CN114390026B - Identity information tracing method, device, equipment, storage medium and program - Google Patents

Abstract

The embodiment of the invention provides an identity information tracing method, an identity information tracing device, identity information tracing equipment, an identity information tracing storage medium and an identity information tracing program. The method comprises the following steps: extracting feature information of a dead website or application program APP; according to the characteristic information, acquiring a historical access record associated with the invalid website or APP from the cached access record; acquiring tracing clue information according to the history access record; the trace source cue information comprises at least one of the following: APP download address, call link of third party platform, page keyword, website type, and associated domain name information; and acquiring the identity information of the target personnel according to the traceability cue information. In the scheme, under the condition that the website or the APP fails, the identity information of the personnel implementing the illegal case through the website or the APP can still be traced.

Description

Identity information tracing method, device, equipment, storage medium and program

Technical Field

The present invention relates to the field of computer technology, and in particular to an identity information tracing method, device, equipment, storage medium and program.

Background technique

With the rapid development of social economy and science and technology, especially the widespread application of new technologies such as big data and artificial intelligence, the means of committing crimes through the Internet are constantly being updated, and the number of illegal cases is growing, seriously affecting people's lives and causing huge economic losses to individuals and society.

At present, in cases of crimes committed through the Internet, it is often the case that the website or application APP can be accessed normally in the initial stage of user use, but becomes inactivated and inaccessible after a period of time. That is, after successfully defrauding the victim's money, the suspect will take the approach of closing the website, APP download address, and server involved in the case to evade investigation. Therefore, how to trace the identity information of people who commit crimes through the Internet when the website or APP is inactivated is an important issue that needs to be urgently resolved in the industry.

Summary of the invention

In view of the problems in the prior art, embodiments of the present invention provide an identity information tracing method, apparatus, device, storage medium and program.

Specifically, the embodiment of the present invention provides the following technical solutions:

In a first aspect, an embodiment of the present invention provides an identity information tracing method, comprising:

Extract feature information of invalid websites or applications;

According to the characteristic information, obtaining historical access records associated with the invalid website or APP from the cached access records;

Obtaining tracing clue information according to the historical access records; the tracing clue information includes at least one of the following: APP download address, call link of a third-party platform, page keywords, website type, and associated domain name information;

The identity information of the target person is obtained based on the traceability clue information.

Optionally, acquiring, according to the characteristic information, a historical access record associated with the invalid website or APP from the cached access record includes:

According to the characteristic information, searching for historical access records associated with the invalid website or APP from the access records cached in the Internet space mapping system; or,

According to the characteristic information, historical access records of other surviving websites or APPs associated with the characteristic information are obtained, and the historical access records of the surviving websites or APPs are used as historical access records associated with the invalid website or APP.

Optionally, obtaining the tracing clue information according to the historical access record includes:

Obtaining web page code according to the historical access record;

The key information of the webpage code is extracted, and the extracted key information is associated to obtain the tracing clue information.

Optionally, the extracted key information is subjected to association processing to obtain the tracing clue information, including:

If the historical access records associated with the invalid website or APP include historical access records of multiple websites, determine whether there is a target website among the multiple websites that meets at least one of the following conditions with the invalid website: having the same keywords, having the same APP download address, having the same third-party account, or having the same DNS domain name system; wherein the same third-party account includes: the same account of the same third-party platform or different accounts of the same third-party platform;

If so, the tracing clue information is obtained based on the characteristic information of the target website.

Optionally, the extracted key information is subjected to association processing to obtain the tracing clue information, including:

If there are multiple surviving websites, determine whether there is a target website among the multiple surviving websites that meets at least one of the following conditions with the invalid website: having the same keywords, having the same APP download address, having the same third-party account, or having the same DNS domain name system; wherein the same third-party account includes: the same account of the same third-party platform or different accounts of the same third-party platform;

If so, the tracing clue information is obtained based on the characteristic information of the target website.

Optionally, extracting key information of the webpage code includes:

Through regular matching, the APP information included in the webpage code is identified, and the download address of the APP is obtained.

Optionally, the characteristic information includes at least one of the following: domain name, IP address, website keyword, request address, logo information, contact information and IOC information.

