Abnormal behavior analysis system and method based on mobile phone multi-dimensional data

Abstract

The invention discloses an abnormal behavior analysis system and method based on mobile phone multi-dimensional data, and belongs to the technical field of artificial intelligence. According to the method, mobile phone point test parameters are set by a user, a point test mode is automatically selected by using an SVM algorithm, mobile phone abnormal behavior monitoring is carried out, and a detection report is provided. The system comprises a data extraction module, a point inspection setting module, a data point inspection module and a report generation module. The data extraction module is used for extracting multi-dimensional data from the mobile phone; the point check setting module allows a user to set parameters in the data point check module and configure abnormal behaviors to be checked; the data point inspection module is used for receiving the multi-dimensional data from the data extraction module, providing three point inspection modes, including mobile phone point inspection, AI point inspection and wireless point inspection, and detecting potential abnormal behaviors by using an SVM algorithm according to a set rule; and the report generation module lists each detected abnormal behavior in combination with the chart, and provides a detection report.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an abnormal behavior analysis system and method based on multi-dimensional data of mobile phones. Background Art

[0002] With the continuous improvement and expansion of the service levels and types of services provided by mobile communication technology, mobile phones have increasingly become an indispensable communication tool in people's work and life, forming a new business model of "Internet + smart phones", allowing "people follow the Internet" to become "the Internet follows people". However, at the same time, the use of mobile phones to commit crimes such as fraud, defamation and forgery is also common.

[0003] Traditional technologies may only be able to process limited types of multidimensional data, while modern mobile phones contain a wide variety of data, such as application usage records, call records, location information, device information, etc. Existing technologies are generally difficult to effectively process and analyze these multidimensional data. Many existing technologies rely on manually set rules and parameters and require manual intervention by users or analysts, which limits the ability of automation and real-time analysis and increases operational complexity. Some existing technologies are limited to single-dimensional data verification and are difficult to provide comprehensive analysis. In addition, they do not have the ability to monitor and respond in real time, making it difficult to respond to rapidly changing threats. Summary of the invention

[0004] The purpose of the present invention is to provide an abnormal behavior analysis system and method based on multi-dimensional data of mobile phones to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] The system includes a data extraction module, a check setting module, a data check module, and a report generation module;

[0007] The data extraction module is used to extract multi-dimensional data from the mobile phone, and the multi-dimensional data includes the usage records of mobile phone applications, call records, text message records, location information, network activities, and device information;

[0008] The verification setting module allows the user to set parameters in the data verification module, specify the time range for verification, select the data type to be analyzed, configure abnormal behavior to be checked, define screening conditions, configure access control, and set the review process;

[0009] The data verification module receives multi-dimensional data from the data extraction module and provides three verification modes, including mobile phone verification, AI verification, and wireless verification; uses machine learning algorithms and detects potential abnormal behaviors according to set rules; when abnormal behavior detection is completed, the data verification module will generate results;

[0010] The report generation module obtains the detected abnormal behaviors from the data verification module, and the user can select the required report format and select a predefined report template; the report generation module lists each detected abnormal behavior in combination with a chart, and provides recommended action steps, risk management strategies and improvement suggestions.

[0011] The data extraction module supports extracting data from mobile phones based on mainstream smartphone operating systems, including HarmonyOS, Android, and IOS;

[0012] The operating system records the usage of applications and stores the usage records in the system log, which can be accessed by the system administrator or authorized users. Some mobile applications provide APIs to allow third-party applications to access and extract application usage data, and the data extraction module can obtain it through the API.

[0013] The operating system maintains a call record database, and the data extraction module extracts data by accessing the database or using the API provided by the operating system;

[0014] The operating system maintains a SMS database that records the sending and receiving information of SMS messages; the data extraction module extracts data by accessing the database or using relevant APIs;

[0015] The mobile phone uses GPS or Beidou satellite navigation to determine the location and record the coordinates; the data extraction module obtains through the GPS module, Beidou satellite navigation module or related API;

[0016] The operating system records logs of network activities, including data usage and visited websites. The data extraction module is accessed through system management privileges.

