Remote monitoring and management method of mobile office equipment based on Internet of Things

Abstract

The present invention discloses a remote monitoring and management method for mobile office equipment based on the Internet of Things, and specifically relates to the field of remote monitoring technology. By extracting the deviation characteristics of operation behaviors and the abnormal characteristics of identity authentication frequencies of different users, a data prediction model is constructed to accurately distinguish user behaviors when multiple users share mobile office equipment, thereby solving the problem of privacy infringement and potential safety hazards caused by the inability of the equipment management system to accurately distinguish user behaviors. By calculating the comprehensive distinction accuracy coefficient by weighted average, the system dynamically adjusts the management strategy according to different accuracy levels, reduces the real-time monitoring burden for accurately distinguished users, and immediately initiates isolation measures for inaccurately distinguished users. For users who are not completely accurately distinguished, whether to trigger protection measures is determined by predicting the degree of abnormality, thereby effectively improving the user behavior recognition capability of the equipment management system, reducing the risk of misjudgment and data leakage, and ensuring user privacy and system security in a shared equipment environment.

Description

Technical Field

[0001] The present invention relates to the field of remote monitoring technology, and in particular to a remote monitoring management method for mobile office equipment based on the Internet of Things. Background Art

[0002] Remote monitoring and management of mobile office equipment based on the Internet of Things refers to the use of Internet of Things technology to achieve real-time monitoring and management of mobile office equipment (such as laptops, smartphones, tablets, etc.) scattered across the country through Internet connections and communication protocols. This monitoring and management system usually includes functions such as real-time monitoring of equipment status, location tracking, and security status assessment to ensure that the equipment can stay online at any time and any place, ensure the normal operation of the equipment, and quickly respond to potential failures or security threats. At the same time, remote monitoring and management also allows administrators to remotely control through the background system, such as distributing software updates, adjusting configurations, handling security issues, and even performing remote locking or erasing data. The advantage of this technology is that it improves the efficiency and security of equipment management. It is especially suitable for enterprises or organizations with cross-regional and large mobile office needs, and can ensure the security, compliance and efficient operation of equipment.

[0003] The prior art has the following deficiencies:

[0004] Some mobile devices may be shared among multiple users, and the device management system may not be able to accurately distinguish the behavior of different users. If the system uses the same management policy to handle shared devices by default, this may lead to privacy violations for a certain user. At the same time, if the device management system fails to impose appropriate isolation and protection measures for different users in a timely manner, it may lead to unintentional data leakage. In serious cases, malicious users can use shared devices to carry out attacks, and the monitoring system mistakenly attributes the behavior to innocent users. Summary of the invention

[0005] The purpose of the present invention is to provide a remote monitoring and management method for mobile office equipment based on the Internet of Things to solve the shortcomings of the background technology.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a remote monitoring and management method for mobile office equipment based on the Internet of Things, comprising the following steps:

[0007] S1: obtaining operation behavior data and identity authentication data of different users on mobile office devices in several time periods, and preprocessing the operation behavior data and identity authentication data obtained in each time period;

[0008] S2: extracting features from the pre-processed operation behavior data and identity verification data of different users in each time period, respectively extracting operation behavior deviation features from the operation behavior data and verification frequency abnormal features from the identity verification data;

[0009] S3: Based on the extracted operation behavior deviation characteristics and verification frequency abnormal characteristics, a data prediction model is constructed, and the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period is determined according to the model output results, and the comprehensive distinction accuracy coefficient is calculated by weighted average according to the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period;

[0010] S4: Compare and analyze the obtained comprehensive distinction accuracy coefficient with the gradient accuracy threshold, and divide the accuracy of the device management system in distinguishing different user behaviors into accurate distinction, incompletely accurate distinction, and inaccurate distinction according to the analysis result;

[0011] S5: When the device management system can accurately distinguish users, for users that have been accurately distinguished, the management system reduces the detail of real-time behavior records; for users that are not accurately distinguished, the dynamic isolation mechanism is immediately activated to isolate the operation behaviors between users;

[0012] S6: For incompletely accurate distinctions, the abnormal degree of accuracy of the device management system in distinguishing different user behaviors within a fixed time period is predicted, and whether to trigger isolation and protection measures is determined based on the prediction results.

[0013] Preferably, in S2, a typing rhythm deviation index is generated according to the operation behavior deviation feature in the extracted operation behavior data, and the method for obtaining the typing rhythm deviation index is:

