Safety detection method for abnormal startup of computer

Abstract

The invention discloses a security detection method for abnormal startup of a computer, and relates to the technical field of computers. The priority setting of current starting equipment is read through a system API interface, starting sequence data is analyzed, the damage condition of boot sector data and the delay condition of the starting process are judged, the accuracy of the starting sequence is comprehensively evaluated, the starting sequence is classified and adjusted according to the evaluation result, and therefore the starting sequence of the system is optimized, and the starting efficiency is improved. According to the method, the operating system equipment is ensured to be started preferentially, and a new starting sequence is finally displayed for a user to confirm through further analysis and generation of an adjustment strategy, so that the reliability and efficiency of system starting can be remarkably improved, the starting time can be shortened, the user experience can be enhanced, and potential system starting problems are prevented.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a safety detection method for abnormal startup of a computer. Background Art

[0002] The security detection of abnormal computer startup refers to the use of technical means to monitor and identify whether there are abnormal behaviors or abnormal startup methods during the startup process of the computer system. These anomalies include but are not limited to unauthorized hardware or firmware modifications, changes in the startup sequence, tampering with the boot program, and injection of malware. This detection is designed to promptly detect potential security threats and prevent malicious attackers from invading by exploiting vulnerabilities in the startup process, thereby protecting the integrity and security of the computer system. When monitoring the startup sequence, the system administrator or user can specify the startup sequence in the BIOS / UEFI settings, usually the hard disk first, then the optical drive, USB device, etc. However, if the user sets the wrong boot device priority in the BIOS / UEFI, the USB device or optical drive without an operating system is set as the first boot device instead of the hard disk containing the operating system. The computer may try to boot from the data hard disk instead of the operating system hard disk, resulting in a startup failure. At the same time, if the system configuration boot sequence is wrong, it may cause the computer to try to boot from multiple invalid devices each time it starts before it can finally find the correct boot device. Each startup process will be significantly extended, resulting in a longer system startup time and a poor user experience. Summary of the invention

[0003] The purpose of the present invention is to provide a safety detection method for abnormal startup of a computer to solve the shortcomings of the background technology.

[0004] In order to achieve the above object, the present invention provides the following technical solution: a computer abnormal startup security detection method, comprising the following steps:

[0005] S1: Use the system API interface to read the current boot device priority setting, parse the read boot sequence data, and determine the type and priority of each device;

[0006] S2: Check the boot device according to the preset rules and priorities, determine the damage of the boot sector data of the boot device, and evaluate the health of the boot sector; and analyze the delay in the boot process to evaluate the stability of the boot process;

[0007] S3: Comprehensively analyze the health of the boot sector and the stability of the boot process to evaluate the accuracy of the boot sequence;

[0008] S4: according to the accuracy evaluation result of the startup sequence, the startup sequence is divided into a startup sequence accurate situation, a startup sequence possibly accurate situation and a startup sequence inaccurate situation, and the startup sequence is adjusted according to the division result;

[0009] S5: For a possible accurate boot sequence, determine the device containing the operating system according to each boot device and its priority in the current boot sequence, and adjust its priority;

[0010] S6: further analyzing the accuracy of the adjusted startup sequence, generating an adjustment strategy according to the analysis result, and generating a new startup sequence through the adjustment strategy and displaying it to the user for confirmation.

[0011] Preferably, in S2, a boot sector data damage index is generated according to the damage of the boot sector data of the boot device, and the health of the boot sector is evaluated according to the boot sector data damage index. The method for obtaining the boot sector data damage index is:

[0012] The boot sector data is divided into data blocks, each data block contains n bytes, and a Reed-Solomon code is generated according to the boot sector data block, which includes data symbols and check symbols. The generating polynomial G(x) is used for encoding. The generating polynomial of the boot sector data is expressed as: G(x) = (x-α1)(x-α2)...(x-α2t); where α is a primitive element of the finite field, and t is the number of errors corrected; the product of the boot sector data polynomial D(x) and the generating polynomial G(x) plus the check symbol C(x) obtains the coded data polynomial E(x), which is expressed as: E(x) = D(x)*x 2t +C(x); calculate the check polynomial S(x) of the received polynomial R(x) to obtain the check value, which is expressed as: S(x)=R(x)modG(x) Calculate the error polynomial E(x) according to the check value S(x), detect the error position and number, use the Berlekamp-Massey algorithm to correct the error, calculate the number of errors that cannot be corrected e, and generate the boot sector data damage index, which is expressed as: Where Dc is the boot sector data damage index.

