Full-platform detection system and identification method

Abstract

The invention provides a full-platform detection system and an identification method, and relates to the field of data detection systems, and the full-platform detection system and the identification method comprise a USB interface module, an analysis and judgment module, a dynamic adjustment module, a driving adaptation module, a data management module, a data interaction module and a security encryption module. By means of the technology, full-process automatic processing from device insertion to final data transmission is achieved, by means of the technology, the storage device can be comprehensively compatible with Windows, Android, iOS, Mac OS and Linux systems, iOS and Mac OS of apple ecology or Windows, Android and Linux of non-apple ecology can easily deal with the conditions, data safe storage and transfer become convenient, and the method is suitable for large-scale popularization and application. The universality and convenience of the storage device are improved, the operation steps of a user are simplified, the interoperability and safety between the device and different operation systems are improved, and the method is suitable for wide application scenes, so that the requirements of the user for backing up and transferring data between different platforms are met.

Description

Technical Field

[0001] The present invention relates to the field of data detection systems, and in particular to a full-platform detection system and an identification method. Background Art

[0002] With the continuous advancement of technology and the diversification of applications, the functions of terminal devices (especially handheld devices) are becoming increasingly powerful. These terminal devices are equipped with different hardware and operating system platforms. The mainstream terminal user operating system platforms on the current market mainly include Windows, Linux, Android, iOS and Mac OS. As people's needs continue to grow, a person may have multiple terminal devices of different platforms, which leads to a sharp increase in the amount of data stored on the terminal devices. Therefore, the built-in memory of the terminal device often cannot meet the growing storage needs. Users need to back up or transfer the data of a terminal device to another terminal of a different platform for storage, which requires USB smart storage devices to back up or transfer data; However, most storage devices on the market currently have serious compatibility issues. Many storage devices only support one or two platforms, such as only supporting Windows computers but not Mac computers and mobile phone systems, or only supporting Android phones but not iOS phones. Even on supported platforms, storage devices may have major compatibility issues and can usually only be used on specific system versions. For example, although some storage devices claim to support Mac OS, due to differences in security levels and features between different versions of Mac OS, the management software (APP) of USB smart storage devices cannot be installed or used normally, thus limiting the versatility and convenience of the storage devices.

[0003] Therefore, it is necessary to provide a new full-platform detection system and identification method to solve the above technical problems. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a full-platform detection system and identification method.

[0005] The full-platform detection system provided by the present invention comprises: a USB interface module, which is used for power-on initialization and self-test of the device, and is connected to the terminal interfaces of various operating systems for information exchange; The analysis and judgment module is used for preliminary instruction screening and execution, and determines the type of operating system based on the instruction operation sequence; A dynamic adjustment module that continuously monitors instructions, tracks the quality of recognition decisions, and updates confidence scores; A driver adaptation module, for preparing a driver program to load the most matching driver for a high confidence situation according to the operating system type preliminarily determined by the analysis and judgment module and the confidence score evaluated by the dynamic adjustment module; Data management module for automatically selecting the most suitable file format for the operating system; A data interaction module, used to automatically select the optimal transmission protocol according to the operating system type determined by the analysis and determination module; A security encryption module, used to perform multi-factor authentication encryption on important data according to different versions and types of drivers installed by the driver adapter module and different transmission protocols adopted by the data interaction module; The analysis and judgment module includes an instruction analysis unit and a system judgment unit. The instruction analysis unit is used to monitor and capture the first SETUP packet, and at the same time parse the bRequest field of the first SETUP packet and judge the execution instruction. The system judgment unit is used to send a detection command and receive feedback according to the order of instruction names executed by the instruction analysis unit if the instruction execution order is the same as the specific execution order, otherwise it will not be sent, and then preliminarily determine which operating system terminal interface the USB interface module is connected to.

[0006] Preferably, the dynamic adjustment module includes a monitoring scoring unit and a tracking scoring unit, wherein the monitoring scoring unit is used to monitor key instructions in various new SETUP packages interacted by the USB interface module at any time or key instructions in other interaction processes, and to give a basic confidence score to the key instructions processed by it according to the operating system type determined by the existing data; The tracking scoring unit adds or subtracts confidence scores based on the key instructions processed by the monitoring scoring unit and given basic confidence scores, combined with the same batch or multiple related key instructions and specifically set control transmission instructions, on the basis of the basic confidence scores given by the monitoring scoring unit to generate a comprehensive confidence score, and feeds the comprehensive confidence score back to the drive adaptation module.