In a second aspect, an embodiment of the present invention further provides an identity information tracing device, including:

An acquisition module is used to extract characteristic information of invalid websites or application programs;

The acquisition module is further used to acquire, from the cached access records, historical access records associated with the invalid website or APP according to the characteristic information;

A processing module, configured to obtain tracing clue information according to the historical access records; the tracing clue information includes at least one of the following: APP download address, call link of a third-party platform, page keywords, website type, and associated domain name information;

The processing module is also used to obtain the identity information of the target person based on the tracing clue information.

In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the identity information tracing method described in the first aspect are implemented.

In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the identity information tracing method as described in the first aspect.

In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the identity information tracing method described in the first aspect.

The identity information tracing method, apparatus, equipment, storage medium and program provided by the embodiments of the present invention extract feature information based on an invalid website or APP, and then obtain relevant historical access records based on the extracted feature information, and obtain tracing clue information based on the historical access records. The tracing clue information includes at least one of the following: APP download address, call link of a third-party platform, page keywords, website type, and associated domain name information. Finally, the identity information of the target person is traced back, and there is no need to rely on the survival of the website or APP. In the case of an invalid website or APP, the identity tracing of the target person who has committed a crime through the website or APP is realized, and the complexity is low and the efficiency is high.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a schematic diagram of a flow chart of an embodiment of a method for tracing identity information provided by the present invention;

FIG2 is a schematic diagram of an invalid website interface according to an embodiment of the identity information tracing method provided by the present invention;

FIG3 is a schematic diagram of a web page interface of an embodiment of the identity information tracing method provided by the present invention;

FIG4 is one of the schematic diagrams of web page code of an embodiment of the identity information tracing method provided by the present invention;

FIG5 is a second schematic diagram of a web page interface of an embodiment of the identity information tracing method provided by the present invention;

FIG6 is a third schematic diagram of a web page interface of an embodiment of the identity information tracing method provided by the present invention;

FIG. 7 is a second schematic diagram of web page code of an embodiment of the identity information tracing method provided by the present invention;

FIG8 is a schematic diagram of search results of an embodiment of a method for tracing identity information provided by the present invention;

FIG9 is a schematic diagram of a customer service interface of an embodiment of an identity information tracing method provided by the present invention;

FIG10 is a flow chart of another embodiment of the identity information tracing method provided by the present invention;

11 is a schematic diagram of the structure of an embodiment of an identity information tracing device provided by the present invention;

FIG. 12 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

First, the terms of the embodiments of the present invention are explained:

Invalid website or application APP: The service of the website or APP has been closed and users cannot access it normally.

Internet Space Mapping System: A system that regularly scans the entire Internet assets through a scanner and saves the scan results to provide users with asset search services.

The identity information tracing method of the embodiment of the present invention extracts feature information based on an invalid website or APP, and then obtains relevant historical access records based on the extracted feature information, and obtains clues based on the historical access records, such as APP download addresses, call links of third-party platforms, page keywords, website types, associated domain name information, etc. Finally, the identity information of the target person is traced back, and there is no need to rely on the survival of the website or APP. In the case that the website or APP is invalid, the identity tracing of the target person who committed a crime through the website or APP is realized, and the complexity is low and the efficiency is high.

The technical solution of the present invention is described in detail with reference to specific embodiments in conjunction with Figures 1 to 10. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

FIG1 is a flow chart of an embodiment of an identity information tracing method provided by an embodiment of the present invention.

As shown in FIG1 , the method provided by the embodiment of the present invention includes:

Step 101: extract feature information of invalid websites or application programs APP;

Specifically, feature information is extracted from the invalid website address or APP as a clue entry. Optionally, feature information can be extracted from the access record and/or log information of the invalid website or APP. Among them, the invalid website or APP may be a website or APP that has committed illegal cases through the website or APP, especially financial illegal cases. The access record and/or log information of the invalid website or APP can be obtained from the data cached by major Internet space mapping systems based on the website address of the invalid website or the download address of the APP. After obtaining the access record and/or log information of the invalid website or APP, for example, feature information can be extracted from it by regular matching, and the feature information includes but is not limited to at least one of the following: domain name, IP address, website keywords, request address at runtime, logo information, contact information, Inversion of Control (IOC) information, etc. Figure 2 shows an invalid website.

The website keywords are, for example, "XX Group", "daily income", "investment reward" etc. as shown in FIG3. The request address at runtime may be the address requested to the server when the website is running.

IOC refers to dependency injection, which means that a certain dependency is dynamically injected into an object by the IOC container during runtime.