[0013] Preferably, the acquired boot sector data damage index is compared with a preset boot sector data damage index reference threshold. If the boot sector data damage index is greater than or equal to the preset boot sector data damage index reference threshold, the damage to the boot sector data is serious and the health of the boot sector is low, and a boot sector abnormal signal is generated at this time; if the boot sector data damage index is less than the preset boot sector data damage index reference threshold, the damage to the boot sector data is slight and the health of the boot sector is high, and a boot sector normal signal is generated at this time.

[0014] Preferably, in S2, the delay in the startup process is analyzed and a startup delay index is generated, and the stability of the startup process is evaluated according to the startup delay index. The method for obtaining the startup delay index is:

[0015] Obtain the delay data and related features during the startup process and establish a data matrix X, where each row represents a startup process and each column represents a feature. Standardize the data and the standardized data matrix is ​​Z. Calculate the covariance matrix: Where C is an m×m covariance matrix. The covariance matrix C is decomposed into eigenvalues ​​to obtain the eigenvalues ​​λi and the corresponding eigenvectors vi. The first k largest eigenvalues ​​and their corresponding eigenvectors are selected to form the principal component matrix W: The data is projected into the principal component space, and the expression is: T=ZW; Where W is the first k selected eigenvector matrix. The start delay index DQ is calculated according to the principal component scores, and the expression is: DQ=β*T; Where β is the weight vector.

[0016] Preferably, the acquired startup delay index is compared with a preset startup delay index reference threshold. If the startup delay index is greater than or equal to the preset startup delay index reference threshold, a startup delay signal is generated; if the startup delay index is less than the preset startup delay index reference threshold, no startup delay signal is generated.

[0017] Preferably, the boot sector data damage index and the startup delay index are converted into a first eigenvector, and the first eigenvector is used as the input of the machine learning model. The machine learning model uses the accuracy value label of the startup sequence predicted by each group of first eigenvectors as the prediction target, and minimizes the sum of the prediction errors of the accuracy value labels of all startup sequences as the training target. The machine learning model is trained until the sum of the prediction errors converges, and the model training is stopped. The accuracy value of the startup sequence is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

[0018] Preferably, in S4, according to the accuracy evaluation result of the startup sequence, the startup sequence is divided into a startup sequence accurate situation, a startup sequence possibly accurate situation and a startup sequence inaccurate situation, specifically:

[0019] Comparing the acquired accuracy value of the startup sequence with a gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and comparing the accuracy value of the startup sequence with the first standard threshold and the second standard threshold respectively;

[0020] If the accuracy value of the startup sequence is greater than the second standard threshold, it indicates that the startup sequence accuracy is high, and it is classified as the startup sequence accuracy situation, and a startup sequence accuracy signal is generated, and no adjustment is required, and the existing startup sequence is maintained. The system startup sequence is reasonable and efficient and does not need to be changed;

[0021] If the accuracy value of the boot sequence is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the boot sequence accuracy is medium, and it is classified as a boot sequence that may be accurate, and a boot sequence that may be accurate signal is generated, and the user manually checks the priority setting of the boot device;

[0022] If the accuracy value of the startup sequence is less than the first standard threshold, the startup sequence accuracy is low, it is classified as an inaccurate startup sequence situation, and an inaccurate startup sequence signal is generated to adjust the startup sequence.

[0023] Preferably, in S5, for the possible accurate situation of the boot sequence, the priority of each boot device in the current boot sequence and its priority is adjusted, specifically:

[0024] Read the boot order in the BIOS / UEFI setup and list all devices and their current priority, check each device in the boot order, determine the device that contains the operating system, read the boot sector of each device, check the boot record, adjust the boot order to ensure that the device containing the operating system has the highest priority, and write the adjusted boot order back to the BIOS / UEFI setup.

[0025] Preferably, in S6, the accuracy of the adjusted startup sequence is further analyzed, and an adjustment strategy is generated according to the analysis result, specifically:

[0026] The accuracy of the adjusted startup sequence is further analyzed. When the startup sequence is possibly accurate, that is, the accuracy value of the startup sequence generated within a fixed time period is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the accuracy values ​​of the startup sequences generated within a subsequent fixed time period that are greater than or equal to the first standard threshold and less than or equal to the second standard threshold are collected, and a data set is established. The mean and standard deviation of the data set are calculated, and an adjustment strategy is generated after analysis. The new startup sequence generated by the adjustment strategy is displayed to the user for confirmation.