[0007] The identification method of the full-platform detection system provided in the second aspect of the present invention is applicable to the full-platform detection system, and is characterized in that it comprises the following steps: S1, device insertion, inserting the USB interface module into the terminal interface of the operating system; S2, power-on self-test, the USB interface module activates the hardware circuit and checks the power status; S3, screening and parsing, using the instruction analysis unit to monitor and capture the first SETUP packet, and parse the bRequest field in the SETUP packet. At this time, hardware acceleration technology is used to speed up the parsing process, and the characteristic instructions are quickly identified with the help of a detailed command library; S4, judging execution, judging whether the key instruction in the bRequest field is a specific key instruction, if it is, executing it immediately, otherwise temporarily storing it for subsequent instruction analysis, and recording the timestamp of the instruction for subsequent confidence scoring; S5, sequence determination, using the system determination unit to determine the sequence of the key instructions being executed according to step S4, and compare it with the preset special sequence. If they are consistent, send a detection command and wait for a reply, and then preliminarily determine the operating system type. Otherwise, continue to listen for new instructions; S6, scoring judgment, for each key instruction, the monitoring scoring unit first gives a basic confidence score, and then the tracking scoring unit adjusts the comprehensive confidence score according to the key instructions of the same batch or multiple related key instructions and the control transmission instructions with specific settings; S7, driver installation, using the driver adapter module, prepare the most matching driver according to the initially determined operating system type and comprehensive confidence score, and directly load the driver for high confidence situations, and use memory mapping technology to accelerate the loading process, but before that, strict signature verification and other necessary security checks must be completed; S8, select a file format, use the data management module to reselect the file format according to the operating system type, implement an intelligent cache strategy, load common files into the cache area in advance, and convert the common files in the cache area into the selected format first, and convert the remaining internal files in order; S9, selecting a transmission protocol, using the data management module to automatically select the optimal transmission protocol according to the operating system type, and signing the agreement, while implementing an intelligent retransmission strategy to ensure data integrity, and introducing a higher level of error correction code ECC and content-based verification method; S10. Data encryption: select encryption algorithms that meet the characteristics of the target operating system based on the characteristics of different operating systems, set up multi-factor authentication and fine-grained permission management, and implement end-to-end encryption for sensitive data.

[0008] Preferably, the specific operation steps of the screening and analysis in step S3 are as follows: S301, start monitoring. Once a new device is detected, immediately start monitoring the data packets on the USB bus. At this time, the hardware accelerator starts working, filters out irrelevant traffic, and focuses on capturing the first SETUP packet from the host. S302, capturing the SETUP packet, and when receiving a data frame that conforms to the expected format, immediately saving it in its entirety; S303, preliminary analysis, using the auxiliary functions provided by the hardware accelerator to quickly extract the key elements in the SETUP packet, especially the bRequest field value, because it directly specifies the specific operation type; S304, search for matching items, search for corresponding items in the command library according to the extracted bRequest value, if a complete match is found, a conclusion can be drawn directly, otherwise proceed to the next step of in-depth analysis and comparison; S305, deep analysis, for those commands that are not directly hit but have certain similarities, further check other related fields and make judgments based on context information; S306, recording a timestamp, adding a timestamp to each successfully parsed command, which is very important for subsequent confidence scoring, because there may be subtle time interval differences between different operating systems; S307, output and send, once the operating system type is confirmed, generate a brief report listing the parsing method used and its basis, and send this report to the analysis and judgment module.

[0009] Preferably, the specific operation steps of step S4 are as follows: S401, receiving and judging the instruction, receiving the brief report sent from step S307, and extracting the parsed SETUP package information from the brief report, especially the bRequest field value therein, and comparing it with the preset key instruction features to determine whether it matches; S402, executing the instruction. If the key instruction feature matches the preset instruction feature, the key instruction is directly executed, such as setting the address "Set Address" or getting the device descriptor "Get Device Descriptor". Otherwise, if it is not a key instruction, it is temporarily stored in a queue and waits for further analysis. S403, sequential feedback, after completing all the above operations, the running sequence of the key instructions is sent to the system identification unit to inform that the current instruction has been properly processed and is ready to receive the next instruction or continue to execute the next step.

[0010] Preferably, the specific operation steps of the sequence determination in step S5 are as follows: S501, receiving an execution sequence, receiving an execution sequence of a key instruction sent by the instruction analysis unit; S502, determining whether the sequence is consistent with a preset special sequence. For example, if the "SetAddress" operation is executed first and then the "Get Device Descriptor" operation is executed, it is determined to be an iOS system and a Mac OS system, otherwise it is a non-iOS system and a Mac OS system; S503, sending a detection command. If the order determined in step S502 is consistent with the predetermined special order, sending a detection command and waiting for a reply, and then further determining the iOS system and the Mac OS system.

[0011] Preferably, the specific operation steps of the scoring judgment in step S6 are as follows: S601, dynamic adjustment and confirmation, continuously monitoring each new instruction according to the monitoring and scoring unit; S602, determine the source of the command, and determine whether each new command is a SETUP packet or other key command. If so, analyze the bRequest feature, otherwise continue to monitor; S603, basic scoring, for the analyzed bRequest feature, a basic confidence score is performed based on whether the new key instruction itself can support the operating system type determined by the existing step S5 sequence judgment; S604, dynamic scoring, using the tracking scoring unit to add or subtract confidence scores based on the basic confidence scores given by the monitoring scoring unit for instructions given basic confidence scores, combined with the same batch or multiple related key instructions and specifically set control transfer instructions, to generate a comprehensive confidence score, and feed the comprehensive confidence score back to the driver adaptation module.

[0012] Preferably, the specific operation steps of the driver installation in step S7 are as follows: S701, receiving a confidence score, receiving a comprehensive confidence score sent by the tracking scoring unit; S702: Comprehensively judge the type of the operating system according to the basic type judged by the analysis and judgment module and the comprehensive confidence score sent by the tracking and scoring unit; S703, installing the driver. According to the type of the operating system determined by comprehensive judgment in step S701, the corresponding matching driver is installed according to the type of the operating system, and the memory mapping technology is used to accelerate the loading process.