[0014] The time interval between each key press of the user is represented as a time series, and the user's reference time series and current time series are constructed respectively; the reference time series , indicating the user's standard typing rhythm; the current time series , represents the user's current typing rhythm; among them, and Represents the time interval from the user pressing a key to the next key, calculates the item-by-item difference between the two time series R and C, and uses the Euclidean distance to measure the distance between two time points. The expression is: ;in, represents the time interval difference between time points n and m, The nth typing interval in the reference time series, is the mth typing interval in the current time series; the size of the generated distance matrix D is n×m, where each element Represents the difference between sequences R and C at corresponding time points, and uses a recursive method to construct a cumulative distance matrix D' to find the optimal matching path. The element D'(i, j) of the cumulative distance matrix represents the minimum cumulative path cost to reach point (i, j), and the calculation formula is: ; represents the cumulative distance between sequences R and C at the previous time point, Indicates the cumulative distance that the current time point moves forward one step in the reference sequence or the current sequence. Represents the cumulative distance of moving one step on both sequences at the same time; find the optimal matching path W from (1,1) to (n,m) through the cumulative distance matrix D′, the path length is L, the optimal path is found by minimizing the overall cumulative distance, so that the points of the two sequences match, and the path W is expressed as: ;in Indicates that at the Lth matching point in the path, the typing rhythm deviation index is calculated, and the expression is: ; In the formula, It is the typing rhythm deviation index.

[0015] Preferably, in S2, a verification frequency anomaly index is generated according to the verification frequency anomaly feature extracted from the identity authentication data, and the method for obtaining the verification frequency anomaly index is:

[0016] Obtain the user verification frequency data in Q time periods and construct the corresponding user verification frequency time series ;in Indicates at time The number of identity authentications that occurred within the time span, g is the length of the time series, that is, the number of authentications within the time span of data collection; the complex authentication frequency time series X(t) is decomposed into several intrinsic mode functions IMFs, each IMF represents a different frequency component of the data, including: identifying all local maxima and local minima in the authentication frequency time series X(t), generating an upper envelope through local maximum points, and generating a lower envelope through local minimum points. The upper and lower envelopes use cubic spline interpolation to connect these extreme points to form the upper and lower limit curves of the data series, respectively, and calculating the mean m(t) of the upper and lower envelopes: ; Calculate the difference between the verification frequency time series and the envelope mean , the expression is: ; Remove the extracted IMF components from the original sequence, the expression is: ;Will As a new sequence, continue to decompose to obtain the second IMF component and the remaining amount , until the remaining amount Until it becomes monotonic, the entire sequence X(t) is decomposed into: ;in It is the bth IMF, is the final residual term, each IMF component Indicates the different frequency components in the verification frequency signal and calculates the energy of each IMF component , the energy calculation formula is: ; According to the calculated energy of each IMF component Calculate the verification frequency anomaly index, the expression is: ; Where AQ is the verification frequency anomaly index, p represents the number of high-frequency IMF components, and k represents the total number of all IMFs.

[0017] Preferably, in S3, the typing rhythm deviation index and the verification frequency anomaly index are converted into a first eigenvector, and the first eigenvector is used as the input of the machine learning model. The machine learning model uses each group of first eigenvectors to predict the weighted assignment value label of the accuracy of the device management system in distinguishing different user behaviors in each time period as the prediction target, and takes minimizing the sum of the prediction errors of the weighted assignment labels of the accuracy of the device management system in distinguishing different user behaviors in all time periods as the training target. The machine learning model is trained until the sum of the prediction errors converges and the model training is stopped. The weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period is determined according to the model output results, wherein the machine learning model is a polynomial regression model, and the comprehensive distinction accuracy coefficient is calculated by weighted average according to the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period.

[0018] Preferably, in S4, the obtained comprehensive distinction accuracy coefficient is compared with the gradient accuracy threshold, and the accuracy of different user behaviors of the device management system is divided according to the analysis result, specifically:

[0019] The obtained comprehensive discrimination accuracy coefficient is compared with the gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and the comprehensive discrimination accuracy coefficient is compared with the first standard threshold and the second standard threshold respectively;

[0020] If the comprehensive distinction accuracy coefficient is greater than the second standard threshold, it means that the device management system has high accuracy in distinguishing different user behaviors, and a high accuracy signal is generated and classified as accurate distinction;

[0021] If the comprehensive distinction accuracy coefficient is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it means that the accuracy of the device management system in distinguishing different user behaviors is average, and a medium accuracy signal is generated at this time, and it is classified as an incompletely accurate distinction;

[0022] If the comprehensive distinction accuracy coefficient is less than the first standard threshold, it means that the device management system has low accuracy in distinguishing different user behaviors. In this case, a low accuracy signal is generated and classified as an inaccurate distinction.

[0023] Preferably, in S6, for the incompletely accurate distinction, the abnormal degree of accuracy of the device management system in distinguishing different user behaviors within a fixed time period is predicted, specifically:

[0024] For incompletely accurate distinctions, that is, the comprehensive distinction accuracy coefficient generated in a fixed time period is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the comprehensive distinction accuracy coefficients generated in subsequent fixed time periods that are greater than or equal to the first standard threshold and less than or equal to the second standard threshold are collected, and a corresponding data set is established to distinguish the abnormal degree of different user behaviors for the device management system. To make a prediction, the expression is: ; In the formula, is the comprehensive discrimination accuracy coefficient in the sth time period, is the second standard threshold, is the historical normal typing rhythm deviation index benchmark value, Function of the abnormality prediction model, is the weight coefficient, which indicates the influence weight of each deviation on the abnormality degree. The verification frequency abnormality index benchmark value under historical normal conditions, is the typing rhythm deviation index in the sth time period, is the verification frequency anomaly index in the sth time period; according to the predicted degree of anomaly , set the threshold Ethreshold for triggering isolation and protection measures; when When the value is greater than or equal to the threshold Ethreshold, isolation and protection measures are triggered.