[0017] The operating system provides information about the device model, operating system version, and hardware configuration, which the data extraction module obtains through system settings or APIs.

[0018] The inspection setting module allows the user to select the data type to be analyzed. The data type comes from the multidimensional data, and the user can select several of them for analysis;

[0019] Users can configure the abnormal behaviors to be checked in the Point Verification Settings module and define filtering conditions to exclude data that does not need to be analyzed or limit the data analyzed; filtering includes excluding data from specific applications, ignoring certain call records or text messages, or filtering based on geographic location;

[0020] The verification setting module allows users to configure access control to ensure that only authorized personnel can perform verification operations; access control configuration items include identity authentication, access control list, and permission level;

[0021] Users can configure the review process, which includes the following: designation of reviewers, review procedures and processes, and recording and processing of review results.

[0022] The mobile phone verification of the data verification module includes fast verification and regular verification, using the multi-dimensional data of the mobile phone itself to detect abnormal behavior, and the system analyzes the data stored on the mobile phone; mobile phone verification is a localized verification method, mainly used to analyze local data on the mobile phone; mobile phone verification can provide more detailed information on mobile phone usage, but requires the cooperation or access rights of the mobile phone user;

[0023] The AI ​​verification of the data verification module uses AI technology to analyze multi-dimensional data of mobile phones. The AI ​​technology includes natural language processing, image analysis, and pattern recognition to detect abnormal behavior in an automated manner. AI verification is applied to large-scale data verification tasks, which require processing of large amounts of multi-dimensional data without manual intervention by users.

[0024] The wireless inspection includes WIFI inspection and Bluetooth inspection, focusing on the wireless communication activities of the mobile phone. The system monitors the interaction with the wireless network or Bluetooth to detect potential abnormal behavior.

[0025] The data verification module can automatically select the optimal verification mode through the SVM algorithm and define the following parameters: T: task nature, D: data availability, R: resource requirements, Time: time limit, B: budget; the parameter values ​​are set by the user in the verification setting module; then, the parameters are combined to form a feature vector X, where each parameter is a component of the feature vector: X =

[0026] [T,D,R,Time,B];

[0027] Next, define a target variable Y, where Y represents the best verification mode and is a positive integer representing different verification modes, where Y=1 represents the mobile verification mode, Y=2 represents the AI ​​verification mode, and Y=3 represents the wireless verification mode. Use SVM to build a multi-class classification model. In the multi-class SVM, each class corresponds to a verification mode. The model will learn how to predict the best verification mode Y based on the input feature vector X. The training formula is as follows:

[0028]

[0029] where ω is the normal vector of the hyperplane, ||ω|| 2 Represents the square of the normal vector, W T The weight of the parameter task nature, W D represents the weight of data availability, W R represents the weight of resource demand, WTime represents the weight of the time limit, W B Indicates the weight of the budget;

[0030] The weights of the parameters are automatically set by the system, satisfying the following conditions:

[0031]

[0032] Where N is the total number of weights.

[0033] The mathematical formula for setting the weight of the task nature is as follows:

[0034]

[0035] Among them, W T is the weight of the task nature, N is the total number of task types, and G is the task type weight;

[0036] The mathematical formula for setting the weight of data availability is as follows:

[0037]

[0038] Among them, W D is the weight of data availability, Q is the data quality score, and S is the availability score of the data source;

[0039] The mathematical formula for setting the weight of resource requirements is as follows:

[0040]

[0041] Among them, W R is the weight of the resource demand parameter, K is the resource demand, C is the weight of the resource type, and M is the total number of resource types;

[0042] The mathematical formula for setting the weight of the time limit is as follows:

[0043]

[0044] Among them, W Time is the weight of the time limit, U represents the task urgency score, and V represents the time from the task deadline;

[0045] The mathematical formula for budget weight is as follows:

[0046]

[0047] Among them, P is the budget of the task, and H is the maximum budget of the task.