[0013] Preferably, the specific operation steps of selecting the file format in step S8 are as follows: S801, selecting a file format, using the data management module to reselect a file format according to the connected operating system type, such as NTFS file format, exFAT file format, or HFS+ file format; S802, file reloading, implement intelligent caching strategy for stored internal files, load commonly used files into the cache area in advance, and convert the commonly used files in the cache area according to the reselected file format first, and prepare for use, and the remaining internal files are converted in sequence.

[0014] Preferably, the specific operation steps of selecting the transmission protocol in step S9 are as follows: S901, operating system type identification, based on the comprehensive judgment of the currently running operating system type and its version number and other information obtained in step S702, evaluate the most commonly used transmission protocol in the operating system environment; S902, automatically selecting a transmission protocol, using the data interaction module, to find the best transmission protocol configuration solution that best suits the current environment to maintain optimal performance; S903. Signing an agreement, the communicating parties complete the generation and exchange of security keys, clarify the service quality commitments of both parties regarding data transmission rate, delay, packet loss rate, etc., and provide a basis for solving possible problems; S904. Introduce advanced verification methods and add additional redundant information in the data packaging stage, so that even if part of the data is lost, the original content can be restored by calculation. Before the data is sent, the strong hash function SHA-256 is used to calculate the summary value of the data to be transmitted, and it is sent to the receiver together with the data. After the receiving end receives the data, it independently recalculates the hash value to confirm that the data transmission is correct.

[0015] Compared with the related art, the full-platform detection system and identification method provided by the present invention have the following beneficial effects: 1. By using the technology of the present invention, a USB smart storage device will be fully compatible with Windows, Android, iOS, Mac OS and Linux systems. It can easily cope with both iOS and Mac OS of Apple ecosystem and Windows, Android and Linux of non-Apple ecosystem. It breaks the boundary between terminals and operating systems, allowing users to freely shuttle between different devices, making data security storage and transfer convenient, and improving the versatility and convenience of storage devices. This full-platform detection system not only simplifies the user's operation steps, but also greatly improves the interoperability and security between devices and different operating systems. It is suitable for a wide range of application scenarios, thereby meeting the needs of users to back up and transfer data between different platforms.

[0016] 2. The dynamic adjustment module can monitor and optimize the confidence score in real time, and flexibly adjust the decision-making strategy according to the actual situation. Even when the network conditions change or encounter an unknown operating system type, the system can respond quickly to ensure the best operating performance. At the same time, this adaptive feature also helps the system to continuously learn and improve to better cope with new challenges that may arise in the future. In addition, by integrating hardware acceleration technology and a detailed command library, this solution can significantly speed up the speed of instruction parsing while maintaining extremely high accuracy. This not only reduces the possibility of misjudgment, but also enables the device to respond to requests from different operating systems in the first time, thereby providing smooth and fast service responses, especially when faced with a large number of concurrent requests, it can efficiently and accurately process data requests.

[0017] 3. This solution introduces strict signature verification mechanisms, memory mapping technology, and advanced encryption algorithms, such as multi-factor authentication and fine-grained permission management. These measures work together to build a solid security barrier, effectively preventing unauthorized access and potential data leakage risks, and providing users with a safer and more reliable usage environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A process wireframe diagram of the overall modules and units of the full-platform detection system provided by the present invention; Figure 2 A wireframe diagram of the overall process of the full-platform detection system and identification method provided by the present invention; Figure 3 A wireframe diagram of the specific operation steps of step S3 screening and analysis provided by the present invention; Figure 4 A wireframe diagram of the specific operation steps of step S4 provided by the present invention; Figure 5 A wireframe diagram of the specific operation steps of the step S5 sequence judgment provided by the present invention; Figure 6 A wireframe diagram of the specific operation steps of step S6 scoring judgment provided by the present invention; Figure 7 A wireframe diagram of the specific operation steps of the driver installation in step S7 provided by the present invention; Figure 8 A wireframe diagram of the specific operation steps of selecting a file format in step S8 provided by the present invention; Fig. 9 A wireframe diagram of the specific operation steps of selecting a transmission protocol in step S9 provided by the present invention; Fig.10 A structural block diagram of the analysis and judgment module provided by the present invention; Fig.11This is a structural block diagram of the dynamic adjustment module provided by the present invention. DETAILED DESCRIPTION

[0019] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.

[0020] Please refer to Figure 1 , Figure 2 , Figure 3 , Figure 4 , Figure 5 , Figure 6 , Figure 7 , Figure 8 , Fig. 9 , Fig.10 as well as Fig.11 ,in, Figure 1 A process wireframe diagram of the overall modules and units of the full-platform detection system provided by the present invention; Figure 2 A wireframe diagram of the overall process of the full-platform detection system and identification method provided by the present invention; Figure 3 A wireframe diagram of the specific operation steps of step S3 screening and analysis provided by the present invention; Figure 4 A wireframe diagram of the specific operation steps of step S4 provided by the present invention; Figure 5 A wireframe diagram of the specific operation steps of the step S5 sequence judgment provided by the present invention; Figure 6 A wireframe diagram of the specific operation steps of step S6 scoring judgment provided by the present invention; Figure 7 A wireframe diagram of the specific operation steps of the driver installation in step S7 provided by the present invention; Figure 8 A wireframe diagram of the specific operation steps of selecting a file format in step S8 provided by the present invention; Fig. 9 A wireframe diagram of the specific operation steps of selecting a transmission protocol in step S9 provided by the present invention; Fig.10 A structural block diagram of the analysis and judgment module provided by the present invention; Fig.11 This is a structural block diagram of the dynamic adjustment module provided by the present invention.