[0025] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0026] 1. The present invention can effectively solve the problem in the prior art that mobile office equipment cannot accurately distinguish user behaviors in multi-user shared use scenarios through a remote monitoring and management method based on the Internet of Things. By extracting features from user operation behavior data and identity authentication data (such as typing rhythm deviation index and verification frequency anomaly index), the system constructs a prediction model to evaluate the behavior patterns of different users, and dynamically adjusts the management strategy based on the calculated comprehensive distinction accuracy coefficient. For users who can be accurately distinguished, unnecessary monitoring burden is reduced and the utilization efficiency of system resources is improved; for users who cannot be accurately distinguished, isolation measures are immediately initiated to prevent malicious behavior and protect user privacy and data security.

[0027] 2. The present invention can also predict the abnormal degree of user behavior distinguished by the device management system based on the incompletely accurate distinction, and dynamically trigger isolation and protection measures according to the abnormal degree, further improving the flexibility and intelligence level of the system. Through this solution, the system can effectively reduce the risk of privacy leakage and misjudgment in a complex shared device environment, ensure the isolation and security of operations between users, and improve the accuracy and operation efficiency of device management. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0029] Figure 1 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] For examples, see Figure 1 As shown, the remote monitoring and management method of mobile office equipment based on the Internet of Things described in this embodiment includes the following steps:

[0032] S1: obtaining operation behavior data and identity authentication data of different users on mobile office devices in several time periods, and preprocessing the operation behavior data and identity authentication data obtained in each time period;

[0033] S2: extracting features from the pre-processed operation behavior data and identity verification data of different users in each time period, respectively extracting operation behavior deviation features from the operation behavior data and verification frequency abnormal features from the identity verification data;

[0034] S3: Based on the extracted operation behavior deviation characteristics and verification frequency abnormal characteristics, a data prediction model is constructed, and the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period is determined according to the model output results, and the comprehensive distinction accuracy coefficient is calculated by weighted average according to the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period;

[0035] S4: Compare and analyze the obtained comprehensive distinction accuracy coefficient with the gradient accuracy threshold, and divide the accuracy of the device management system in distinguishing different user behaviors into accurate distinction, incompletely accurate distinction, and inaccurate distinction according to the analysis result;

[0036] S5: When the device management system can accurately distinguish users, for users that have been accurately distinguished, the management system reduces the detail of real-time behavior records; for users that are not accurately distinguished, the dynamic isolation mechanism is immediately activated to isolate the operation behaviors between users;

[0037] S6: For incompletely accurate distinctions, the abnormal degree of accuracy of the device management system in distinguishing different user behaviors within a fixed time period is predicted, and whether to trigger isolation and protection measures is determined based on the prediction results.

[0038] In S1, the operation behavior data and identity authentication data of different users on the mobile office device in several time periods are obtained, and the operation behavior data and identity authentication data obtained in each time period are preprocessed, specifically:

[0039] Collect multiple users' operation behavior data and authentication data in different time periods, which provide detailed information on the user's interaction with the device. This stage mainly includes the following:

[0040] Operational behavior data includes various behavioral patterns generated when users interact with devices. These data are used to identify users' usage habits and operational characteristics. Common data types include: Typing behavior: records the user's typing speed, keystroke rhythm, and error rate. Mouse or touch screen behavior: includes mouse movement trajectory, click frequency, sliding gestures, etc. Application usage data: records the type, frequency, and operation sequence of applications used by users in different time periods. File operation behavior: captures the frequency and method of users creating, modifying, and deleting files. Device usage time: records the continuous use time of the user's device in a certain period of time, as well as its active and idle periods.

[0041] Authentication data involves authentication information every time a user logs into a device. This information is used to confirm the user's identity and associate it with their operational behavior data. Including: Login method: such as password input, multi-factor authentication (MFA), biometrics (fingerprint, facial recognition). Verification success / failure: record whether the verification is passed and the reason for failure. Verification frequency: record the number of times the user performs authentication in different time periods. Geographic location and device information: record the location information (such as IP address, GPS data) and device identification when the user authenticates.

[0042] After obtaining the original operation behavior data and authentication data, it is necessary to clean, transform and extract features for subsequent analysis and modeling. The purpose of the preprocessing step is to ensure the consistency and integrity of the data and convert it into a standardized format that can be used for analysis. Preprocessing mainly includes the following steps:

[0043] Data cleaning: Data cleaning is an important step in preprocessing, which aims to ensure the accuracy and reliability of data. Identify and remove obviously erroneous or missing data, such as operation interruption records due to network failures or sessions that have failed authentication but are still recorded. Remove redundant behavior data and authentication records to ensure that the operation behavior and authentication events in each time period are unique and meaningful. Ensure that different types of data (such as operation behavior and authentication data) are aligned on the same timeline to eliminate errors caused by asynchronous timestamps.

