-mentioned transmitting device 806 is used to that data to be received or sent via a network.Above-mentioned network specific example It may include cable network and wireless network.In an example, transmitting device 806 includes a network adapter (Network Interface Controller, referred to as NIC), can be connected by cable with other network equipments with router so as to It is communicated with internet or local area network.In an example, transmitting device 806 is radio frequency (Radio Frequency, abbreviation For RF) module, it is used to wirelessly be communicated with internet.

The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.

If the integrated unit in above-described embodiment is realized in the form of SFU software functional unit and as independent product When selling or using, it can store in above-mentioned computer-readable storage medium.Based on this understanding, skill of the invention Substantially all or part of the part that contributes to existing technology or the technical solution can be with soft in other words for art scheme The form of part product embodies, which is stored in a storage medium, including some instructions are used so that one Platform or multiple stage computers equipment (can be personal computer, server or network equipment etc.) execute each embodiment institute of the present invention State all or part of the steps of method.

In the above embodiment of the invention, it all emphasizes particularly on different fields to the description of each embodiment, does not have in some embodiment The part of detailed description, reference can be made to the related descriptions of other embodiments.

In several embodiments provided herein, it should be understood that disclosed client, it can be by others side Formula is realized.Wherein, the apparatus embodiments described above are merely exemplary, such as the division of the unit, and only one Kind of logical function partition, there may be another division manner in actual implementation, for example, multiple units or components can combine or It is desirably integrated into another system, or some features can be ignored or not executed.Another point, it is shown or discussed it is mutual it Between coupling, direct-coupling or communication connection can be through some interfaces, the INDIRECT COUPLING or communication link of unit or module It connects, can be electrical or other forms.

The unit as illustrated by the separation member may or may not be physically separated, aobvious as unit The component shown may or may not be physical unit, it can and it is in one place, or may be distributed over multiple In network unit.It can select some or all of unit therein according to the actual needs to realize the mesh of this embodiment scheme 's.

It, can also be in addition, the functional units in various embodiments of the present invention may be integrated into one processing unit It is that each unit physically exists alone, can also be integrated in one unit with two or more units.Above-mentioned integrated list Member both can take the form of hardware realization, can also realize in the form of software functional units.

The above is only a preferred embodiment of the present invention, it is noted that for the ordinary skill people of the art For member, various improvements and modifications may be made without departing from the principle of the present invention, these improvements and modifications are also answered It is considered as protection scope of the present invention.

Claims

1. a kind of object identifying method characterized by comprising

Obtain the object run characteristic value of the specified operating characteristics of specified object, wherein the specified operating characteristics are for identifying The operation information for the specified operation that the specified object executes；

According to the object run characteristic value and object module, determine that the specified object belongs to the destination probability of targeted packets, Wherein, the object module is the model being trained using the sample operations characteristic value of sample object to initial model；

Object identifying result is determined according to the determining destination probability, wherein the Object identifying result is used to indicate described Whether specified object belongs to the targeted packets.

2. the method according to claim 1, wherein determining the object according to the determining destination probability After recognition result, the method also includes:

In the case where the Object identifying result is that the specified object belongs to the targeted packets, target information is sent to Processing equipment, to indicate that the processing equipment is that the specified object configures business corresponding with the target information, wherein institute Stating target information includes the mark of the specified object and the mark of the targeted packets.

3. the method according to claim 1, wherein determining Object identifying according to the determining destination probability As a result after, the method also includes:

In the case where the Object identifying result is that the specified object belongs to the targeted packets, target ip address model is determined It encloses, wherein the target ip address range includes the first IP address used in the specified object；

It determines and belongs to the targeted packets using the object of the second IP address, wherein second IP address is included in the IP In address range.

4. the method according to claim 1, wherein in the specified operating characteristics for obtaining the specified object The object run characteristic value before, the method also includes:

The the first operating characteristics value for belonging to the first specified operating characteristics of first sample object of the targeted packets is obtained, and not Belong to the second operating characteristics value of the second specified operating characteristics of the second sample object of the targeted packets, wherein described One specified operating characteristics are used to identify the operation information for the specified operation that the first sample object executes, and described second refers to Operating characteristics are determined for identifying the operation information for the specified operation that second sample object executes；

The initial model is trained using the first operating characteristics value and the second operating characteristics value, is obtained described Object module.