[0021] In the specific implementation process, Figure 1-Figure 11 As shown, the full-platform detection system and identification method provided by the present invention include a USB interface module, which is used for device power-on initialization and self-test, and is connected to terminal interfaces of various operating systems for information exchange; The analysis and judgment module is used for preliminary instruction screening and execution, and determines the type of operating system based on the instruction operation sequence; A dynamic adjustment module that continuously monitors instructions, tracks the quality of recognition decisions, and updates confidence scores; A driver adaptation module, for preparing a driver to load the most matching driver for a high confidence situation based on the operating system type initially determined by the analysis and judgment module and the confidence score evaluated by the dynamic adjustment module; Data management module for automatically selecting the most suitable file format for the operating system; The data interaction module is used to automatically select the optimal transmission protocol according to the operating system type determined by the analysis and judgment module; A security encryption module is used to perform multi-factor authentication and encryption on important data according to different versions and types of drivers installed by the driver adapter module and different transmission protocols adopted by the data interaction module; It should be noted that the security encryption module is a vital component of the system, which is designed to ensure the integrity and confidentiality of important data during transmission. It enhances security by combining multiple authentication factors. It not only relies on traditional password verification methods, but also introduces additional security layers, such as biometrics, hardware tokens, etc. This multi-factor authentication MFA mechanism requires users to provide at least two different types of credentials to prove their identity, thereby greatly improving the security and reliability of the account. Multi-factor authentication encryption refers to the use of multiple independent and complementary authentication methods to protect keys or sensitive information while encrypting data. This method can not only prevent unauthorized access, but also effectively resist attacks against a single authentication method; The analysis and judgment module includes an instruction analysis unit and a system judgment unit. The instruction analysis unit is used to monitor and capture the first SETUP packet, and at the same time parse the bRequest field of the first SETUP packet and judge the execution instruction. The system judgment unit is used to execute the instruction name sequence of the instruction analysis unit. If the instruction execution sequence is the same as the specific execution sequence, the detection command is sent and feedback is received. Otherwise, it is not sent, and then preliminarily determines the terminal interface of which operating system the USB interface module is connected to.

[0022] The dynamic adjustment module includes a monitoring and scoring unit and a tracking and scoring unit. The monitoring and scoring unit is used to monitor the key instructions in various new SETUP packages interacted with by the USB interface module at any time or in other key instructions in the interaction process, and give a basic confidence score to the key instructions processed by it based on the operating system type determined by the existing data; The tracking scoring unit adds or subtracts confidence scores based on the key instructions processed by the monitoring scoring unit and given basic confidence scores, combined with the same batch or multiple related key instructions and specifically set control transmission instructions, to generate a comprehensive confidence score, and then feeds the comprehensive confidence score back to the drive adaptation module.

[0023] The identification method of the full-platform detection system provided in the second aspect of the present invention is applicable to the full-platform detection system, and comprises the following steps: S1, device insertion, insert the USB interface module into the terminal interface of the operating system; S2, power-on self-test, USB interface module activates hardware circuit and checks power status; S3, screening and parsing, using the instruction analysis unit to monitor and capture the first SETUP packet, and parse the bRequest field in the SETUP packet. At this time, hardware acceleration technology is used to speed up the parsing process, and the characteristic instructions are quickly identified with the help of a detailed command library; S4, judging execution, judging whether the key instruction in the bRequest field is a specific key instruction, if it is, executing it immediately, otherwise temporarily storing it for subsequent instruction analysis, and recording the timestamp of the instruction for subsequent confidence scoring; S5, sequence determination, using the system determination unit to determine the sequence of the key instructions being executed according to step S4, and compare it with the preset special sequence. If they are consistent, send a detection command and wait for a reply, and then preliminarily determine the operating system type. Otherwise, continue to listen for new instructions; S6. Scoring judgment: For each key instruction, the monitoring scoring unit first gives a basic confidence score, and then the tracking scoring unit adjusts the comprehensive confidence score based on the key instructions of the same batch or multiple related key instructions and the control transmission instructions with specific settings; S7, driver installation, using the driver adapter module, prepare the most matching driver according to the initially determined operating system type and comprehensive confidence score. For high confidence situations, directly load the driver and use memory mapping technology to accelerate the loading process, but before that, strict signature verification and other necessary security checks must be completed; S8. Select a file format, use the data management module, reselect the file format according to the operating system type, implement an intelligent cache strategy, load common files into the cache area in advance, and convert the common files in the cache area into the selected format first, and convert the remaining internal files in order; S9. Select the transmission protocol, use the data management module to automatically select the optimal transmission protocol according to the operating system type, and sign the agreement. At the same time, implement an intelligent retransmission strategy to ensure data integrity, and introduce a higher level of error correction code ECC and content-based verification method; S10. Data encryption: select encryption algorithms that meet the characteristics of the target operating system based on the characteristics of different operating systems, set up multi-factor authentication and fine-grained permission management, and implement end-to-end encryption for sensitive data.