[0044] Data normalization: Since different data types (such as operation behaviors and authentication information) have different dimensions and units, data normalization is required so that they can be analyzed uniformly. For example, the operation data of different scales such as mouse movement speed, typing speed, and click frequency are unified into the range of 0-1 to ensure consistency during data analysis. Information such as login method, verification success / failure, etc. are converted into numerical data. For example, successful verification is recorded as 1 and failed verification is recorded as 0 for subsequent analysis.

[0045] Data association and integration: associate operation behavior data and identity verification data in different time periods to form a complete operation record of the user in a specific time period. According to the timestamp and user ID, the operation behavior is matched with the identity verification information one by one. In this way, the verification data can be used to determine whether a certain operation is performed by a legitimate user, or whether abnormal behavior occurs after the verification fails. For scenarios where multiple users share the device, ensure that the operation behavior data of different users do not overlap in time periods. The system should separate the operation records of different users based on the identity verification data.

[0046] Data smoothing and noise processing: In actual operation, user behavior data may contain noise or abnormal fluctuations, so smoothing is required to reduce random errors in the data. Use moving average method or exponential smoothing method to process user operation behavior data (such as mouse movement trajectory, click frequency, etc.) to eliminate short-term random fluctuations and make the behavior pattern more consistent. Mark data with abnormally high or low verification frequency to identify potential misoperation or malicious attack behavior.

[0047] In this application, by acquiring operation behavior data and identity authentication data within several time periods and systematically preprocessing them, including data cleaning, normalization, and noise processing, the device management system is able to generate high-quality behavior data and authentication data. These preprocessing steps ensure the accuracy and consistency of the data, providing a solid foundation for subsequent user behavior analysis, identity recognition, and security management.

[0048] S2: Perform feature extraction on the pre-processed operation behavior data and identity verification data of different users in each time period, and extract the operation behavior deviation features in the operation behavior data and the verification frequency abnormal features in the identity verification data respectively.

[0049] After data preprocessing is completed, key features are extracted from the operation behavior data and identity authentication data for subsequent analysis. Feature vectors such as deviation features of typing rhythm, rate of change of mouse movement trajectory, and frequency of application use are extracted. Abnormal features of verification methods, change patterns of verification frequency, time distribution of success / failure, etc. are extracted. After preprocessing and feature extraction, the data needs to be stored in a database suitable for analysis for subsequent machine learning models and anomaly detection algorithms. Time series databases or traditional relational databases can be used for storage to ensure efficient retrieval and query of data.

[0050] The typing rhythm deviation index is generated according to the operation behavior deviation characteristics in the extracted operation behavior data. The method for obtaining the typing rhythm deviation index is:

[0051] The time interval between each key press of the user is represented as a time series, and the user's reference time series and current time series are constructed respectively; the reference time series , represents the user's standard typing rhythm (e.g., the average typing interval of the user in historical operations); the current time series , represents the user's current typing rhythm (for example, the typing interval in a specific input). and Represents the time interval from the user pressing a key to the next key. Calculate the item-by-item difference (i.e., distance) between two time series R and C. Euclidean distance is usually used to measure the distance between two time points, and the expression is: ;in, represents the time interval difference between time points n and m, The nth typing interval in the reference time series, is the mth typing interval in the current time series; the size of the generated distance matrix D is n×m, where each element Both represent the difference between sequences R and C at the corresponding time points. The cumulative distance matrix D′ is constructed recursively to find the optimal matching path. The element D′(i, j) of the cumulative distance matrix represents the minimum cumulative path cost to reach point (i, j). The calculation formula is: ; represents the cumulative distance between sequences R and C at the previous time point, Indicates the cumulative distance that the current time point moves forward one step in the reference sequence or the current sequence. Represents the cumulative distance of moving one step on both sequences at the same time; through the cumulative distance matrix D′, the optimal matching path W from (1,1) to (n,m) can be found, and the path length is L. The optimal path is found by minimizing the overall cumulative distance, so that the points of the two sequences match. The path W is expressed as: ;in Indicates that at the Lth matching point in the path, the typing rhythm deviation index is calculated, and the expression is: ; In the formula, It is the typing rhythm deviation index.

[0052] The larger the typing rhythm deviation index is, the greater the difference between the user's current typing behavior and their historical typing pattern is. A higher deviation index indicates that the device management system may face greater uncertainty in distinguishing different user behaviors, and the system may not be able to accurately identify whether the current operation comes from a legitimate user. Such deviations may be caused by changes in user habits, abnormal behaviors (such as malicious users), or other external factors. Therefore, a higher deviation index means that the system needs to further verify the user's identity or take additional security measures to ensure the security of the device and the accuracy of the operation behavior.