[0048] The mobile phone inspection includes ultra-fast inspection and regular inspection. The ultra-fast inspection detects abnormal behavior as quickly as possible, focusing on quickly identifying obvious abnormal behaviors. The inspection content provided includes malicious application installation, high-risk website visits, abnormal network activities, large-value fund transactions, abnormal application behavior, abnormal communication behavior, and abnormal location changes;

[0049] Regular inspection is slower than fast inspection and provides more in-depth multi-dimensional data analysis. The inspection content provided includes the inspection content of fast inspection, and also includes application usage records, call records, SMS records, location information, and network activities.

[0050] In the AI ​​verification, NLP technology is used to analyze text data, including sentiment analysis, topic modeling, keyword extraction and entity recognition; abnormal behaviors are extracted from the verification setting module and filtered by the user; if the call record includes voice information, voice recognition technology converts the voice into text, which is then analyzed using NLP;

[0051] Natural Language Processing (NLP) is a branch of artificial intelligence that focuses on the interaction and communication between computers and human natural language. NLP technology allows computers to understand, interpret, generate, and respond to natural language, including text and voice data. In the data verification module, NLP technology is used to analyze text data and can be applied to various text processing tasks such as sentiment analysis, topic modeling, keyword extraction, and entity recognition.

[0052] For image and video data, image analysis techniques are used for object recognition, face recognition, and image content classification. Abnormal patterns in images are detected using pattern recognition techniques. If a certain pattern or color exists, it indicates an abnormality.

[0053] For call records and other time series data, pattern recognition technology is used to detect abnormal patterns and identify abnormal call periods, frequencies, and call volumes.

[0054] The report generation module first receives the abnormal behavior data from the data verification module, and organizes, classifies and sorts the data; the user can select the required report format according to his needs, and the report format includes HTML, PDF, WORD, EXCEL, and supports batch export;

[0055] The report generation module provides preset report templates, and users can choose according to their needs; the content of the report includes a list of abnormal behaviors, a visual abnormal behavior chart, a detailed description of abnormal behaviors, recommended action steps, risk management strategies, and improvement suggestions; the charts are expressed using bar charts, line charts, and pie charts.

[0056] A method for analyzing abnormal behavior based on multi-dimensional data of mobile phones, the steps are as follows:

[0057] S100, a data extraction module extracts multi-dimensional data from a mobile phone;

[0058] S200, the user sets parameters in the data inspection module in the inspection setting module and configures abnormal behaviors to be checked;

[0059] S300, the data verification module automatically selects the verification method through the SVM algorithm: select mobile phone verification, go to step S400; select AI verification, go to step S500; select wireless verification, go to step S600;

[0060] S400, multidimensional data cleaning and preprocessing;

[0061] S401, performing abnormal behavior detection;

[0062] S402, generating a detection result of the mobile phone point verification mode, and proceeding to step S700;

[0063] S500, Apply natural language processing technology to analyze text data;

[0064] S501. Use image recognition and analysis technology to detect abnormal content;

[0065] S502, automatically learning the normal behavior patterns of mobile phone users through pattern recognition technology;

[0066] S503, generating the detection result of the AI ​​inspection mode, and proceeding to step S700;

[0067] S600, monitors the phone's network traffic, analyzing packets, requests, and responses to detect potential abnormal behavior;

[0068] S601, check whether there is a risk in the connection of the mobile phone;

[0069] S602, generating the detection result of the wireless point verification mode, and proceeding to step S700;

[0070] S700: A report generation module generates a report.

[0071] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0072] The present invention utilizes multi-dimensional data on the mobile phone, including application usage records, call records, text message records, location information, network activities and device information, to conduct a comprehensive abnormal behavior analysis, which enables the system to detect potential abnormal behaviors more comprehensively.

[0073] The system of the present invention supports different inspection modes, including mobile phone inspection, AI inspection and wireless inspection. The system can automatically select the most suitable inspection mode, reduce the user's operating burden and improve efficiency.