[0024] The specific operation steps of step S3 screening and analysis are as follows: S301, start monitoring. Once a new device is detected, immediately start monitoring the data packets on the USB bus. At this time, the hardware accelerator starts working, filters out irrelevant traffic, and focuses on capturing the first SETUP packet from the host. S302, capturing the SETUP packet, and when receiving a data frame that conforms to the expected format, immediately saving it in its entirety; S303, preliminary analysis, using the auxiliary functions provided by the hardware accelerator to quickly extract the key elements in the SETUP packet, especially the bRequest field value, because it directly specifies the specific operation type; S304, search for matching items, search for corresponding items in the command library according to the extracted bRequest value, if a complete match is found, a conclusion can be drawn directly, otherwise proceed to the next step of in-depth analysis and comparison; S305, deep analysis, for those commands that are not directly hit but have certain similarities, further check other related fields and make judgments based on context information; S306, recording a timestamp, adding a timestamp to each successfully parsed command, which is very important for subsequent confidence scoring, because there may be subtle time interval differences between different operating systems; S307, output and send, once the operating system type is confirmed, generate a brief report listing the parsing method used and its basis, and send this report to the analysis and judgment module.

[0025] The specific operation steps of step S4 are as follows: S401, receiving and judging the instruction, receiving the brief report sent from step S307, and extracting the parsed SETUP package information from the brief report, especially the bRequest field value therein, and comparing it with the preset key instruction features to determine whether it matches; S402, executing the instruction. If the key instruction feature matches the preset instruction feature, the key instruction is directly executed, such as setting the address "Set Address" or getting the device descriptor "Get Device Descriptor". Otherwise, if it is not a key instruction, it is temporarily stored in a queue and waits for further analysis. S403, sequential feedback, after completing all the above operations, the running sequence of the key instructions is sent to the system identification unit to inform that the current instruction has been properly processed and is ready to receive the next instruction or continue to execute the next step.

[0026] The specific operation steps of step S5 sequence determination are as follows: S501, receiving an execution sequence, receiving an execution sequence of a key instruction sent by an instruction analysis unit; S502, determining whether the sequence is consistent with a preset special sequence. For example, if the "SetAddress" operation is executed first and then the "Get Device Descriptor" operation is executed, it is determined to be an iOS system and a Mac OS system, otherwise it is a non-iOS system and a Mac OS system; It should be noted that the USB enumeration process on Apple operating systems iOS and Mac OS is different from that on non-Apple operating systems such as Windows, Android and Linux. On Apple operating systems, the "Set Address" operation is performed first and then the "Get Device Descriptor" operation is performed, while on non-Apple operating systems, the "Get Device Descriptor" operation is performed first and then the "Set Address" operation is performed. By detecting the execution order of these operations, the USB smart storage device can determine whether it is inserted into an Apple terminal device or a non-Apple terminal device. Because the usage method and process of the USB smart storage device are relatively consistent for non-Apple terminal devices, there is no need for additional system platform identification. The USB smart storage device can directly communicate and transmit data with non-Apple terminal devices, so it only needs to determine whether it is an Apple operating system iOS and Mac OS; S503, sending a detection command. If the order determined in step S502 is consistent with the predetermined special order, sending a detection command and waiting for a reply, and then further determining the iOS system and the Mac OS system; It should be noted that for Apple terminal devices, the iOS system and Mac OS system are further distinguished by the support of the communication protocol. For the iOS system, the iAP2 USB communication protocol is supported, while Mac OS does not support the iAP2 protocol. When the USB smart storage device is plugged into the USB port of the Apple terminal device, the USB smart storage device sends the iAP2 Dectect detection command. If it is an iOS terminal device, there will be a reply message soon, otherwise there will be no reply. This operation can be used to identify whether it is an iOS terminal device or a Mac OS operating system device. This method is applicable to USB2.0 and below and USB3.0 and above communications.

[0027] The specific operation steps of step S6 scoring judgment are as follows: S601, dynamic adjustment and confirmation, continuously monitoring each new instruction according to the monitoring and scoring unit; S602, determine the source of the command, and determine whether each new command is a SETUP packet or other key command. If so, analyze the bRequest feature, otherwise continue to monitor; S603, basic scoring, for the analyzed bRequest feature, a basic confidence score is performed based on whether the new key instruction itself can support the operating system type determined by the existing step S5 sequence judgment; It should be noted that the basic confidence rating standard reflects the strength of the current instruction's evidence for a specific operating system type. For example, if the behavior pattern of an instruction is highly consistent with the expectations of a certain operating system, it will be given a higher basic score, otherwise it will be given a lower score. The purpose is to establish a preliminary confidence framework through a separate evaluation of each key instruction, which will serve as the basis for subsequent comprehensive scoring. S604, dynamic scoring, using the tracking scoring unit to add or subtract confidence scores based on the basic confidence scores given by the monitoring scoring unit for the instructions given basic confidence scores, combined with the same batch or multiple related key instructions and the control transmission instructions with specific settings, so as to generate a comprehensive confidence score, and feed the comprehensive confidence score back to the driver adaptation module; It should be noted that after the tracking scoring unit takes over the basic confidence score from the monitoring scoring unit, it begins to consider the relationship between this instruction and other instructions in the same batch or multiple related instructions. The "same batch" here usually refers to a series of continuous instructions issued by the same host, and "multiple related" refers to those instructions that are not continuous in time but logically related. Special attention should be paid to certain control transfer instructions with special significance, which can often provide more information about the internal state of the operating system. According to the above factors, the confidence score is increased or decreased on the original basis, and finally a more comprehensive and accurate comprehensive confidence score is formed. This score will be directly fed back to the driver adaptation module to guide the next action selection to ensure that the final judgment of the operating system type is as accurate as possible.