[0027] Preferably, if the mean of the accuracy values ​​in the data set is greater than or equal to the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is less than the reference threshold of the standard deviation of the accuracy values, no warning signal is generated, the current startup sequence is maintained, and the user is prompted that the current startup sequence is stable and accurate;

[0028] If the mean of the accuracy values ​​is greater than or equal to the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is greater than or equal to the reference threshold of the standard deviation of the accuracy values, a level 3 warning signal is generated, and the user is advised to make slight adjustments to reduce fluctuations in the startup sequence and improve stability;

[0029] If the mean of the accuracy values ​​is less than the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is greater than or equal to the reference threshold of the standard deviation of the accuracy values, a secondary warning signal is generated, and the user makes substantial adjustments to improve the accuracy of the startup sequence;

[0030] If the mean of the accuracy values ​​is less than the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is less than the reference threshold of the standard deviation of the accuracy values, a first-level warning signal is generated and the user conducts a comprehensive inspection and adjustment to improve the accuracy of the startup sequence.

[0031] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0032] 1. The present invention uses the system API interface to read and parse the boot device priority setting, conducts a comprehensive analysis of the boot sector data of the boot device and the delay during the boot process, and evaluates the accuracy of the boot sequence. Through a comprehensive evaluation of the health of the boot sector and the stability of the boot process, a scientific adjustment strategy is formulated to ensure that the device containing the operating system in the boot device is started first. It can not only significantly improve the reliability and efficiency of system startup, reduce the startup time, and improve the user experience, but also prevent and detect potential security threats and ensure the integrity and security of the computer system.

[0033] 2. The present invention introduces advanced algorithms such as Reed-Solomon coding and principal component analysis (PCA) to accurately quantify boot sector data damage and startup delay, generate an accuracy value for the startup sequence, and classify and optimize the startup sequence according to a set threshold. The possible accurate startup sequence is analyzed and optimized to further improve the stability of system startup. Finally, the adjusted startup sequence is displayed through an intuitive user interface to provide user confirmation, ensuring the transparency and controllability of the adjustment process. Not only does it optimize the system startup process, but it also improves user trust and satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0035] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] For examples, see Figure 1 As shown, the security detection method for abnormal startup of a computer described in this embodiment includes the following steps:

[0038] S1: Use the system API interface to read the current boot device priority setting, parse the read boot sequence data, and determine the type and priority of each device;

[0039] S2: Check the boot device according to the preset rules and priorities, determine the damage of the boot sector data of the boot device, and evaluate the health of the boot sector; and analyze the delay in the boot process to evaluate the stability of the boot process;

[0040] S3: Comprehensively analyze the health of the boot sector and the stability of the boot process to evaluate the accuracy of the boot sequence;

[0041] S4: according to the accuracy evaluation result of the startup sequence, the startup sequence is divided into a startup sequence accurate situation, a startup sequence possibly accurate situation and a startup sequence inaccurate situation, and the startup sequence is adjusted according to the division result;

[0042] S5: For a possible accurate boot sequence, determine the device containing the operating system according to each boot device and its priority in the current boot sequence, and adjust its priority;

[0043] S6: further analyzing the accuracy of the adjusted startup sequence, generating an adjustment strategy according to the analysis result, and generating a new startup sequence through the adjustment strategy and displaying it to the user for confirmation.

[0044] Among them, in S1, the system API interface is used to read the current boot device priority setting, and the read boot sequence data is parsed to determine the type and priority of each device, mainly including:

[0045] First, the user needs to restart the computer and press a specific key (usually F2, F10, Delete or Esc key) during the boot process to enter the BIOS or UEFI setup interface. This step is to ensure that the system can read the boot order data from the BIOS / UEFI.

[0046] Use the API interface provided by the system to read the current boot device priority setting. For example, in Windows system, you can use the WMI (Windows Management Instrumentation) interface to obtain the boot order data; in Linux system, you can use the efibootmgr tool to obtain the EFI boot items. The data read is usually a list or string representing the boot device order.

[0047] Parse the boot order data and convert it into a usable list format. During the parsing process, it is necessary to determine the identifier of each device and its corresponding boot priority. For example, each device in the list may contain a device ID and its position (priority) in the boot order.

[0048] Based on the device ID or name, identify and determine the type of each device, such as a hard disk, USB device, or optical drive. You can use predefined mappings or rules to identify device types, such as a device ID that begins with "HD" may indicate a hard disk, while a device ID that begins with "USB" indicates a USB device. Identifying the device type helps understand the role of each device in the boot process.

[0049] After parsing the boot order data, you can print out the results for inspection or save them to a file for later analysis and reference. The parsing results usually include information such as the ID, type, and priority of each device, which is very important for subsequent boot order adjustment and optimization.