[0053] On the contrary, the smaller the typing rhythm deviation index is, the closer the user's current typing behavior is to their historical behavior pattern. A lower deviation index indicates that the device management system can accurately distinguish the degree of match between the current operating user and the reference user's behavior. This consistency usually indicates that the user's identity is legitimate and the behavior pattern is in line with expectations. The system does not require additional identity authentication and can continue to maintain normal permissions and operation settings. Therefore, a lower deviation index enhances the system's trust in the current user's behavior and improves the system's operating efficiency and user experience.

[0054] The verification frequency anomaly index is generated according to the verification frequency anomaly features in the extracted identity authentication data. The method for obtaining the verification frequency anomaly index is as follows:

[0055] Obtain the user verification frequency data in Q time periods and construct the corresponding user verification frequency time series ;in Indicates at time The number of identity authentications that occurred within, g is the length of the time series, that is, the number of authentications within the time span of data collection; the complex authentication frequency time series X(t) is decomposed into several intrinsic mode functions IMFs, each IMF represents a different frequency component of the data, including: identifying all local maxima and local minima in the authentication frequency time series X(t). These extreme points will be used to generate envelopes. The upper envelope is generated by the local maximum points, and the lower envelope is generated by the local minimum points. The upper and lower envelopes use cubic spline interpolation to connect these extreme points to form the upper and lower limit curves of the data series, respectively. Calculate the mean m(t) of the upper and lower envelopes: ; Calculate the difference between the verification frequency time series and the envelope mean , the expression is: ; It should be satisfied that in the entire time period, the number of maximum and minimum points of the signal is the same or differs by at most 1, and at any time, the local average of the upper envelope and the lower envelope is zero. Remove the extracted IMF component from the original sequence, the expression is: ;Will As a new sequence, continue to decompose to obtain the second IMF component and the remaining amount , until the remaining amount Until it becomes monotonic, the entire sequence X(t) is decomposed into: ;in It is the bth IMF, is the final residual term, each IMF component Indicates the different frequency components in the verification frequency signal and calculates the energy of each IMF component , which is used to evaluate its contribution to the entire signal. The energy calculation formula is: ; According to the calculated energy of each IMF component Calculate the verification frequency anomaly index, the expression is: ; In the formula, AQ is the verification frequency anomaly index, p represents the number of high-frequency IMF components, usually the first several IMFs are selected to reflect the rapid fluctuation of frequency, and k represents the total number of all IMFs.

[0056] The larger the verification frequency anomaly index is, the greater the fluctuation or anomaly in the user's identity authentication frequency is. This usually means that the device management system may not be able to accurately distinguish whether the current user behavior is consistent with its normal pattern. A high anomaly index may be caused by frequent verification attempts, an unusual number of verification failures, or a verification frequency that is inconsistent with the user's previous behavior. In this case, the system's ability to distinguish is weakened, and additional security measures (such as multi-factor verification or account lockout) may be required to confirm the user's identity and prevent potential security threats.

[0057] On the contrary, the smaller the verification frequency anomaly index is, the more consistent the user's verification frequency is with their historical behavior pattern, without significant fluctuations or anomalies. This indicates that the device management system can accurately distinguish the current user behavior, which is consistent with the user's previous operating habits. A lower anomaly index usually means that the user's authentication behavior is normal, and the system can continue to trust the current operation without additional security intervention. In this case, the system has a higher ability to distinguish, ensuring a smooth user experience and normal operating process.

[0058] S3: Based on the extracted operational behavior deviation characteristics and verification frequency abnormal characteristics, a data prediction model is constructed. The weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period is determined according to the model output results. The comprehensive distinction accuracy coefficient is calculated by weighted average based on the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period.

[0059] The typing rhythm deviation index and the verification frequency anomaly index are converted into the first eigenvector, and the first eigenvector is used as the input of the machine learning model. The machine learning model predicts the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period with each group of first eigenvectors, and the value label is the prediction target. The training target is to minimize the sum of the prediction errors of the weight assignment labels for distinguishing the accuracy of different user behaviors of the device management system in all time periods. The model training is stopped when the sum of the prediction errors converges, and the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period is determined according to the model output results. Among them, the machine learning model is a polynomial regression model, and the comprehensive distinction accuracy coefficient is calculated by weighted average according to the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period.

[0060] The method for obtaining the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period is as follows: from the first feature vector training data of the trained machine learning model, the corresponding function expression is obtained: ; In the formula, is the output function of the model, is the typing rhythm deviation index, AQ is the verification frequency abnormality index, Assign weights to the accuracy of the device management system in distinguishing different user behaviors in each time period.

[0061] S4: Compare and analyze the obtained comprehensive distinction accuracy coefficient with the gradient accuracy threshold, and divide the accuracy of the device management system in distinguishing different user behaviors into accurate distinction, incompletely accurate distinction and inaccurate distinction according to the analysis results.