[0028] Step S7: The specific steps for driver installation are as follows: S701, receiving a confidence score, receiving a comprehensive confidence score sent by a tracking and scoring unit; S702: Comprehensively judge the type of the operating system based on the basic type judged by the analysis and judgment module and the comprehensive confidence score sent by the tracking and scoring unit; S703, installing the driver, according to the type of the operating system determined by comprehensive judgment in step S701, installing the corresponding matching driver according to the type of the operating system, and using memory mapping technology to accelerate the loading process; It should be noted that the driver adapter module is responsible for loading the prepared driver into the operating system. This process varies depending on the operating system: For example: Windows uses standard driver installation APIs (such as SetupAPI) to register driver services. If it is a user-mode driver, it can be loaded by directly calling the relevant interface through the application. For kernel-mode drivers, it is usually necessary to restart the computer for the changes to take effect; For example: Linux, compiles into a dynamically loadable module (.ko file), and then uses the insmod or modprobe command to insert it into the kernel space. The kernel module can be statically compiled into the kernel through macro definitions and automatically loaded when the system starts, ensuring the correct loading order, because some basic modules need to be loaded before other modules.

[0029] At the same time, considering the differences between different operating systems, the driver adaptation module must have cross-platform capabilities, which means that it must not only understand the driver models on each platform, but also be able to handle their respective characteristics and limitations. By using machine learning technology, the system can learn from past experience and gradually optimize its understanding of the characteristics of various operating systems. When encountering new situations that have never been seen before but have similar characteristics, the system can make reasonable inferences based on the existing knowledge base and introduce anomaly detection algorithms to monitor whether there are any unconventional behavior patterns. These algorithms can help identify instruction combinations or parameter settings that deviate from normal operating procedures, indicating that different operating system types may exist.

[0030] In one specific implementation, the anomaly detection algorithm process is as follows: Step 1: Data collection and preprocessing: Logging: Comprehensively record all activities related to device communication, including but not limited to received data packets, executed commands, and generated response results. These logs will become the basis for subsequent analysis; Feature extraction: Extract valuable feature vectors from the raw logs, including instruction frequency, parameter range, and execution order. These features will be used to describe the unique nature of each event and passed as input to the next analysis step; Step 2: Model training and selection: Offline training: Use annotated historical data sets to train multiple machine learning models, such as decision trees or random forests and support vector machines, to find the best model that best suits the current task; Online fine-tuning: As new data continues to flow in, the model parameters are gradually fine-tuned to make it closer to the actual situation. At the same time, a certain degree of flexibility is maintained to allow the model to make appropriate adjustments when encountering special situations. Step 3: Real-time monitoring and early warning: Threshold setting: According to the probability distribution of the trained model output, the alarm threshold is set reasonably. When the probability of an event is lower than the set threshold, it is considered to be a potential abnormal event. Contextual analysis: not only focusing on a single isolated event, but also combining other related activities in the previous and subsequent periods of time for comprehensive evaluation. For example, the occurrence of multiple low-probability events in succession may indicate the existence of some kind of regular abnormal behavior. Immediate response: Once an abnormal situation is detected, an alarm is triggered immediately and a notification is sent to relevant personnel. At the same time, further actions can be taken according to the specific situation, such as suspending the current operation, requiring the user to verify the identity, or launching a more in-depth security check process; Step 4: Post-processing and learning: Cause investigation: For each event marked as abnormal, a detailed cause investigation is required to find out the root cause and record it, which is very helpful for enriching the knowledge base and improving future detection accuracy; Model iterative update: Regularly review the entire anomaly detection process, summarize lessons learned, and perform necessary iterative updates on the model to ensure that it always maintains good detection results.

[0031] The specific operation steps of step S8 for selecting the file format are as follows: S801, select a file format, and use the data management module to reselect a file format according to the type of the connected operating system, such as NTFS file format, exFAT file format, and HFS+ file format; S802, file reloading, implement intelligent caching strategy for stored internal files, load commonly used files into the cache area in advance, and convert the commonly used files in the cache area according to the reselected file format first, and prepare for use, and the remaining internal files are converted in sequence.

[0032] The specific operation steps of step S9 for selecting the transmission protocol are as follows: S901, operating system type identification, based on the comprehensive judgment of the currently running operating system type and its version number and other information obtained in step S702, evaluate the most commonly used transmission protocol in the operating system environment; S902, automatically select a transmission protocol, use a data interaction module, and find the best transmission protocol configuration solution that best suits the current environment to maintain optimal performance; S903. Signing an agreement, the communicating parties complete the generation and exchange of security keys, clarify the service quality commitments of both parties regarding data transmission rate, delay, packet loss rate, etc., and provide a basis for solving possible problems; S904. Introduce advanced verification methods and add additional redundant information in the data packaging stage, so that even if part of the data is lost, the original content can be restored by calculation. Before the data is sent, the strong hash function SHA-256 is used to calculate the summary value of the data to be transmitted, and it is sent to the receiver together with the data. After the receiver receives the data, it independently recalculates the hash value to confirm that the data transmission is correct. In a specific implementation, the advanced verification method is to apply ECC encoding, add additional redundant information in the data packaging stage, so that even if part of the data is lost, the original content can be restored by calculation. This method is particularly suitable for applications that have extremely high requirements for data accuracy. At the same time, the strong hash function SHA-256 is used to calculate the summary value of the data to be transmitted and send it to the receiver along with the data; After the receiving end receives the data, it recalculates the hash value independently and compares it with the received summary. If the two are consistent, it means that the data transmission is correct. Otherwise, it indicates that there is an error and triggers the corresponding error correction process.