5. according to the method described in claim 4, it is characterized in that, using the first operating characteristics value and second operation Characteristic value is trained the initial model, obtains the object module and includes:

Use the initial weight of the first operating characteristics value and the second operating characteristics value and the specified operating characteristics The initial model is trained, the object module is obtained, wherein the initial weight is according to the first sample object The specified operation was executed in the quantity and second sample object of the middle sample object for executing the specified operation The quantity of sample object is calculated.

6. the method according to any one of claims 1 to 5, which is characterized in that the specified operating characteristics include following At least one:

Fisrt feature, wherein the fisrt feature operates use performed by target software for identifying the specified object Operation information；

Second feature, wherein the second feature is used to identify the access operation that the specified object executes target network address Operation information；

Third feature, wherein the third feature is used to identify the specified object and grasps to the downloading that first object file executes The operation information of work includes the first special key words in the first object file；

Fourth feature, wherein the fourth feature is used to identify the specified object and grasps to the opening that the second file destination executes The operation information of work includes the second special key words in second file destination；

Fifth feature, wherein the fifth feature is used to identify the opening operation that the specified object executes target window Operation information includes third special key words in the target window.

7. a kind of object recognition equipment characterized by comprising

First acquisition unit, the object run characteristic value of the specified operating characteristics for obtaining specified object, wherein described specified Operating characteristics are used to identify the operation information for the specified operation that the specified object executes；

First determination unit, for determining that the specified object belongs to mesh according to the object run characteristic value and object module Mark grouping destination probability, wherein the object module be using sample object sample operations characteristic value to initial model into The model that row training obtains；

Second determination unit, for determining Object identifying result according to the determining destination probability, wherein the Object identifying As a result it is used to indicate whether the specified object belongs to the targeted packets.

8. device according to claim 7, which is characterized in that described device further include:

Transmission unit, for after determining the Object identifying result according to the determining destination probability, in the object Recognition result is that in the case that the specified object belongs to the targeted packets, target information is sent to processing equipment, to refer to Show that the processing equipment is that the specified object configures business corresponding with the target information, wherein the target information packet Include the mark of the specified object and the mark of the targeted packets.

9. device according to claim 7, which is characterized in that described device further include:

Third determination unit, for after determining Object identifying result according to the determining destination probability, in the object Recognition result is in the case that the specified object belongs to the targeted packets, to determine target ip address range, wherein the mesh Marking IP address range includes the first IP address used in the specified object；

4th determination unit belongs to the targeted packets using the object of the second IP address for determining, wherein the 2nd IP Address is included in the IP address range.

10. device according to claim 7, which is characterized in that described device further include:

Second acquisition unit, for the object run characteristic value in the specified operating characteristics for obtaining the specified object Before, the first operating characteristics value for belonging to the first specified operating characteristics of first sample object of the targeted packets is obtained, and It is not belonging to the second operating characteristics value of the second specified operating characteristics of the second sample object of the targeted packets, wherein described The operation information of the specified operation of the first specified operating characteristics for identifying the first sample object execution, described second Specified operating characteristics are used to identify the operation information for the specified operation that second sample object executes；

Training unit, for being carried out using the first operating characteristics value and the second operating characteristics value to the initial model Training, obtains the object module.

11. device according to claim 10, which is characterized in that training unit includes:

Training module, for special using the first operating characteristics value and the second operating characteristics value and the specified operation The initial weight of sign is trained the initial model, obtains the object module, wherein the initial weight is according to It was executed in first sample object in the quantity and second sample object of the sample object of the specified operation and executed institute The quantity for stating the sample object of specified operation is calculated.

12. a kind of storage medium, which is characterized in that be stored with computer program in the storage medium, wherein the computer Program is arranged to execute method described in any one of claim 1 to 6 when operation.

13. a kind of electronic device, including memory and processor, which is characterized in that be stored with computer journey in the memory Sequence, the processor are arranged to execute side described in any one of claim 1 to 6 by the computer program Method.