Process identification method and system based on power supply side channel of mobile equipment

Abstract

The invention belongs to the technical field of client identification, and particularly relates to a process identification method and system based on a mobile equipment power supply side channel, and the system comprises a data acquisition module, a data processing module, a feature extraction and selection module and a classification identification module. And efficient and accurate identification can be realized under the condition of not depending on network flow or system authority by utilizing the relationship between the identification information and the process running state.

Description

Technical Field

[0001] The present application belongs to the technical field of client identification, and specifically relates to a process identification method and system based on a power side channel of a mobile device. Background Art

[0002] With the widespread popularity of smartphones, users have an increasing demand for identifying and managing processes (such as applications, system processes, etc.) running on mobile devices. For example, users want to know whether the processes running on the device are safe, or optimize the running status to save resources. In the existing technology, most common identification methods are based on data analysis at the software level, which mainly include the following types: network traffic-based analysis methods, which identify by analyzing the network traffic characteristics generated by the process. For example, some studies use deep packet inspection (DPI) and traffic pattern classification to identify running processes. However, with the popularization of encrypted communication protocols (such as HTTPS, QUIC), the traffic content is gradually encrypted, resulting in a significant decrease in the accuracy of network traffic-based identification methods; system behavior-based monitoring methods, which identify by analyzing the system calls, memory usage or process information of the running process on the device. However, this method has high requirements for system permissions, usually requiring root permissions or high-privilege access capabilities, which becomes unrealistic under the current device security policy. Summary of the invention

[0003] Based on the above problems, this application provides a new identification method that does not rely on traditional network or system behavior analysis, but is based on the power side channel during the charging process of mobile devices to achieve efficient and accurate process identification. Its technical solution is: A process identification method based on the power side channel of a mobile device, wherein a resistor is set in the charging device to sense the voltage change during the charging process; the voltage data at both ends of the resistor is collected in real time, and the small voltage fluctuations during the charging process are captured at a set frequency. The power signal during the charging process of the device is directly collected, and the relationship between the power signal and the running status of different processes is utilized to realize the identification of different processes.

[0004] Preferably, the method comprises the following steps: S1, collecting the power signal of the mobile device that is charging and running the process; S2, preprocessing the collected data; S3, extracting features from the preprocessed data, extracting variables that can effectively characterize the characteristics of different processes, and selecting the optimal feature set through an optimization algorithm; S4. Use the extracted feature set to train the classification model and build a classifier that can identify different processes to achieve the identification of mobile device processes.

[0005] Preferably, the specific steps of step S2 are as follows: S2.1, denoising each piece of collected data; S2.2, cutting the denoised data; S2.3, using the above cut data to detect the start and end time of the process using a change point detection algorithm based on cumulative summation, and removing data outside the process running time; S2.4. Process each piece of data according to steps S2.1, S2.2, and S2.3 until all data are processed.

[0006] Preferably, the specific steps of the change point detection algorithm based on cumulative summation in step S2.3 are as follows: S2.3.1. Input a piece of cutting data and the corresponding timestamp ; Calculate the standard deviation of data P , as the difference threshold; S2.3.2. Initialize the change point list ; Set the initial minimum point , the initial minimum time point , the initial minimum cumulative sum ; S2.3.3, Cumulative summation and change point detection: Traverse the time series data and calculate the cumulative sum ,in ; For each data point : 1) Calculate the difference between the current point and the previous point ; 2) Check the difference. If the following conditions are met, the current point is considered as a change point and the change point and the timestamp are added to : First, ; Second, the time difference between the current time and the previous change point is greater than the set time; Third, the current cumulative sum At least higher than the lowest cumulative sum or the starting cumulative sum after the last change point; 3) Starting from the current point, recalculate the lowest point , Lowest point time and the lowest cumulative sum ; S2.3.4. Output results: Output all detected change points and their corresponding timestamps.

[0007] Preferably, the specific steps of step S3 are as follows: S3.1, extract features from each preprocessed data using a feature extraction algorithm to generate a preliminary feature set; S3.2, using the feature selection algorithm to select the above-mentioned prepared feature set, and select the optimal K features; S3.3. Based on the features selected in S3.2, the preliminary feature set is screened to generate a final feature set.