[0062] The obtained comprehensive discrimination accuracy coefficient is compared with the gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and the comprehensive discrimination accuracy coefficient is compared with the first standard threshold and the second standard threshold respectively;

[0063] If the comprehensive distinction accuracy coefficient is greater than the second standard threshold, it means that the device management system has high accuracy in distinguishing different user behaviors, and a high accuracy signal is generated and classified as accurate distinction;

[0064] If the comprehensive distinction accuracy coefficient is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it means that the accuracy of the device management system in distinguishing different user behaviors is average, and a medium accuracy signal is generated at this time, and it is classified as an incompletely accurate distinction;

[0065] If the comprehensive distinction accuracy coefficient is less than the first standard threshold, it means that the device management system has low accuracy in distinguishing different user behaviors. In this case, a low accuracy signal is generated and classified as an inaccurate distinction.

[0066] S5: When the device management system is able to accurately distinguish users, for users that have been accurately distinguished, the management system reduces the detail of real-time behavior records; for inaccurate distinctions, the dynamic isolation mechanism is immediately activated to isolate the operation behaviors between users.

[0067] When the system confirms that it can accurately distinguish the current user's behavior, and the user's operation mode is consistent with his / her historical records, and the verification frequency and operation behavior (such as typing rhythm and application usage) are within the normal range, the system can take the following optimization measures:

[0068] a. Reduce the level of detail of real-time behavior records, reduce unnecessary resource consumption, improve system performance, and maintain basic security monitoring. When the system accurately distinguishes users, the frequency of real-time behavior monitoring or the level of detail of the data can be reduced. For example, reduce the collection of high-frequency data such as typing speed and mouse movement trajectory, and only keep records of key operations (such as file modification and access to sensitive applications). Reducing the level of detail of monitoring will not affect the system's overall control of user behavior, and it reduces the use of storage and computing resources, making the system run more efficiently.

[0069] b. Optimize user experience: Reduce interference with users and enhance operational experience while maintaining security. Reduce security measures for confirmed users, such as reducing the frequency of additional identity authentication (such as multi-factor authentication) to avoid unnecessary security reminders or interruptions to normal behavior. The user experience is smoother, and operations are not frequently interfered with by security measures. At the same time, the system still maintains appropriate monitoring to ensure that its behavior is consistent with normal operations.

[0070] For users who cannot be accurately distinguished: start the dynamic isolation mechanism.

[0071] When the system cannot accurately distinguish user behavior, that is, when the verification frequency is abnormal, the operation mode deviates significantly from historical data, or the system is difficult to confirm whether the current operation conforms to the normal user behavior, the dynamic isolation mechanism should be activated immediately to ensure the security of the system and data. At this time, the following measures can effectively isolate potential threats:

[0072] a. Triggering of dynamic isolation mechanism: When the accuracy of distinguishing user behavior is low, prevent potential security risks such as malicious operations or user identity theft. The system can trigger the dynamic isolation mechanism to limit or isolate the user's operating permissions. The mechanism automatically adjusts the scope of the user's permission access or isolates his access operations according to the abnormal degree of the user's current behavior. Restricting access: such as restricting access to sensitive data, file systems, or reducing the user's control over system resources. Prevent possible cross-user attacks or data leakage by isolating the user's operating environment from other users. For example, restrict user access to shared folders or turn off sharing functions for other devices. The system can increase the detail of real-time behavior records, increase detailed monitoring of typing behavior, file operations, and network activities, and ensure timely capture of abnormal behavior.

[0073] b. Enhanced identity verification: Confirm the real identity of the user to prevent malicious users from impersonating accounts or devices. The system can force a stricter identity verification process. For example, in the case of abnormal verification frequency, the user is required to re-perform multi-factor authentication (MFA), biometrics (such as fingerprint or facial recognition), etc. to ensure that the current operation is from a legitimate user. Through multi-layer identity verification, the system can better confirm the user's identity, thereby restoring normal operating permissions or further restricting suspicious behavior.

[0074] c. Notify administrators and generate security alerts: Ensure that potential security threats receive timely manual intervention and investigation. When the system cannot accurately distinguish user behavior and triggers the isolation mechanism, it can send real-time alerts to administrators, generate abnormal behavior reports, and record user operations in detail (such as abnormal authentication frequency, file access records, etc.). Administrators can take further security response measures based on the security reports generated by the system, such as temporarily freezing user accounts, conducting in-depth investigations, or analyzing potential attacks.

[0075] In this application, for users who have been accurately distinguished, the system can reduce the detail of real-time behavior records, reduce resource consumption, and optimize the user experience. After confirming that the user's operating mode is consistent with historical data, the system does not need to maintain high-intensity monitoring, and can continue to maintain basic security checks to ensure efficient operation. For users who cannot be accurately distinguished, the dynamic isolation mechanism should be started immediately to limit or isolate the user's operating permissions to ensure that potential threats do not affect other users or systems. Combined with enhanced identity authentication processes and abnormal behavior monitoring, ensure that the system can respond in a timely manner and take corresponding security measures when faced with potential risks. This dynamically adjusted strategy can not only ensure system security, but also improve resource utilization efficiency.

[0076] S6: For incompletely accurate distinctions, the abnormal degree of accuracy of the device management system in distinguishing different user behaviors within a fixed time period is predicted, and whether to trigger isolation and protection measures is determined based on the prediction results.