Step 102: Obtain historical access records associated with the invalid website or APP from the cached access records according to the characteristic information;

Specifically, the characteristic information can be used to find the retained historical access records related to the invalid website or APP in the access records cached by major Internet space mapping systems (as shown in Figure 4, with a1.apk), and the invalid website or APP can be traced back through the historical access records.

For example, new clue information can be extracted from relevant historical access records to trace the identity of the relevant target person. New clue information can be, for example, APP download addresses, keywords, call links, or associated domain name information.

Alternatively, the characteristic information can be used to expand the line of other similar surviving websites or apps of the relevant target person on the Internet, and continue to trace the websites or apps that have not been closed.

The websites shown in Figures 5 and 6 are basically similar except for the website addresses and website names.

Step 103: Obtain tracing clue information based on historical access records; the tracing clue information includes at least one of the following: APP download address, call link of a third-party platform, page keywords, website type, and associated domain name information;

Specifically, relevant historical access records are analyzed to obtain tracing clue information, including at least one of the following: APP download address, call link of third-party platform, page keywords, website type, and associated domain name information.

As shown in FIG. 7 , the website has an APP download address. As shown in FIG. 6 , the website page displays customer service. For example, the customer service is a third-party platform. Analysis of the webpage code shows that the call link of the third-party platform is “https://kefu.mnkefu.com/im297176ae”.

As shown in FIG6 , the website has page keywords: certain group, investment incentive, commission, income, etc.

As shown in FIG6 , the website has the keyword “something”, and by searching for the keyword, relevant domain name information can be found, such as “zyfd2582.com, zyfd7513.com, zyfd8816.com, zyfd282.com”.

As shown in FIG8 , by searching for the keyword, search results of other websites are found, and the other websites are related to the invalid website type.

For example, through the URLs of these websites (such as including the /anquan/ field), it can be analyzed that these website systems belong to stock allocation systems.

Step 104: Obtain the identity information of the target person based on the tracing clue information.

Specifically, the target person may be a person who has committed a crime through the Internet. The identity information of the target person may be further obtained based on the tracing clue information obtained in the above steps.

For example, the user registered identity information when logging into some websites before, and paid when the APP download link was provided (for example, obtaining the APP download link from other platforms), etc. The tracing clues include the contact information on the website, IP address, call link of the third-party platform, APP download address, associated domain name information, etc. For example, the user login IP and user login identity information can be obtained from the associated domain name information, such as real name, contact information, ID number, etc., and the payment record when downloading the APP can be obtained based on the APP download address.

Alternatively, you can retrieve identity information from a third-party platform.

The method of this embodiment extracts feature information based on an invalid website or APP, and then obtains relevant historical access records based on the extracted feature information, and obtains tracing clue information based on the historical access records. The tracing clue information includes at least one of the following: APP download address, call link of a third-party platform, page keywords, website type, and associated domain name information. Finally, the identity information of the target person is traced back, and there is no need to rely on the survival of the website or APP. In the case that the website or APP is invalid, the identity tracing of the target person who has committed a crime through the website or APP is realized, with low complexity and high efficiency.

In one embodiment, step 102 may be implemented in the following ways:

a method:

Based on the characteristic information, historical access records associated with invalid websites or apps are searched from the access records cached in the Internet space mapping system.

Specifically, the characteristic information can be used to find the historical access records related to the invalid website or APP in the access records cached by major Internet space mapping systems (as shown in Figure 4, with a1.apk), and the invalid website or APP can be traced through the historical access records. Then, the tracing clue information can be obtained based on the historical access records.

another way:

According to the characteristic information, historical access records of other surviving websites or apps associated with the characteristic information are obtained, and the historical access records of the surviving websites or apps are used as historical access records associated with the invalid website or app.

Specifically, based on the feature information extracted from the invalid website or APP, we can expand the line to other similar surviving websites or APPs of the relevant target person on the Internet, and continue to trace the websites or APPs that have not been closed.

The websites shown in Figures 5 and 6 are basically similar except for the website addresses and website names.

The historical access records of other surviving websites or apps are used as the historical access records of the invalid website or app, and then the tracing clue information is obtained based on the historical access records.

In the above implementation, if the invalid website or APP has historical access records, the corresponding historical access records are obtained. If there are no historical access records, the historical access records of other associated surviving websites or APPs can be obtained. The implementation complexity is relatively low, and it is possible to trace the identity of the target person who committed a crime through the website or APP when the website or APP is invalid.