[0050] S2: Check the boot device according to preset rules and priorities, determine the damage of the boot sector data of the boot device, and evaluate the health of the boot sector; and analyze the delay in the boot process to evaluate the stability of the boot process.

[0051] The steps of checking the boot devices according to the preset rules and priorities include: first, reading and parsing the current boot sequence data to determine the type and priority of each device; second, checking according to the preset rules, including verifying the existence and validity of each boot device, ensuring that the boot sector is healthy, the boot file is complete, and the device type meets expectations; finally, analyzing whether there are redundant configurations in the boot sequence and delays during the boot process, and evaluating the stability and efficiency of the boot process. This process is implemented through the system API interface or command line tools to ensure that accurate and comprehensive boot sequence data is obtained. It can not only effectively improve the reliability and efficiency of system startup. By verifying the validity and priority configuration of the boot device, boot failures, system delays, and poor user experience caused by incorrect settings can be avoided. Detect and eliminate redundant device configurations to ensure that the operating system device is started first, thereby shortening the system startup time. In addition, identifying and repairing problems with the boot sector or boot file in advance can help prevent potential system crashes and data loss, and ensure the security and stability of the system.

[0052] The boot sector data damage index is generated according to the damage of the boot sector data of the boot device. The health of the boot sector is evaluated according to the boot sector data damage index. The method for obtaining the boot sector data damage index is as follows:

[0053] The boot sector data is divided into data blocks, each data block contains n bytes, and a Reed-Solomon code is generated according to the boot sector data block, which includes data symbols and check symbols. The generating polynomial G(x) is used for encoding. The generating polynomial of the boot sector data is expressed as: G(x) = (x-α1)(x-α2)...(x-α2t); wherein α is a primitive element of the finite field, and t is the number of errors corrected;

[0054] The product of the boot sector data polynomial D(x) and the generator polynomial G(x) plus the check symbol C(x) is the encoded data polynomial E(x), expressed as: E(x) = D(x)*x 2t +C(x); calculate the check polynomial S(x) of the received polynomial R(x) to obtain the check value, which is expressed as: S(x)=R(x)modG(x) Calculate the error polynomial E(x) according to the check value S(x), detect the error position and number, use the Berlekamp-Massey algorithm to correct the error, calculate the number of errors that cannot be corrected e, and generate the boot sector data damage index, which is expressed as: Where Dc is the boot sector data damage index.

[0055] The obtained boot sector data damage index is compared with the preset boot sector data damage index reference threshold. If the boot sector data damage index is greater than or equal to the preset boot sector data damage index reference threshold, it means that the boot sector data is severely damaged and the health of the boot sector is low. At this time, a boot sector abnormal signal is generated; if the boot sector data damage index is less than the preset boot sector data damage index reference threshold, it means that the boot sector data is slightly damaged and the health of the boot sector is high. At this time, a boot sector normal signal is generated.

[0056] The larger the boot sector data damage index is, the more serious the boot sector data damage is. This index quantifies the degree of data damage and can intuitively reflect the proportion of boot sector damage by evaluating the number of uncorrectable errors. If the damage index is close to 100%, it means that most of the boot sector data has been damaged and cannot be repaired.

[0057] The larger the boot sector data damage index is, the worse the health of the boot sector is. A healthy boot sector should have no or very few uncorrectable errors. If the damage index is low (close to 0%), it means that the boot sector data is relatively intact, with only a few or no data errors, indicating that the boot sector is in good health.

[0058] By monitoring and calculating the boot sector data damage index, you can timely identify and evaluate the health status of the boot sector, take appropriate repair or preventive measures, and ensure the stable operation of the system. If the damage index is high, it is recommended to back up data, repair the boot sector, or replace the storage device to avoid problems such as system startup failure or data loss.

[0059] The delay in the startup process is analyzed and a startup delay index is generated. The stability of the startup process is evaluated based on the startup delay index. The method for obtaining the startup delay index is as follows:

[0060] Obtain the delay data and related features during the startup process (such as the startup time, device type, priority, etc. of each device) and establish a data matrix X, where each row represents a startup process and each column represents a feature. Standardize the data so that the mean of each feature is 0 and the variance is 1. The standardized data matrix is ​​Z, and the expression is: Among them, μj and σj are the mean and standard deviation of the jth feature, respectively, and the covariance matrix is ​​calculated: Among them, C is an m×m covariance matrix, which reflects the linear relationship between each feature. The covariance matrix C is decomposed by eigenvalue to obtain the eigenvalue λi and the corresponding eigenvector vi. The decomposition expression is: Cvi=λivi; wherein λi is the i-th eigenvalue, vi is the corresponding eigenvector, and the first k largest eigenvalues ​​and their corresponding eigenvectors are selected to form the principal component matrix W: the data is projected into the principal component space, and the expression is: T=ZW; wherein W is the first k selected eigenvector matrix, and the start delay index DQ is calculated according to the principal component score, and the expression is: DQ=β*T; β is a weight vector, which can be determined according to the variance contribution rate of the principal component or through a regression model.