[0077] For incompletely accurate distinctions, that is, the comprehensive distinction accuracy coefficient generated in a fixed time period is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the comprehensive distinction accuracy coefficients generated in subsequent fixed time periods that are greater than or equal to the first standard threshold and less than or equal to the second standard threshold are collected, and a corresponding data set is established to distinguish the abnormal degree of different user behaviors for the device management system. To make a prediction, the expression is: ; In the formula, is the comprehensive discrimination accuracy coefficient in the sth time period, is the second standard threshold, is the historical normal typing rhythm deviation index benchmark value, Function of the abnormality prediction model, is the weight coefficient, which indicates the influence weight of each deviation on the abnormality degree. The verification frequency abnormality index benchmark value under historical normal conditions, is the typing rhythm deviation index in the sth time period, is the verification frequency anomaly index in the sth time period.

[0078] According to the predicted abnormality , set the threshold Ethreshold that triggers isolation and protection measures. When the value is greater than or equal to the threshold, isolation and protection measures are triggered. Isolation measures limit the user's access rights to the system or specific resources to prevent the expansion of potential malicious behavior.

[0079] In this embodiment, the mobile office equipment management system accurately distinguishes different user behaviors by analyzing user operation behavior data and identity authentication data. First, the system obtains and preprocesses operation behavior and identity authentication data in different time periods, and then extracts operation behavior deviation characteristics and verification frequency abnormal characteristics. Based on these characteristics, a data prediction model is constructed to calculate the weight assignment for distinguishing the accuracy of user behavior in each time period, and obtain the comprehensive distinction accuracy coefficient by weighted average. Then, the system compares the coefficient with the gradient accuracy threshold and divides it into accurate distinction, incompletely accurate distinction, and inaccurate distinction. For users with accurate distinction, the system reduces the detail of real-time behavior records; for users with inaccurate distinction, the dynamic isolation mechanism is immediately started. For users with inaccurate distinction, the system determines whether to trigger isolation and protection measures by predicting the degree of abnormality. This method ensures that the system can effectively manage user behavior and improve device security and resource utilization efficiency.

[0080] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0081] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0082] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the objects associated with each other are in an "or" relationship, but it may also indicate an "and / or" relationship, which can be understood by referring to the context. A person of ordinary skill in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this article can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0083] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A remote monitoring and management method for mobile office equipment based on the Internet of Things, characterized in that: The steps include: S1: obtaining operation behavior data and identity authentication data of different users on mobile office devices in several time periods, and preprocessing the operation behavior data and identity authentication data obtained in each time period; S2: extracting features from the pre-processed operation behavior data and identity verification data of different users in each time period, respectively extracting operation behavior deviation features from the operation behavior data and verification frequency abnormal features from the identity verification data; The step S2 specifically includes: generating a typing rhythm deviation index according to the extracted operation behavior deviation characteristics in the operation behavior data, and the method for obtaining the typing rhythm deviation index is: The time interval between each key press of the user is represented as a time series, and the user's reference time series and current time series are constructed respectively; the reference time series , indicating the user's standard typing rhythm; the current time series , represents the user's current typing rhythm; among them, and Represents the time interval from the user pressing a key to the next key, calculates the item-by-item difference between the two time series R and C, and uses the Euclidean distance to measure the distance between two time points. The expression is: ;in, represents the time interval difference between time points n and m, The nth typing interval in the reference time series, is the mth typing interval in the current time series; the size of the generated distance matrix D is n×m, where each element Represents the difference between sequences R and C at corresponding time points, and uses a recursive method to construct a cumulative distance matrix D' to find the optimal matching path. The element D'(i, j) of the cumulative distance matrix represents the minimum cumulative path cost to reach point (i, j), and the calculation formula is: ; represents the cumulative distance between sequences R and C at the previous time point, Indicates the cumulative distance that the current time point moves forward one step in the reference sequence or the current sequence. Represents the cumulative distance of moving one step on both sequences at the same time; find the optimal matching path W from (1,1) to (n,m) through the cumulative distance matrix D′, the path length is L, the optimal path is found by minimizing the overall cumulative distance, so that the points of the two sequences match, and the path W is expressed as: ;in Indicates that at the Lth matching point in the path, the typing rhythm deviation index is calculated, and the expression is: ; In the formula, is the typing rhythm deviation index; The verification frequency anomaly index is generated according to the verification frequency anomaly features in the extracted identity authentication data. The method for obtaining the verification frequency anomaly index is as follows: Obtain the user verification frequency data in Q time periods and construct the corresponding user verification frequency time series ;in Indicates at time The number of identity authentications that occurred within the time span, g is the length of the time series, that is, the number of authentications within the time span of data collection; the complex authentication frequency time series X(t) is decomposed into several intrinsic mode functions IMFs, each IMF represents a different frequency component of the data, including: identifying all local maxima and local minima in the authentication frequency time series X(t), generating an upper envelope through local maximum points, and generating a lower envelope through local minimum points. The upper and lower envelopes use cubic spline interpolation to connect these extreme points to form the upper and lower limit curves of the data series, respectively, and calculating the mean m(t) of the upper and lower envelopes: ; Calculate the difference between the verification frequency time series and the envelope mean , the expression is: ; Remove the extracted IMF components from the original sequence, the expression is: ;Will As a new sequence, continue to decompose to obtain the second IMF component and the remaining amount , until the remaining amount Until it becomes monotonic, the entire sequence X(t) is decomposed into: ;in is the bth IMF, is the final residual term, each IMF component Indicates the different frequency components in the verification frequency signal and calculates the energy of each IMF component , the energy calculation formula is: ; According to the calculated energy of each IMF component Calculate the verification frequency anomaly index, the expression is: ; Where AQ is the verification frequency anomaly index, p represents the number of high-frequency IMF components, and k represents the total number of all IMFs; S3: Based on the extracted operation behavior deviation characteristics and verification frequency abnormal characteristics, a data prediction model is constructed, and the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period is determined according to the model output results, and the comprehensive distinction accuracy coefficient is calculated by weighted average according to the weight assignment of the accuracy of the device management system in distinguishing different user behaviors in each time period; The step S3 specifically includes: converting the typing rhythm deviation index and the verification frequency anomaly index into a first eigenvector, taking the first eigenvector as the input of the machine learning model, the machine learning model uses each group of first eigenvectors to predict the weighted value labels of the accuracy of the device management system in distinguishing different user behaviors in each time period as the prediction target, and minimizing the sum of the prediction errors of the weighted value labels of the accuracy of the device management system in distinguishing different user behaviors in all time periods as the training target, training the machine learning model until the sum of the prediction errors reaches convergence and stopping the model training, determining the weighted value of the accuracy of the device management system in distinguishing different user behaviors in each time period according to the model output results, wherein the machine learning model is a polynomial regression model, and the comprehensive distinction accuracy coefficient is calculated by weighted average according to the weighted value of the accuracy of the device management system in distinguishing different user behaviors in each time period; S4: Compare and analyze the obtained comprehensive distinction accuracy coefficient with the gradient accuracy threshold, and divide the accuracy of the device management system in distinguishing different user behaviors into accurate distinction, incompletely accurate distinction, and inaccurate distinction according to the analysis result; S5: When the device management system can accurately distinguish users, for users that have been accurately distinguished, the management system reduces the detail of real-time behavior records; for users that are not accurately distinguished, the dynamic isolation mechanism is immediately activated to isolate the operation behaviors between users; S6: For incompletely accurate distinctions, the abnormal degree of accuracy of the device management system in distinguishing different user behaviors within a fixed time period is predicted, and whether to trigger isolation and protection measures is determined based on the prediction results.