[0074] The system generates detailed abnormal behavior reports, including charts and recommended action steps, risk management strategies, and improvement suggestions, which helps users better understand abnormal behaviors and take necessary measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0076] Figure 1 It is a system structure diagram of an abnormal behavior analysis system based on multi-dimensional data of mobile phones of the present invention;

[0077] Figure 2 It is a schematic diagram of the steps of an abnormal behavior analysis method based on multi-dimensional data of a mobile phone according to the present invention. DETAILED DESCRIPTION

[0078] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0079] See also Figure 1 and Figure 2 , the present invention provides a technical solution:

[0080] According to one embodiment of the present invention, Figure 1 As shown in the system structure diagram of an abnormal behavior analysis system based on multi-dimensional data of mobile phones, the system includes a data extraction module, a check setting module, a data check module, and a report generation module;

[0081] The data extraction module is used to extract multi-dimensional data from the mobile phone, and the multi-dimensional data includes the usage records of mobile phone applications, call records, text message records, location information, network activities, and device information;

[0082] Mobile application usage records include the usage of various applications used by users on their mobile phones, such as application launch, usage duration, frequency, etc. These records can help analyze users' application preferences and habits.

[0083] Call records include call-related information such as incoming calls, outgoing calls, missed calls, and call duration. Call records are used to analyze communication activities and identify abnormal call behavior.

[0084] SMS logs include sent and received SMS messages, including text messages, multimedia messages, SMS content, sending time, etc. Analyzing SMS logs helps understand the user's communication patterns and content.

[0085] Location information includes the geographical location data of the mobile phone, which is GPS coordinates, Beidou satellite navigation, Wi-Fi access point information or base station information. Location information is used to track the user's movement trajectory and detect abnormal geographical location activities.

[0086] Web activity includes activities when the phone is connected to the Internet, such as websites visited, applications used, data transfer volume, etc. Web activity records help monitor users' online behavior and network security.

[0087] Device information includes the hardware and software information of the phone, such as device model, operating system version, storage capacity, application list, etc. Device information is used to understand the performance and configuration of the phone.

[0088] The verification setting module allows the user to set parameters in the data verification module, specify the time range for verification, select the data type to be analyzed, configure abnormal behavior to be checked, define screening conditions, configure access control, and set the review process;

[0089] Users can set parameters in the data verification module, which include parameters used in abnormal behavior detection, such as verification mode selection, algorithm parameters, weight settings, etc. Users can customize parameter configurations according to the needs of specific tasks to obtain the best verification results.

[0090] Users can specify the time range for the inspection and determine the range of data records to be analyzed, as some tasks may only be concerned with data within a specific time period. Users can choose to analyze data within the last week, month, or a specific date range.

[0091] Users can select the type of data to be analyzed. Depending on the nature of the task, users can include or exclude different types of multidimensional data, such as call logs, SMS logs, location information, application usage records, etc.

[0092] Users can configure what unusual behaviors to check for, including defining what behaviors or activities are considered unusual, such as specific behaviors that indicate a breach, cybersecurity risk, or compliance issue.

[0093] Users can define filter conditions to filter specific information in the data. This helps users locate the data of interest more accurately, reduce noise interference, and improve detection accuracy.

[0094] Users can configure access control to ensure that only authorized personnel can access and modify the system's settings. This helps maintain data security and privacy.

[0095] Users can define review processes to specify the actions to be taken when abnormal behavior is found. The review process can include steps such as automated alerts, notification of relevant teams, and generation of review reports.

[0096] The data verification module receives multi-dimensional data from the data extraction module and provides three verification modes, including mobile phone verification, AI verification, and wireless verification; uses machine learning algorithms and detects potential abnormal behaviors according to set rules; when abnormal behavior detection is completed, the data verification module will generate results;

[0097] The data verification module can automatically select the optimal verification mode through the SVM algorithm and define the following parameters: T: task nature, D: data availability, R: resource requirements, Time: time limit, B: budget; the parameter values ​​are set by the user in the verification setting module; then, the parameters are combined to form a feature vector X, where each parameter is a component of the feature vector: X =

[0098] [T,D,R,Time,B];