[0008] Preferably, the specific steps of step S3.1 are as follows: S3.1.1, Preprocessing: Extract the local maximum or minimum peak and its corresponding timestamp that meet the following conditions: Its value is larger or smaller than the previous and subsequent measurements, that is, and ; and ; Its value is at least α times larger or smaller than the previous local maximum or minimum peak, that is, ; ; use , as well as Three sequences are used to represent the changes in the local peak values ​​of the data. They are calculated as follows: For a local peak and its timestamp , if it is a local maximum peak, then record , otherwise it is recorded as ; if , then Recorded as an element of Recorded as an element of ; S3.1.2. Calculation characteristics: 1) For the data sequence P, , as well as Calculate the following time domain features respectively: use X to represent data P, , as well as , the calculation method is as follows: average value ; Standard Deviation ; Skewness ; Kurtosis ; RMS ; Maximum , minimum ; The 30th, 60th, and 90th percentile data measurements: , , ; The 20th, 50th, and 80th percentile data measurements: , , ; The 10th, 40th, and 70th percentile data measurements: , , ; 2) For data , calculate different lags The autocorrelation function of is: ,in, is the lag time, indicating the degree of autocorrelation of the data; Apply aggregate function calculations ; Aggregation functions include mean, variance var, standard deviation std and median median; 3) Data Applying the fast Fourier transform, we get the vector , calculate the following frequency domain features: Spectral mean ,in is the amplitude of the spectrum F; Spectral entropy ,in ; Spectral diffusion ; Spectral skewness ; Spectral kurtosis ; Spectral flatness ; S3.1.3 outputs the features calculated above as a preliminary feature set.

[0009] Preferably, the prepared feature set is used to calculate the correlation table of features with respect to different processes using selection.select_features() provided by tsfresh, and is sorted in ascending order based on the p-value, and the top K features are selected.

[0010] Preferably, the specific steps of step S4 are as follows: S4.1. Randomly divide the final feature set into three parts: training set, validation set and test set; S4.2. Train the classifier using the training set; S4.3. Use the validation set to test the effect of the classifier on process identification and calculate performance indicators such as accuracy, recall, and F1 score; S4.4. Adjust classifier hyperparameters to optimize classification results; S4.5. Repeat steps S4.2 and S4.3 until the classifier has the best process recognition effect on the validation set, and finally use the test set to test the recognition effect of the final model.

[0011] A process identification system based on a power side channel of a mobile device, comprising: The data acquisition module is used to collect the power signal of the mobile device during the charging process, collect the voltage data of the mobile device during charging through the built-in sensor or the external data acquisition device, and transmit the data to the preprocessing module in real time; The data processing module pre-processes the collected data, including smoothing filtering, cutting and change point detection, and outputs the pre-processed time series data; The feature extraction and selection module is used to extract features from the preprocessed data, select the most representative feature set, and output the feature set of the data; The classification and recognition module uses the trained random forest model to classify the extracted features and obtain the recognition results of the process.

[0012] Compared with the prior art, the present invention has the following beneficial effects: The present invention collects power signals during the charging process and uses a machine learning algorithm to classify and identify them, so as to accurately identify the processes running on the mobile device without interfering with the user's operation. It has the advantages of high recognition accuracy, good real-time performance, and simple implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A schematic diagram of a scenario for performing an identification method provided by an embodiment of the present invention; Figure 2 A schematic diagram of a process identification method provided by an embodiment of the present invention; Figure 3 A schematic diagram of the structure of a process identification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0014] In order to more clearly illustrate the technical solution of the present invention, the present invention will be described in detail below with reference to the accompanying drawings.

[0015] The technical solution of the present application is described in detail below through specific embodiments and drawings. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application, and the specific technical features may be combined with each other.

[0016] See also Figure 1 , is a schematic diagram of an operating environment applicable to an embodiment of the present invention. Figure 1 As shown, the user's mobile device 100 is connected to the modified charging device 200 via a USB charging cable, and the charging device 200 is connected to a terminal server 300. The connection can be a network connection or a physical line connection.