[0033] The above are only embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the specification and drawings of the present invention, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. Full platform detection system, characterized by: include: USB interface module, used for device power-on initialization and self-test, and connected to terminal interfaces of various operating systems for information exchange; The analysis and judgment module is used for preliminary instruction screening and execution, and determines the type of operating system based on the instruction operation sequence; A dynamic adjustment module that continuously monitors instructions, tracks the quality of recognition decisions, and updates confidence scores; A driver adaptation module, for preparing a driver program to load the most matching driver for a high confidence situation according to the operating system type preliminarily determined by the analysis and judgment module and the confidence score evaluated by the dynamic adjustment module; Data management module for automatically selecting the most suitable file format for the operating system; A data interaction module, used to automatically select the optimal transmission protocol according to the operating system type determined by the analysis and determination module; A security encryption module, used to perform multi-factor authentication encryption on important data according to different versions and types of drivers installed by the driver adapter module and different transmission protocols adopted by the data interaction module; The analysis and judgment module includes an instruction analysis unit and a system judgment unit. The instruction analysis unit is used to monitor and capture the first SETUP packet, and at the same time parse the bRequest field of the first SETUP packet and judge the execution instruction. The system judgment unit is used to send a detection command and receive feedback according to the order of instruction names executed by the instruction analysis unit if the instruction execution order is the same as the specific execution order, otherwise it will not be sent, and then preliminarily determine which operating system terminal interface the USB interface module is connected to.

2. The full-platform detection system according to claim 1, characterized in that: The dynamic adjustment module includes a monitoring and scoring unit and a tracking and scoring unit, wherein the monitoring and scoring unit is used to monitor key instructions in various new SETUP packages interacted by the USB interface module at any time or key instructions in other interaction processes, and to give a basic confidence score to the key instructions processed by it according to the operating system type determined by the existing data; The tracking scoring unit adds or subtracts confidence scores based on the key instructions processed by the monitoring scoring unit and given basic confidence scores, combined with the same batch or multiple related key instructions and specifically set control transmission instructions, on the basis of the basic confidence scores given by the monitoring scoring unit to generate a comprehensive confidence score, and feeds the comprehensive confidence score back to the drive adaptation module.

3. The identification method of the full-platform detection system is applicable to the full-platform detection system according to claim 1 or 2, characterized in that: The method comprises the following steps: S1, device insertion, inserting the USB interface module into the terminal interface of the operating system; S2, power-on self-test, the USB interface module activates the hardware circuit and checks the power status; S3, screening and parsing, using the instruction analysis unit to monitor and capture the first SETUP packet, and parse the bRequest field in the SETUP packet. At this time, hardware acceleration technology is used to speed up the parsing process, and the characteristic instructions are quickly identified with the help of a detailed command library; S4, judging execution, judging whether the key instruction in the bRequest field is a specific key instruction, if it is, executing it immediately, otherwise temporarily storing it for subsequent instruction analysis, and recording the timestamp of the instruction for subsequent confidence scoring; S5, sequence determination, using the system determination unit to determine the sequence of the key instructions being executed according to step S4, and compare it with the preset special sequence. If they are consistent, send a detection command and wait for a reply, and then preliminarily determine the operating system type. Otherwise, continue to listen for new instructions; S6, scoring judgment, for each key instruction, the monitoring scoring unit first gives a basic confidence score, and then the tracking scoring unit adjusts the comprehensive confidence score according to the key instructions of the same batch or multiple related key instructions and the control transmission instructions with specific settings; S7, driver installation, using the driver adapter module, prepare the most matching driver according to the initially determined operating system type and comprehensive confidence score, and directly load the driver for high confidence situations, and use memory mapping technology to accelerate the loading process, but before that, strict signature verification and other necessary security checks must be completed; S8, select a file format, use the data management module to reselect the file format according to the operating system type, implement an intelligent cache strategy, load common files into the cache area in advance, and convert the common files in the cache area into the selected format first, and convert the remaining internal files in order; S9, selecting a transmission protocol, using the data management module to automatically select the optimal transmission protocol according to the operating system type, and signing the agreement, while implementing an intelligent retransmission strategy to ensure data integrity, and introducing a higher level of error correction code ECC and content-based verification method; S10. Data encryption: select encryption algorithms that meet the characteristics of the target operating system based on the characteristics of different operating systems, set up multi-factor authentication and fine-grained permission management, and implement end-to-end encryption for sensitive data.