[0061] The obtained startup delay index is compared with the preset startup delay index reference threshold. If the startup delay index is greater than or equal to the preset startup delay index reference threshold, it means that the delay in the startup process is more obvious, and a startup delay signal is generated at this time; if the startup delay index is less than the preset startup delay index reference threshold, it means that the delay in the startup process is not obvious, and no startup delay signal is generated at this time.

[0062] The larger the boot delay index, the more serious the delay during the boot process. The boot delay index is a quantitative indicator obtained by analyzing various delay factors during the boot process. A higher boot delay index indicates that the system encounters more delay problems during the boot process, such as long boot device recognition time, long system initialization time, or excessive time to load programs.

[0063] When the boot delay index increases, users will experience a noticeable increase in system boot time. This may be caused by improper boot sequence settings, hardware device performance degradation, or unoptimized system configuration. This delay not only affects the user experience, but may also cause users to feel inconvenienced and frustrated while waiting for the system to boot.

[0064] By monitoring and analyzing the boot delay index, system administrators can promptly discover and diagnose problems in the boot process and take corresponding optimization measures, such as adjusting the boot sequence, replacing aging equipment, or optimizing system configuration, thereby increasing system boot speed and improving the overall user experience and system performance.

[0065] It should be noted here that the principal component analysis method can effectively reduce the dimension and extract the main features that affect the delay in the startup process to generate a startup delay index. First, the collected startup delay data is standardized, and then the covariance matrix of the data is calculated and the eigenvalue decomposition is performed, and the first few main eigenvectors are selected as principal components. Next, the standardized data is projected into the principal component space to obtain the principal component score. Finally, the startup delay index is calculated based on the principal component score and the weight vector. This method can not only reduce the data dimension and improve the calculation efficiency, but also accurately evaluate the startup delay by selecting the most representative principal components. The generated startup delay index can quantify the degree of delay in the startup process and help evaluate the stability of the startup process.

[0066] S3: Comprehensively analyze the health of the boot sector and the stability of the boot process to evaluate the accuracy of the boot sequence.

[0067] The boot sector data damage index and the startup delay index are converted into a first eigenvector, and the first eigenvector is used as the input of a machine learning model. The machine learning model uses the accuracy value label of the startup sequence predicted by each group of first eigenvectors as a prediction target, and minimizes the sum of prediction errors of the accuracy value labels of all startup sequences as a training target. The machine learning model is trained until the sum of prediction errors converges, and the model training is stopped. The accuracy value of the startup sequence is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

[0068] The method for obtaining the accuracy value of the startup sequence is as follows: from the first feature vector training data of the trained machine learning model, the corresponding function expression is obtained: CR = f1(D c , QD); where f1 is the output function of the model, Dc is the boot sector data damage index, QD is the boot delay index, and CR is the accuracy value of the boot sequence.

[0069] S4: According to the accuracy evaluation result of the startup sequence, the startup sequence is divided into an accurate startup sequence situation, a possibly accurate startup sequence situation and an inaccurate startup sequence situation, and the startup sequence is adjusted according to the division result.

[0070] Comparing the acquired accuracy value of the startup sequence with a gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and comparing the accuracy value of the startup sequence with the first standard threshold and the second standard threshold respectively;

[0071] If the accuracy value of the startup sequence is greater than the second standard threshold, it indicates that the startup sequence accuracy is high, and it is classified as the startup sequence accuracy situation, and a startup sequence accuracy signal is generated, and no adjustment is required, and the existing startup sequence is maintained. The system startup sequence is reasonable and efficient and does not need to be changed;

[0072] If the boot sequence accuracy value is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it means that the boot sequence accuracy is medium, and it is classified as the boot sequence may be accurate, and a boot sequence may be accurate signal is generated. It is recommended that the user conduct a manual check or provide optimization suggestions. The boot sequence is basically reasonable, but there may be room for optimization. It is recommended that the user check the priority setting of the boot device to ensure that the key device (such as the hard disk containing the operating system) is in the front row and the secondary devices (such as USB, optical drive) are in the back row;

[0073] If the accuracy value of the startup sequence is less than the first standard threshold, it indicates that the startup sequence accuracy is low, and it is classified as an inaccurate startup sequence situation, and an inaccurate startup sequence signal is generated, and manual and automatic adjustments are made to it.