2. The method for remote monitoring and management of mobile office equipment based on the Internet of Things according to claim 1 is characterized in that: In S4, the obtained comprehensive discrimination accuracy coefficient is compared with the gradient accuracy threshold, and the accuracy of different user behaviors of the device management system is divided according to the analysis result, specifically: The obtained comprehensive discrimination accuracy coefficient is compared with the gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and the comprehensive discrimination accuracy coefficient is compared with the first standard threshold and the second standard threshold respectively; If the comprehensive distinction accuracy coefficient is greater than the second standard threshold, it means that the device management system has high accuracy in distinguishing different user behaviors, and a high accuracy signal is generated and classified as accurate distinction; If the comprehensive distinction accuracy coefficient is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it means that the accuracy of the device management system in distinguishing different user behaviors is average, and a medium accuracy signal is generated at this time, and it is classified as an incompletely accurate distinction; If the comprehensive distinction accuracy coefficient is less than the first standard threshold, it means that the device management system has low accuracy in distinguishing different user behaviors. In this case, a low accuracy signal is generated and classified as an inaccurate distinction.

3. The method for remote monitoring and management of mobile office equipment based on the Internet of Things according to claim 1 is characterized in that: In S6, for the incompletely accurate distinction, the abnormal degree of the accuracy of the device management system in distinguishing different user behaviors within a fixed time period is predicted, specifically: For incompletely accurate distinctions, that is, the comprehensive distinction accuracy coefficient generated in a fixed time period is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the comprehensive distinction accuracy coefficients generated in subsequent fixed time periods that are greater than or equal to the first standard threshold and less than or equal to the second standard threshold are collected and a corresponding data set is established; Distinguish the abnormality of different user behaviors for the device management system To make a prediction, the expression is: ; In the formula, is the comprehensive discrimination accuracy coefficient in the sth time period, is the second standard threshold, is the historical normal typing rhythm deviation index benchmark value, Function of the abnormality prediction model, is the weight coefficient, which indicates the influence weight of each deviation on the abnormality degree. is the verification frequency abnormality index benchmark value under historical normal conditions, is the typing rhythm deviation index in the sth time period, is the verification frequency anomaly index in the sth time period; According to the predicted abnormality , set the threshold Ethreshold for triggering isolation and protection measures; when When the value is greater than or equal to the threshold Ethreshold, isolation and protection measures are triggered.

Images