4. The identification method of the full-platform detection system according to claim 3, characterized in that: The specific operation steps of the screening and analysis in step S3 are as follows: S301, start monitoring. Once a new device is detected, immediately start monitoring the data packets on the USB bus. At this time, the hardware accelerator starts working, filters out irrelevant traffic, and focuses on capturing the first SETUP packet from the host. S302, capturing the SETUP packet, and when receiving a data frame that conforms to the expected format, immediately saving it in its entirety; S303, preliminary analysis, using the auxiliary functions provided by the hardware accelerator to quickly extract the key elements in the SETUP packet, especially the bRequest field value, because it directly specifies the specific operation type; S304, search for matching items, search for corresponding items in the command library according to the extracted bRequest value, if a complete matching item is found, a conclusion can be drawn directly, otherwise proceed to the next step of in-depth analysis and comparison; S305, deep analysis, for those commands that are not directly hit but have certain similarities, further check other related fields and make judgments based on context information; S306, recording a timestamp, adding a timestamp to each successfully parsed command, which is very important for subsequent confidence scoring, because there may be subtle time interval differences between different operating systems; S307, output and send, once the operating system type is confirmed, generate a brief report listing the parsing method used and its basis, and send this report to the analysis and judgment module.

5. The identification method of the full-platform detection system according to claim 4, characterized in that: The specific operation steps of step S4 are as follows: S401, receiving and judging the instruction, receiving the brief report sent from step S307, and extracting the parsed SETUP package information from the brief report, especially the bRequest field value therein, and comparing it with the preset key instruction features to determine whether it matches; S402, executing the instruction. If the key instruction feature matches the preset instruction feature, the key instruction is directly executed. Otherwise, if it is not a key instruction, it is temporarily stored in a queue and waits for further analysis. S403, sequential feedback, after completing all the above operations, the running sequence of the key instructions is sent to the system identification unit to inform that the current instruction has been properly processed and is ready to receive the next instruction or continue to execute the next step.

6. The identification method of the full-platform detection system according to claim 5, characterized in that: The specific operation steps of the sequence determination in step S5 are as follows: S501, receiving an execution sequence, receiving an execution sequence of a key instruction sent by the instruction analysis unit; S502, determining whether the sequence is consistent with a preset special sequence, if it is consistent with the special sequence, it is determined to be an iOS system and a Mac OS system, otherwise it is a non-iOS system and a Mac OS system; S503, sending a detection command. If the order determined in step S502 is consistent with the predetermined special order, sending a detection command and waiting for a reply, and then further determining the iOS system and the Mac OS system.

7. The identification method of the full-platform detection system according to claim 6, characterized in that: The specific operation steps of the scoring judgment in step S6 are as follows: S601, dynamic adjustment and confirmation, continuously monitoring each new instruction according to the monitoring and scoring unit; S602, determine the source of the command, and determine whether each new command is a SETUP packet or other key command. If so, analyze the bRequest feature, otherwise continue to monitor; S603, basic scoring, for the analyzed bRequest feature, a basic confidence score is performed based on whether the new key instruction itself can support the operating system type determined by the existing step S5 sequence judgment; S604, dynamic scoring, using the tracking scoring unit to add or subtract confidence scores based on the basic confidence scores given by the monitoring scoring unit for instructions given basic confidence scores, combined with the same batch or multiple related key instructions and specifically set control transfer instructions, to generate a comprehensive confidence score, and feed the comprehensive confidence score back to the driver adaptation module.

8. The identification method of the full-platform detection system according to claim 7, characterized in that: The specific operation steps of the driver installation in step S7 are as follows: S701, receiving a confidence score, receiving a comprehensive confidence score sent by the tracking scoring unit; S702: Comprehensively judge the type of the operating system according to the basic type judged by the analysis and judgment module and the comprehensive confidence score sent by the tracking and scoring unit; S703, installing the driver. According to the type of the operating system determined by comprehensive judgment in step S701, the corresponding matching driver is installed according to the type of the operating system, and the memory mapping technology is used to accelerate the loading process.

9. The identification method of the full-platform detection system according to claim 8, characterized in that: The specific operation steps of selecting the file format in step S8 are as follows: S801, selecting a file format, using the data management module to reselect a file format according to the connected operating system type; S802, file reloading, implement intelligent caching strategy for stored internal files, load commonly used files into the cache area in advance, and convert the commonly used files in the cache area according to the reselected file format first, and prepare for use, and the remaining internal files are converted in sequence.

10. The identification method of the full-platform detection system according to claim 9, characterized in that: The specific operation steps of selecting the transmission protocol in step S9 are as follows: S901, operating system type identification, based on the comprehensive judgment of the currently running operating system type and its version number and other information obtained in step S702, evaluate the most commonly used transmission protocol in the operating system environment; S902, automatically selecting a transmission protocol, using the data interaction module, to find the best transmission protocol configuration solution that best suits the current environment to maintain optimal performance; S903. Signing an agreement, the communicating parties complete the generation and exchange of security keys, clarify the service quality commitments of both parties regarding data transmission rate, delay, packet loss rate, etc., and provide a basis for solving possible problems; S904. Introduce advanced verification methods and add additional redundant information in the data packaging stage, so that even if part of the data is lost, the original content can be restored by calculation. Before the data is sent, a strong hash function is used to calculate the summary value of the data to be transmitted, and it is sent to the receiver together with the data. After the receiver receives the data, it independently recalculates the hash value to confirm that the data transmission is correct.

Images