[0074] Automatically adjust the boot order or prompt the user to make manual adjustments. Rearrange the priority of boot devices to ensure that the most important devices (such as the operating system hard drive) are booted first, and remove or lower the priority of invalid or redundant devices.

[0075] Manual adjustment: Provides specific adjustment suggestions, such as setting the hard disk as the first boot device in the BIOS, ensuring that USB devices and optical drives have a lower priority. The current boot order seriously affects the system boot efficiency and needs to be adjusted immediately to improve the boot speed and stability.

[0076] S5: For a possible accurate boot sequence, determine the device containing the operating system according to each boot device and its priority in the current boot sequence, and adjust its priority.

[0077] Read the boot order in BIOS / UEFI settings and list all devices and their current priority. Get the boot order list through system API or command line tool and display device ID and priority.

[0078] Check each device in the boot order to determine which devices contain the operating system. Read the boot sector of each device and check the boot record (such as MBR, GPT). Query the device for identifiers and descriptions (such as the operating system mark on the hard disk).

[0079] Adjust the boot order to ensure that the device containing the operating system has the highest priority. Adjust the priority of the boot devices so that the operating system device is at the top of the boot order.

[0080] Write the adjusted boot order back to the BIOS / UEFI settings. Use the system API or command line tools to update the BIOS / UEFI boot order settings.

[0081] For example, suppose the current boot order is: Device A (USB device): Priority 1; Device B (Hard disk 1, including the operating system): Priority 2; Device C (CD-ROM drive): Priority 3.

[0082] The adjustment steps are: Identify the boot device and priority: The current boot order is: A>B>C; Determine the device containing the operating system: By checking the device, determine that device B contains the operating system.

[0083] Adjust the startup sequence: modify the priority so that device B has the highest priority: the adjusted startup sequence is: B>A>C;

[0084] Update the boot order: Use system tools to write the adjusted order back to BIOS / UEFI.

[0085] S6: further analyzing the accuracy of the adjusted startup sequence, generating an adjustment strategy according to the analysis result, and generating a new startup sequence through the adjustment strategy and displaying it to the user for confirmation.

[0086] The accuracy of the adjusted startup sequence is further analyzed. When the startup sequence is possibly accurate, that is, the accuracy value of the startup sequence generated within a fixed time period is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the accuracy values ​​of the startup sequences generated within a subsequent fixed time period that are greater than or equal to the first standard threshold and less than or equal to the second standard threshold are collected, and a data set is established. The mean and standard deviation of the data set are calculated, and an adjustment strategy is generated after analysis. The new startup sequence generated by the adjustment strategy is displayed to the user for confirmation.

[0087] If the mean of the accuracy values ​​in the data set is greater than or equal to the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is less than the reference threshold of the standard deviation of the accuracy values, then no warning signal is generated, the current startup sequence is maintained, and the user is prompted that the current startup sequence is stable and accurate;

[0088] If the mean of the accuracy values ​​is greater than or equal to the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is greater than or equal to the reference threshold of the standard deviation of the accuracy values, a level 3 warning signal is generated, and the user is advised to make slight adjustments to reduce fluctuations in the startup sequence and improve stability;

[0089] If the mean of the accuracy values ​​is less than the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is greater than or equal to the reference threshold of the standard deviation of the accuracy values, a level 2 warning signal is generated, and the user is advised to make substantial adjustments to improve the accuracy of the startup sequence;

[0090] If the mean of the accuracy values ​​is less than the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is less than the reference threshold of the standard deviation of the accuracy values, a level 1 warning signal is generated, and the user is advised to conduct a comprehensive inspection and adjustment to significantly improve the accuracy of the startup sequence.

[0091] Generate a new boot order based on the generated adjustment policy. Adjust the priority of the boot device according to the policy and generate an optimized boot order. Display the new boot order to the user and provide a confirmation option. Display the adjusted boot order and prompt the user to confirm whether to apply the new order.

[0092] It should be noted here that the management level of the first-level warning signal is higher than that of the second-level warning signal, and the management level of the second-level warning signal is higher than that of the third-level warning signal. Relevant personnel can carry out corresponding management according to the level of the warning signal.