[0017] See also Figure 2 ,This embodiment provides a process identification method based on the power side channel of a mobile device, such as Figure 2 As shown, the method comprises the following steps: S1. Collect the power signal of the mobile device that is charging and running the process.

[0018] As an implementation method of the embodiment of the present invention, the specific steps are as follows: S1.1. Insert a small resistor into the charging device to sense the voltage change during the charging process; S1.2. The voltage data across the resistor is collected in real time through the ADQ (analog-digital quantization) module, capturing the tiny voltage fluctuations during the charging process at a frequency of 2KHz.

[0019] S2. Preprocess the collected data: As an implementation method of an embodiment of the present invention, preprocessing is performed on each data sample in multiple data sets, and the specific steps are as follows: S2.1. Filter each piece of collected data using a low-pass filter with a cutoff frequency of 60 Hz; S2.2, applying a sliding window with a window length of 5 seconds and an overlap rate of 75% to the above processed data to cut the data; S2.3. Use the change point detection algorithm based on cumulative summation to detect the start and end time of the process on the above-mentioned cut data, and remove the data within the non-process running time.

[0020] Among them, the specific steps of the change point detection algorithm based on cumulative summation are as follows: S2.3.1, Preprocessing: 1) Input a piece of data to be cut and the corresponding timestamp ; 2) Calculate the standard deviation of data P , as the difference threshold; S2.3.2, Initialization: 1) Initialize the change point list ; 2) Set the initial minimum point , the initial minimum time point , the initial minimum cumulative sum ; S2.3.3, Accumulation and change point detection: 1) Traverse the time series data and calculate the cumulative sum ,in ; 2) For each data point : Calculate the difference between the current point and the previous point ; Check the difference. If the following conditions are met, the current point is considered as a change point and the change point and the timestamp are added to : ① ; ②The time difference between the current time and the previous change point is greater than 250 milliseconds; ③Current cumulative sum At least 25% higher than the lowest cumulative sum (or starting cumulative sum) after the previous change point.

[0021] 3) Starting from the current point, recalculate the lowest point , Lowest point time and the lowest cumulative sum .

[0022] S2.3.4. Output results: Output all detected change points and their corresponding timestamps.

[0023] Step 3: Extract eigenvalues ​​and select features from preprocessed data: As an implementation method of an embodiment of the present invention, the specific steps of extracting features from the data set processed in step 2 are as follows: S3.1. Use feature extraction algorithm to extract features from each preprocessed data to generate a feature set.

[0024] The specific steps of the feature extraction algorithm are as follows: S3.1.1, Preprocessing: 1) Input cutting and remove a piece of data that is not the process running time and the corresponding timestamp ; 2) Calculate the standard deviation of data P ; 3) Extract the local maximum (minimum) peak value and its corresponding timestamp that meets the following conditions: ① Its value is larger (smaller) than the previous and subsequent measurements, that is and ( and ); ② Its value is at least α times larger (α times smaller) than the previous local maximum (minimum) peak value, that is, ( ); use , as well as Three sequences are used to represent the changes in the local peak values ​​of the data. They are calculated as follows: Here .

[0025] 4) Calculation , as well as : ①For a local peak and its timestamp , if it is a local maximum peak, then record , otherwise it is recorded as ; ②If , then Recorded as an element of Recorded as an element of ③ .

[0026] S3.1.2. Calculation characteristics: 1) For the data sequence P, , as well as Calculate the following time domain features respectively: use X to represent data P, , as well as , the calculation method is as follows: average value ; Standard Deviation ; Skewness ; Kurtosis ; RMS ; Maximum , minimum ; The 30th, 60th, and 90th percentile data measurements: , , ; The 20th, 50th, and 80th percentile data measurements: , , ; The 10th, 40th, and 70th percentile data measurements: , , ; 2) For data , calculate different lags The autocorrelation function of is: ,in, is the lag time, indicating the degree of autocorrelation of the data; Then, apply the aggregate function to calculate ; Aggregation functions include mean, variance var, standard deviation std, and median median.