In one embodiment, step 103 may be implemented as follows:

Get the web page code based on historical access records;

The key information of the web page code is extracted, and the extracted key information is associated to obtain the traceability clue information.

Specifically, based on historical access records, the web page code is called to extract key information of the web page code, such as website keywords, APP information, domain names, IP addresses, etc.

For example, part of the webpage code is as follows:

if(isweixin()){

//If yes, open

}

//Otherwise open

else{

if(xxx){attr("","/download/XXX Group.apk");}

if(xxx){attr("","/download/XXX Group.apk");}

if(xxx){attr("","https://www.huox.net/7975");}

}

In the above code, XX Group.apk is an Android APP, /download/XX Group.apk represents the download of the Android APP, and the code “www.huox.net/7975” represents the download address of the Apple APP.

Furthermore, the extracted key information is associated and processed to obtain traceability clue information.

The key information extracted from the historical access records of multiple websites can be associated and processed. For example, multiple websites are deployed for speed and convenience, and some information will only be simply modified or not modified at all, such as the same keywords in Figures 5 and 6.

For example, different website addresses (zyfd7711.com, hjjt381.com) have the same APP download address. The probability of different groups using the same APP is very low, so it can be inferred that they are the same group.

For example, different websites have third-party customer service, as shown in Figures 3 and 9. Figure 9 is a chat interface of online customer service, based on which the web page code can be viewed, and based on the web page code, a call link to the third-party customer service platform can be obtained.

Optionally, extracting key information from the webpage code may include:

Through regular matching, the APP information included in the web page code is identified, and the download address of the APP is obtained.

Specifically, as shown in Figure 7, ".apk" is matched in the web page code, and the file with this suffix is an APP. Then, a download link is found in the web page code, and the download link is accessed through a browser to obtain the identity information of the target person, or related log information is extracted based on the download link to obtain the identity information of the target person.

The tracing clue information includes the download address of the APP.

Optionally, if the website where the APP download address is located is closed, you can use other applications that can cache user files (such as network disk, etc.) to download. The principle is: when the user downloads the file, this type of application will cache the user file so that other users can speed up the download.

In one embodiment, the step of “performing correlation processing on the extracted key information to obtain tracing clue information” includes:

If the historical access records associated with the invalid website or APP include historical access records of multiple websites, determine whether there is a target website among the multiple websites that meets at least one of the following conditions with the invalid website: having the same keywords, having the same APP download address, having the same third-party account, or having the same DNS domain name system; wherein the same third-party account includes: the same account of the same third-party platform or different accounts of the same third-party platform;

If so, the tracing clue information is obtained based on the characteristic information of the target website.

Specifically, as shown in FIG. 5 and FIG. 6 , it is assumed that the website shown in FIG. 5 is an invalid website, and the website in FIG. 6 is a website obtained through feature information of the invalid website, and the two websites have the same keywords.

When the same gang deploys multiple websites, they will simply modify or not modify some non-important information for the sake of speed and convenience. For example, Figure 5 and Figure 6 have the same keywords.

Among them, having the same DNS domain name system, for example, calls the same DNS server address for different websites.

As shown in Figures 5 and 6, there is a situation where two websites with the same website page information (such as the same website framework, page layout, and APP download address) but different domain names use the same third-party customer service account.

Furthermore, based on the characteristic information of other target websites related to the invalid websites or apps, the tracing clue information is obtained.

In another embodiment, the step of “performing correlation processing on the extracted key information to obtain tracing clue information” includes:

If there are multiple surviving websites, determine whether there is a target website among the multiple surviving websites that meets at least one of the following conditions with the invalid website: having the same keywords, having the same APP download address, having the same third-party account, or having the same DNS domain name system; wherein the same third-party account includes: the same account of the same third-party platform or different accounts of the same third-party platform;

If so, the tracing clue information is obtained based on the characteristic information of the target website.

Specifically, as shown in FIG. 5 and FIG. 6 , it is assumed that the website shown in FIG. 5 is an invalid website, and the website in FIG. 6 is another surviving website associated with the invalid website, and the two websites have the same keywords.

When the same gang deploys multiple websites, they will simply modify or not modify some non-important information for the sake of speed and convenience. For example, Figure 5 and Figure 6 have the same keywords.

