Device Fingerprint Classification

  1. Active device fingerprint
  2. Passive device fingerprint
  3. Hybrid device fingerprint technology

A school of device fingerprinting

Unlike traditional device identification methods, which rely on a single source of information, the new generation of device fingerprint technology uses more information to identify devices. It collects feature information of terminal devices through the network. On the basis of analysis and identification, it assigns a unique device fingerprint ID to each group of feature information collected from the terminal device to identify the terminal device. From the technical method of implementation, it can be divided into active device fingerprint and passive device fingerprint two technical routes.

Active device fingerprint

Active device fingerprint technology generally adopts JS code or SDK to proactively collect device-related information and features on the client and identify different devices by identifying these features. General device feature information is as follows:

ø Browser features, including UA, version, OS, plug-in configuration, Canvas features, etc.

Sensor characteristics of the device, such as microphone, acceleration sensor characteristics, etc.

ø Features of the device OS, such as jailbreak or not;

ø Device configuration, such as network configuration, system Flash configuration, etc.

The active device fingerprint algorithm combines the information and obtains a device fingerprint ID using a specific hash algorithm as the unique identifier of the device. In addition, considering the stability of the device fingerprint, the device fingerprint ID is stored for a long time in combination with other persistent storage technologies.

Passive device fingerprint

In the process of communication between a terminal device and a server, passive device fingerprint technology extracts feature sets related to the OS, protocol stack and network state of the terminal device from the OSI layer 7 protocol of data packets, and identifies and tracks specific terminal devices by combining machine learning algorithms.

Compared with the active device fingerprint technology, the passive device fingerprint does not need to embed THE JS code or SDK on the device terminal to collect device feature information. The required device features are extracted from the data packets sent by the terminal device, which is why it is called “passive”.

Active device fingerprinting, which is relatively straightforward, is what most device fingerprinting vendors in the industry provide. Passive device fingerprint technology is still in the initial stage of popularization because it requires machine learning technology to build device fingerprint classification algorithm model, which has high technical barriers.

Hybrid device fingerprint technology

Both active device fingerprinting and passive device fingerprinting have their own shortcomings and limitations, which limit their application scope:

ø For active device fingerprints, the biggest limitation is that the device features collected are separated in the Web domain and App domain, that is, the device features collected are different in different browsers. Therefore, the active device fingerprint will generate different device FINGERPRINT ids in different browsers and between Web and App. Therefore, the device association between Web and App and between different browsers cannot be realized. Another disadvantage of active device fingerprints is that they are less adversarial in anti-fraud scenarios due to their reliance on client-side code.

ø Passive device fingerprint technology can well solve the problem of device association between Web and App and between different browsers. However, because it requires complex machine learning algorithms to identify devices, it consumes more processing resources and has a longer response delay than the active device fingerprint.

Hybrid device fingerprint technology overcomes the inherent shortcomings of active device fingerprint and passive device fingerprint technology, and expands the application range of device fingerprint technology while accurately identifying devices. For Web pages or application scenarios inside apps, active device fingerprint technology can be used to quickly identify devices. For device identification, comparison and association between different browsers and between Web pages and App, passive device fingerprint technology can be used to achieve.

The core technology of device fingerprint

Device fingerprint technology is a comprehensive system engineering, and it needs to cross a series of technical thresholds to master this technology, which is why there are not many providers of this technology in the market even though the application scenarios are broad. This paper introduces two key technologies of device fingerprint, large-scale online probabilistic record association and machine learning, so that we can have an overall understanding of device fingerprint.

Ali. – Device fingerprint access

  • Help.aliyun.com/document_de…

Ali device fingerprint access demo

Obtain the device fingerprint token


      
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="Width = device - width, initial - scale = 1.0">
    <meta http-equiv="X-UA-Compatible" content="ie=edge">
    <title>Ali device Fingerprint</title>
    <! -- <script type="text/javascript" src="https://g.alicdn.com/AWSC/AWSC/awsc.js"></script> -->
</head>
<script>
    function createScript({ url, isAsync }, cb, attrs) {
        var scriptNode = document.createElement('script')
        scriptNode.type = 'text/javascript'
        isAsync && (scriptNode.defer = true, scriptNode.async = true)
        if (attrs) {
            for (let attr in attrs) {
                scriptNode[attr] = attrs[attr]
            }
        }
        scriptNode.src = url;
        document.body.appendChild(scriptNode);
        if (cb) {
            if (window.ActiveXObject || "ActiveXObject" in window) { // Check if it is Ie
                if (scriptNode.readyState) { // Check whether readyState is supported
                    scriptNode.onreadystatechange = function () {
                        if (this.readyState == "loaded" || this.readyState == "complete") {
                            // IE 10 and below
                            cb && cb()
                        }
                    }
                } else {
                    scriptNode.onload = function () {
                        / / ie11 and Edge
                        cb && cb()
                    }
                }
            } else {    / / not ie
                scriptNode.onload = function () {
                    // Non-IE browser
                    cb && cb()
                }
            }
        }
        console.log('scriptNode', scriptNode)
        return scriptNode
    };
    function getTokens() {
        var uabModule;
        var webUmidToken;
        // Man-machine recognition module, only need to initialize once
        AWSC.use("uab".function (state, uab) {
            if (state === "loaded") {
                uabModule = uab;
                var uaToken = uabModule.getUA();
                console.log("uaToken", uaToken)
            }
        });
        // Device fingerprint module, get device token, only need to initialize once
        AWSC.use("um".function (state, um) {
            if (state === "loaded") {
                um.init({
                    appName: 'saf-aliyun-com',},function (initState, result) {
                    if (initState === 'success') {
                        webUmidToken = result.tn;
                        console.log("webUmidToken", webUmidToken) } }); }}); };window.onload = function () {
        createScript({ url: 'https://g.alicdn.com/AWSC/AWSC/awsc.js' }, getTokens);
    }

</script>

<body>

    <div>Device fingerprinting</div>
</body>
<script>

</script>

</html>
Copy the code

The above code will do call (ynuf.aliapp.org/service/um…. Combine uaToken and webUmidToken with other parameters

Some applications in the risk control field

  • Reference on zhihu: www.zhihu.com/question/60…

reference

  • Blog.csdn.net/kobejayandy…

conclusion

  • Most device fingerprinting vendors offer active device fingerprinting
  • Passive device fingerprinting technology is in its infancy.
  • Hybrid device fingerprint technology solves the problem of device identification and comparison between Web pages and App