[0027] 3) Data Applying the fast Fourier transform, we get the vector , calculate the following frequency domain features: Spectral mean ,in is the amplitude of the spectrum F; Spectral entropy ,in ; Spectral diffusion ; Spectral skewness ; Spectral kurtosis ; Spectral flatness ; S3.1.3. Output all the features calculated above as a preliminary feature set.

[0028] S3.2. Use the selection.select_features() provided by tsfresh to calculate the correlation table of features relative to different processes, sort them in ascending order based on the p value, and select the top K features; S3.3. Based on the features selected in S3.2, the preliminary feature set is screened to generate the final feature set: .

[0029] S4. Training classifier: As an implementation method of the embodiment of the present invention, the feature set processed in step 3 is used for training a random forest classifier to finally generate a process identification model. The specific steps are as follows: S4.1, randomly divide the final feature value set into three parts: training set, validation set and test set in the ratio of 7:2:1; S4.2. Use the training set to train the random forest classifier and build a basic model containing multiple decision trees; S4.3. Use the validation set to evaluate the classification accuracy, recall, and F1 score of the random forest classifier model. S4.4. Adjust the number of decision trees and the maximum depth of decision trees in the random forest to optimize the classification performance; S4.5. Repeat S4.2 and S4.3 until the classifier has the best process recognition effect on the validation set, and finally use the test set to test the recognition effect of the final model.

[0030] Figure 3 is a schematic diagram of the structure of a process identification device according to an embodiment of the present invention. The process identification device can be implemented Figure 2 The method provided by the illustrated embodiment, the process identification system comprises: The data acquisition module 301 is used to collect the power signal of the mobile device during the charging process, collect the voltage data of the mobile device during charging through the built-in sensor or the external data acquisition device, and transmit the data to the pre-processing module in real time; The data processing module 302 performs preprocessing on the collected data, including smoothing filtering, cutting and change point detection, and outputs the preprocessed time series data; The feature extraction and selection module 303 is used to extract features from the preprocessed data, select the most representative feature set, and output the feature set of the data; The classification and recognition module 304 uses the trained random forest model to classify the extracted features and obtain the recognition result of the process; In summary, the present invention realizes process identification based on the power side channel of the mobile device by making slight changes to the charging device.

[0031] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A process identification method based on the power side channel of a mobile device, characterized in that: A resistor is set in the charging device to sense the change in voltage during the charging process. The voltage data at both ends of the resistor is collected in real time to capture the tiny fluctuations in voltage during the charging process at a set frequency. The power signal during the charging process of the device is directly collected and the relationship between the power signal and the running status of different processes is used to identify different processes.

2. The process identification method based on the power side channel of a mobile device according to claim 1 is characterized in that: The following steps are involved: S1, collecting the power signal of the mobile device that is charging and running the process; S2, preprocessing the collected data; S3, extracting features from the preprocessed data, extracting variables that can effectively characterize the characteristics of different processes, and selecting the optimal feature set through an optimization algorithm; S4. Use the extracted feature set to train the classification model and build a classifier that can identify different processes to achieve the identification of mobile device processes.

3. The process identification method based on the power side channel of a mobile device according to claim 1 is characterized in that: The specific steps of step S2 are as follows: S2.1, denoising each piece of collected data; S2.2, cutting the denoised data; S2.3, using the above cut data to detect the start and end time of the process using a change point detection algorithm based on cumulative summation, and removing data outside the process running time; S2.

4. Process each piece of data according to steps S2.1, S2.2, and S2.3 until all data are processed.

4. The process identification method based on the power side channel of a mobile device according to claim 3 is characterized in that: The specific steps of the change point detection algorithm based on cumulative summation in step S2.3 are as follows: S2.3.

1. Input a piece of cutting data and the corresponding timestamp ; Calculate the standard deviation of data P , as the difference threshold; S2.3.