Or, the above two websites have the same APP download address, and the probability of different groups using the same APP is very low, so it can be inferred that they are the same group.

Furthermore, based on the characteristic information of the surviving target website, the tracing clue information of the invalid website or APP is obtained.

In the above implementation, if there are historical visit records of multiple websites, in order to improve the tracing efficiency and accuracy, it can be determined whether there is a target website among the multiple websites that meets at least one of the following conditions with the invalid website: having the same keywords, having the same APP download address, having the same third-party account or having the same DNS domain name system. Finally, based on the characteristic information of the target website, the tracing clue information of the invalid website or APP is obtained.

In one embodiment, as shown in FIG10 , the method includes:

Extract features based on invalid websites or apps;

Furthermore, based on the extracted features, historical access records are obtained in the following two ways:

Method 1: Find relevant historical access records through the Internet spatial mapping system;

Method 2: Find the historical access records of other similar surviving websites or apps;

Based on historical access records, key tracing clues are obtained;

Finally, confirm the identity information.

For example, the website code and other associated domain names in the cached historical access records can be used to find the call link, APP download address, and related domain name information of the third-party platform involved in the case. Relevant data can be retrieved from the third-party platform based on the tracing clue information. The retrieved data information includes, for example, user account information, such as real name, contact information, ID number, user login IP, payment record, etc.

When conducting data analysis, the identity of the target person can be determined by comprehensive comparison of multiple related domain names, call links of third-party platforms, user login IPs, and payment record verification information.

Technical details of the analysis:

1. The verification information of different websites shows that the same IP has login records at a close time.

2. The same person appears in different verification information.

3. The identity information of the payers at different sites is the same.

4. The same contact information exists in different verification information, such as the same email address and mobile phone number.

The identity information tracing device provided by the present invention is described below. The identity information tracing device described below and the identity information tracing method described above can be referenced to each other.

FIG11 is a schematic diagram of the structure of an embodiment of an identity information tracing device provided by the present invention. As shown in FIG11 , the identity information tracing device provided by this embodiment includes:

An acquisition module 210 is used to extract characteristic information of an invalid website or application program APP;

The acquisition module 210 is further configured to acquire, from the cached access records, historical access records associated with the invalid website or APP according to the characteristic information;

The processing module 220 is used to obtain the tracing clue information according to the historical access record; the tracing clue information includes at least one of the following: APP download address, call link of the third-party platform, page keyword, website type, and associated domain name information;

The processing module 220 is further used to obtain the identity information of the target person according to the tracing clue information.

Optionally, the acquisition module 210 is specifically configured to:

According to the characteristic information, searching for historical access records associated with the invalid website or APP from the access records cached in the Internet space mapping system; or,

According to the characteristic information, historical access records of other surviving websites or APPs associated with the characteristic information are obtained, and the historical access records of the surviving websites or APPs are used as historical access records associated with the invalid website or APP.

Optionally, the processing module 220 is specifically configured to:

Obtaining web page code according to the historical access record;

The key information of the webpage code is extracted, and the extracted key information is associated to obtain the tracing clue information.

Optionally, the processing module 220 is specifically configured to:

If the historical access records associated with the invalid website or APP include historical access records of multiple websites, determine whether there is a target website among the multiple websites that meets at least one of the following conditions with the invalid website: having the same keywords, having the same APP download address, having the same third-party account, or having the same DNS domain name system; wherein the same third-party account includes: the same account of the same third-party platform or different accounts of the same third-party platform;

If so, the tracing clue information is obtained based on the characteristic information of the target website.

Optionally, the processing module 220 is specifically configured to:

If there are multiple surviving websites, determine whether there is a target website among the multiple surviving websites that meets at least one of the following conditions with the invalid website: having the same keywords, having the same APP download address, having the same third-party account, or having the same DNS domain name system; wherein the same third-party account includes: the same account of the same third-party platform or different accounts of the same third-party platform;

If so, the tracing clue information is obtained based on the characteristic information of the target website.

Optionally, the processing module 220 is specifically configured to:

Through regular matching, the APP information included in the webpage code is identified, and the download address of the APP is obtained.

Optionally, the characteristic information includes at least one of the following: domain name, IP address, website keyword, request address, logo information, contact information and IOC information.

The device of the embodiment of the present invention is used to execute the method in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be described in detail here.