[0093] In this embodiment, the current boot device priority setting is read by using the system API interface, and the boot sequence data read is parsed to determine the type and priority of each device; the boot device is checked according to the preset rules and priorities, the damage of the boot sector data of the boot device is determined, and the health of the boot sector is evaluated; and the delay in the boot process is analyzed to evaluate the stability of the boot process; the health of the boot sector and the stability of the boot process are comprehensively analyzed to evaluate the accuracy of the boot sequence; according to the evaluation results of the accuracy of the boot sequence, it is divided into accurate boot sequence, possible accurate boot sequence and inaccurate boot sequence, and the boot sequence is adjusted according to the division results; for the possible accurate boot sequence, according to each boot device and its priority in the current boot sequence, the device containing the operating system is determined, and its priority is adjusted; the accuracy of the adjusted boot sequence is further analyzed, and an adjustment strategy is generated according to the analysis results, and a new boot sequence is generated through the adjustment strategy and displayed to the user for confirmation. It can not only significantly improve the reliability and efficiency of system startup, but also reduce the startup time, enhance the user experience, and prevent potential system startup problems.

[0094] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0095] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0096] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0097] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0098] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0099] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0100] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0101] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A safety detection method for abnormal startup of a computer, characterized in that: The following steps are involved: S1: Use the system API interface to read the current boot device priority setting, parse the read boot sequence data, and determine the type and priority of each device; S2: Check the boot device according to the preset rules and priorities, determine the damage of the boot sector data of the boot device, and evaluate the health of the boot sector; and analyze the delay in the boot process to evaluate the stability of the boot process; S3: Comprehensively analyze the health of the boot sector and the stability of the boot process to evaluate the accuracy of the boot sequence; S4: according to the accuracy evaluation result of the startup sequence, the startup sequence is divided into a startup sequence accurate situation, a startup sequence possibly accurate situation and a startup sequence inaccurate situation, and the startup sequence is adjusted according to the division result; S5: For a possible accurate boot sequence, determine the device containing the operating system according to each boot device and its priority in the current boot sequence, and adjust its priority; S6: further analyzing the accuracy of the adjusted startup sequence, generating an adjustment strategy according to the analysis result, and generating a new startup sequence through the adjustment strategy and displaying it to the user for confirmation.

2. A computer abnormal startup safety detection method according to claim 1, characterized in that: In S2, a boot sector data damage index is generated according to the damage of the boot sector data of the boot device, and the health of the boot sector is evaluated according to the boot sector data damage index. The method for obtaining the boot sector data damage index is: The boot sector data is divided into data blocks, each data block contains n bytes, and a Reed-Solomon code is generated according to the boot sector data block, which includes data symbols and check symbols. The generating polynomial G(x) is used for encoding. The generating polynomial of the boot sector data is expressed as: G(x) = (x-α1)(x-α2)...(x-α2t); where α is a primitive element of the finite field, and t is the number of errors corrected; the product of the boot sector data polynomial D(x) and the generating polynomial G(x) plus the check symbol C(x) obtains the coded data polynomial E(x), which is expressed as: E(x) = D(x)*x 2 t+C(x); calculate the check polynomial S(x) of the received polynomial R(x) to obtain the check value, which is expressed as: S(x)=R(x)modG(x) Calculate the error polynomial E(x) according to the check value S(x), detect the error position and number, use the Berlekamp-Massey algorithm to correct the error, calculate the number of uncorrectable errors e, and generate the boot sector data damage index, which is expressed as: Where Dc is the boot sector data damage index.

3. A computer abnormal startup safety detection method according to claim 2, characterized in that: The obtained boot sector data damage index is compared with the preset boot sector data damage index reference threshold. If the boot sector data damage index is greater than or equal to the preset boot sector data damage index reference threshold, the boot sector data is severely damaged and the health of the boot sector is low. In this case, a boot sector abnormal signal is generated. If the boot sector data damage index is less than the preset boot sector data damage index reference threshold, the boot sector data is slightly damaged and the health of the boot sector is high. In this case, a boot sector normal signal is generated.

4. A computer abnormal startup safety detection method according to claim 3, characterized in that: In S2, the delay situation in the startup process is analyzed and a startup delay index is generated. The stability of the startup process is evaluated according to the startup delay index. The method for obtaining the startup delay index is: Obtain the delay data and related features during the startup process and establish a data matrix X, where each row represents a startup process and each column represents a feature. Standardize the data and the standardized data matrix is ​​Z. Calculate the covariance matrix: Where C is an m×m covariance matrix. The covariance matrix C is decomposed into eigenvalues ​​to obtain the eigenvalues ​​λi and the corresponding eigenvectors vi. The first k largest eigenvalues ​​and their corresponding eigenvectors are selected to form the principal component matrix W: The data is projected into the principal component space, and the expression is: T=ZW; Where W is the first k selected eigenvector matrix. The start delay index DQ is calculated according to the principal component scores, and the expression is: DQ=β*T; Where β is the weight vector.