2. Initialize the change point list ; Set the initial minimum point , the initial minimum time point , the initial minimum cumulative sum ; S2.3.3, Cumulative summation and change point detection: Traverse the time series data and calculate the cumulative sum ,in ; For each data point : 1) Calculate the difference between the current point and the previous point ; 2) Check the difference. If the following conditions are met, the current point is considered as a change point and the change point and the timestamp are added to : First, ; Second, the time difference between the current time and the previous change point is greater than the set time; Third, the current cumulative sum At least higher than the lowest cumulative sum or the starting cumulative sum after the last change point; 3) Starting from the current point, recalculate the lowest point , Lowest point time and the lowest cumulative sum ; S2.3.

4. Output results: Output all detected change points and their corresponding timestamps.

5. The process identification method based on the power side channel of a mobile device according to claim 1, characterized in that: The specific steps of step S3 are as follows: S3.1, extract features from each preprocessed data using a feature extraction algorithm to generate a preliminary feature set; S3.2, using the feature selection algorithm to select the above-mentioned prepared feature set, and select the optimal K features; S3.

3. Based on the features selected in S3.2, the preliminary feature set is screened to generate a final feature set.

6. The process identification method based on the power side channel of a mobile device according to claim 5 is characterized in that: The specific steps of step S3.1 are as follows: S3.1.1, Preprocessing: Extract the local maximum or minimum peak and its corresponding timestamp that meet the following conditions: Its value is larger or smaller than the previous and subsequent measurements, that is, and ; and ; Its value is at least α times larger or smaller than the previous local maximum or minimum peak, that is, ; ; use , as well as Three sequences are used to represent the changes in the local peak values ​​of the data. They are calculated as follows: For a local peak and its timestamp , if it is a local maximum peak, then record , otherwise it is recorded as ; if , then Recorded as an element of Recorded as an element of ； S3.1.

2. Calculation characteristics: 1) For the data sequence P, , as well as The following time domain features are calculated respectively: Let X represent data P, , as well as , the calculation method is as follows: average value ; Standard Deviation ; Skewness ; Kurtosis ; RMS ; Maximum , minimum ; The 30th, 60th, and 90th percentile data measurements: , , ; The 20th, 50th, and 80th percentile data measurements: , , ; The 10th, 40th, and 70th percentile data measurements: , , ; 2) For data , calculate different lags The autocorrelation function of is: ,in, is the lag time, indicating the degree of autocorrelation of the data; Apply aggregate function calculations ; Aggregation functions include mean, variance var, standard deviation std and median median; 3) Data Applying the fast Fourier transform, we get the vector , calculate the following frequency domain features: Spectral mean ,in is the amplitude of the spectrum F; Spectral entropy ,in ; Spectral diffusion ; Spectral skewness ; Spectral kurtosis ; Spectral flatness ; S3.1.3 outputs the features calculated above as a preliminary feature set.

7. The process identification method based on the power side channel of a mobile device according to claim 5, characterized in that: The prepared feature set is used to calculate the correlation table of features relative to different processes using selection.select_features() provided by tsfresh, and is sorted in ascending order based on the p-value, and the top K features are selected.

8. The process identification method based on the power side channel of a mobile device according to claim 1 is characterized in that: The specific steps of step S4 are as follows: S4.

1. Randomly divide the final feature set into three parts: training set, validation set and test set; S4.

2. Train the classifier using the training set; S4.

3. Use the validation set to test the effect of the classifier on process identification and calculate performance indicators such as accuracy, recall, and F1 score; S4.

4. Adjust classifier hyperparameters to optimize classification results; S4.

5. Repeat steps S4.2 and S4.3 until the classifier has the best process recognition effect on the validation set, and finally use the test set to test the recognition effect of the final model.

9. A process identification system based on the power side channel of a mobile device, characterized in that: The process identification method based on the power side channel of a mobile device as claimed in any one of claims 1 to 8 comprises: The data acquisition module is used to collect the power signal of the mobile device during the charging process, collect the voltage data of the mobile device during charging through the built-in sensor or the external data acquisition device, and transmit the data to the preprocessing module in real time; The data processing module pre-processes the collected data, including smoothing filtering, cutting and change point detection, and outputs the pre-processed time series data; The feature extraction and selection module is used to extract features from the preprocessed data, select the most representative feature set, and output the feature set of the data; The classification and recognition module uses the trained random forest model to classify the extracted features and obtain the recognition results of the process.

Images