Here is an example:

FIG12 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG12, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the following method, which includes: extracting feature information of an invalid website or application APP; according to the feature information, obtaining historical access records associated with the invalid website or APP from the cached access records; according to the historical access records, obtaining tracing clue information; the tracing clue information includes at least one of the following: APP download address, call link of a third-party platform, page keywords, website type, and associated domain name information; according to the tracing clue information, obtaining the identity information of the target person.

In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the identity information tracing method provided in the above embodiments includes: extracting characteristic information of an invalid website or application APP; based on the characteristic information, obtaining historical access records associated with the invalid website or APP from cached access records; based on the historical access records, obtaining tracing clue information; the tracing clue information includes at least one of the following: APP download address, call link of a third-party platform, page keywords, website type, and associated domain name information; and obtaining the identity information of the target person based on the tracing clue information.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. The identity information tracing method is characterized by comprising the following steps of:

extracting feature information of a dead website or application program APP;

According to the characteristic information, acquiring a historical access record associated with the invalid website or APP from the cached access record; the obtaining, from the cached access records, a historical access record associated with the failed website or APP, including: according to the characteristic information, acquiring historical access records of other survival websites or APP related to the characteristic information, and taking the historical access records of the survival websites or APP as the historical access records related to the invalid websites or APP;

Acquiring tracing clue information according to the history access record; the trace source cue information comprises at least one of the following: APP download address, call link of third party platform, page keyword, website type, and associated domain name information;

And acquiring the identity information of the target personnel for implementing the illegal acting according to the traceability clue information.

2. The method for tracing identity information according to claim 1, wherein the step of obtaining, from the cached access records, a history access record associated with the failed website or APP according to the characteristic information comprises:

and searching historical access records associated with the invalid website or APP from access records cached in the Internet spatial mapping system according to the characteristic information.

3. The method for tracing identity information according to claim 1 or 2, wherein the obtaining tracing cue information according to the history access record includes:

Acquiring a webpage code according to the history access record;

and extracting the key information of the webpage codes, and carrying out association processing on the extracted key information to obtain the tracing cue information.

4. The method for tracing identity information according to claim 3, wherein the performing association processing on the extracted key information to obtain the tracing cue information includes:

If the historical access records associated with the failed website or APP comprise the historical access records of a plurality of websites, determining whether target websites meeting at least one of the following conditions with the failed website exist in the websites: have the same keyword, have the same APP download address, have the same third party account number, or have the same DNS domain name system; wherein the same third party account number comprises: the same account number of the same third party platform or different account numbers of the same third party platform;

If yes, acquiring the tracing clue information based on the characteristic information of the target website.

5. The method for tracing identity information according to claim 3, wherein the performing association processing on the extracted key information to obtain the tracing cue information includes:

If the number of the surviving websites is a plurality, determining whether target websites meeting at least one of the following conditions with the failed websites exist in the surviving websites: have the same keyword, have the same APP download address, have the same third party account number, or have the same DNS domain name system; wherein the same third party account number comprises: the same account number of the same third party platform or different account numbers of the same third party platform;

If yes, acquiring the tracing clue information based on the characteristic information of the target website.

6. The method for tracing identity information according to claim 3, wherein the extracting key information of the web page code comprises:

And identifying APP information included in the webpage codes in a regular matching mode, and acquiring the downloading address of the APP.

7. The identity information tracing method according to claim 1 or 2, wherein the characteristic information comprises at least one of the following: domain name, IP address, website keywords, request address, flag information, contact information, and IOC information.

8. An identity information traceability device, comprising:

the acquisition module is used for extracting the characteristic information of the invalid website or application program APP;

The acquisition module is further used for acquiring a history access record associated with the invalid website or APP from the cached access record according to the characteristic information; the obtaining, from the cached access records, a historical access record associated with the failed website or APP, including: according to the characteristic information, acquiring historical access records of other survival websites or APP related to the characteristic information, and taking the historical access records of the survival websites or APP as the historical access records related to the invalid websites or APP;

The processing module is used for acquiring tracing cue information according to the history access record; the trace source cue information comprises at least one of the following: APP download address, call link of third party platform, page keyword, website type, and associated domain name information;

And the processing module is also used for acquiring the identity information of the target personnel for implementing the illegal acting according to the traceability clue information.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the identity information tracing method of any one of claims 1 to 7 when the program is executed by the processor.

10. A non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor performs the steps of the identity information tracing method of any one of claims 1 to 7.