5. A computer abnormal startup safety detection method according to claim 4, characterized in that: The obtained startup delay index is compared with the preset startup delay index reference threshold. If the startup delay index is greater than or equal to the preset startup delay index reference threshold, a startup delay signal is generated; if the startup delay index is less than the preset startup delay index reference threshold, no startup delay signal is generated.

6. A computer abnormal startup safety detection method according to claim 5, characterized in that: The boot sector data damage index and the startup delay index are converted into a first eigenvector, and the first eigenvector is used as the input of a machine learning model. The machine learning model uses the accuracy value label of the startup sequence predicted by each group of first eigenvectors as a prediction target, and minimizes the sum of prediction errors of the accuracy value labels of all startup sequences as a training target. The machine learning model is trained until the sum of prediction errors converges, and the model training is stopped. The accuracy value of the startup sequence is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

7. A computer abnormal startup safety detection method according to claim 6, characterized in that: In S4, according to the accuracy evaluation result of the startup sequence, it is divided into the startup sequence accurate situation, the startup sequence possibly accurate situation and the startup sequence inaccurate situation, specifically: Comparing the acquired accuracy value of the startup sequence with a gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and comparing the accuracy value of the startup sequence with the first standard threshold and the second standard threshold respectively; If the accuracy value of the startup sequence is greater than the second standard threshold, it indicates that the startup sequence accuracy is high, and it is classified as the startup sequence accuracy situation, and a startup sequence accuracy signal is generated, and no adjustment is required, and the existing startup sequence is maintained. The system startup sequence is reasonable and efficient and does not need to be changed; If the accuracy value of the boot sequence is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the boot sequence accuracy is medium, and it is classified as a boot sequence that may be accurate, and a boot sequence that may be accurate signal is generated, and the user manually checks the priority setting of the boot device; If the accuracy value of the startup sequence is less than the first standard threshold, the startup sequence accuracy is low, it is classified as an inaccurate startup sequence situation, and an inaccurate startup sequence signal is generated to adjust the startup sequence.

8. A computer abnormal startup safety detection method according to claim 1, characterized in that: In S5, for the possible accurate boot sequence, the priority of each boot device in the current boot sequence and its priority is adjusted, specifically: Read the boot order in the BIOS / UEFI setup and list all devices and their current priority, check each device in the boot order, determine the device that contains the operating system, read the boot sector of each device, check the boot record, adjust the boot order to ensure that the device containing the operating system has the highest priority, and write the adjusted boot order back to the BIOS / UEFI setup.

9. A computer abnormal startup safety detection method according to claim 1, characterized in that: In S6, the accuracy of the adjusted startup sequence is further analyzed, and an adjustment strategy is generated according to the analysis result, specifically: The accuracy of the adjusted startup sequence is further analyzed. When the startup sequence is possibly accurate, that is, the accuracy value of the startup sequence generated within a fixed time period is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the accuracy values ​​of the startup sequences generated within a subsequent fixed time period that are greater than or equal to the first standard threshold and less than or equal to the second standard threshold are collected, and a data set is established. The mean and standard deviation of the data set are calculated, and an adjustment strategy is generated after analysis. The new startup sequence generated by the adjustment strategy is displayed to the user for confirmation.

10. A computer abnormal startup safety detection method according to claim 9, characterized in that: If the mean of the accuracy values ​​in the data set is greater than or equal to the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is less than the reference threshold of the standard deviation of the accuracy values, then no warning signal is generated, the current startup sequence is maintained, and the user is prompted that the current startup sequence is stable and accurate; If the mean of the accuracy values ​​is greater than or equal to the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is greater than or equal to the reference threshold of the standard deviation of the accuracy values, a level 3 warning signal is generated, and the user is advised to make slight adjustments to reduce fluctuations in the startup sequence and improve stability; If the mean of the accuracy values ​​is less than the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is greater than or equal to the reference threshold of the standard deviation of the accuracy values, a secondary warning signal is generated, and the user makes substantial adjustments to improve the accuracy of the startup sequence; If the mean of the accuracy values ​​is less than the reference threshold of the mean of the accuracy values, and the standard deviation of the accuracy values ​​is less than the reference threshold of the standard deviation of the accuracy values, a first-level warning signal is generated and the user conducts a comprehensive inspection and adjustment to improve the accuracy of the startup sequence.

Images