[0099] Next, define a target variable Y, where Y represents the best verification mode and is a positive integer representing different verification modes, where Y=1 represents the mobile verification mode, Y=2 represents the AI ​​verification mode, and Y=3 represents the wireless verification mode. Use SVM to build a multi-class classification model. In the multi-class SVM, each class corresponds to a verification mode. The model will learn how to predict the best verification mode Y based on the input feature vector X. The training formula is as follows:

[0100]

[0101] where ω is the normal vector of the hyperplane, ||ω|| 2 Represents the square of the normal vector, W T The weight of the parameter task nature, W D represents the weight of data availability, W R represents the weight of resource demand, W Time represents the weight of the time limit, W B Indicates the weight of the budget;

[0102] The weights of the parameters are automatically set by the system, satisfying the following conditions:

[0103]

[0104] Where N is the total number of weights.

[0105] The mathematical formula for setting the weight of the task nature is as follows:

[0106]

[0107] Among them, W T is the weight of the task nature, N is the total number of task types, and G is the task type weight;

[0108] The mathematical formula for setting the weight of data availability is as follows:

[0109]

[0110] Among them, W D is the weight of data availability, Q is the data quality score, and S is the availability score of the data source;

[0111] The mathematical formula for setting the weight of resource requirements is as follows:

[0112]

[0113] Among them, W R is the weight of the resource demand parameter, K is the resource demand, C is the weight of the resource type, and M is the total number of resource types;

[0114] The mathematical formula for setting the weight of the time limit is as follows:

[0115]

[0116] Among them, W Time is the weight of the time limit, U represents the task urgency score, and V represents the time from the task deadline;

[0117] The mathematical formula for budget weight is as follows:

[0118]

[0119] Among them, P is the budget of the task, and H is the maximum budget of the task.

[0120] The report generation module obtains the detected abnormal behaviors from the data verification module, and the user can select the required report format and select a predefined report template; the report generation module lists each detected abnormal behavior in combination with a chart, and provides recommended action steps, risk management strategies and improvement suggestions.

[0121] The report generation module obtains the abnormal behavior data detected from the data verification module. These abnormal behaviors include various mobile phone usage records, abnormal calls, abnormal text messages, abnormal location information, network activity problems, etc.

[0122] Users can select the desired report format based on their needs, including different report layouts, document types such as PDF, HTML, text, etc., and other related parameters. The user's choice will affect the output of the report generation.

[0123] The report generation module also allows users to select predefined report templates that are customized according to the nature of the task, industry standards or organizational needs. The template includes the structure, style and other design aspects of the document.

[0124] The report generation module integrates the detected abnormal behaviors into reports. This includes tables, charts, text, and other visual elements to help users quickly understand the abnormal situation. These presentation forms help visualize problems and trends.

[0125] The report generation module not only presents abnormal behaviors, but also provides recommended action steps based on the detection results. These steps are usually customized according to business needs and compliance standards to help users take appropriate measures to resolve the problem.

[0126] Reports contain risk management strategies to help users understand the nature and severity of potential risks. These strategies include compliance recommendations, security measures, and improvement plans.

[0127] The report generation module provides improvement suggestions to help users improve the security and compliance of their phones. These suggestions include technical, policy and operational level suggestions.

[0128] The abnormal behavior analysis report in this embodiment is relatively long and is roughly as follows:

[0129] Abnormal Behavior Analysis Report: Report Date: October 20, 2023, Task Nature: Network Security Monitoring, Data Availability: High, Resource Requirements: Medium, Time Limit: None, Budget: Moderate, Automation Capability: High, Historical Experience: Yes

[0130] Report Summary: Provides comprehensive insights into abnormal behaviors of multi-dimensional data on mobile phones. Reports are generated for network security monitoring tasks based on high data availability and automation capabilities.

[0131] Summary of unusual behavior:

[0132] Abnormal call records: Multiple long call events are detected, involving specific numbers, which may pose a risk of call abuse.

[0133] Abnormal location information: User location information shows abnormal movement patterns, which may involve mobile phone location fraud.

[0134] Abnormal application usage records: Abnormally high usage of an application may be related to malicious applications or application abuse.

[0135] Abnormal network activity: A large amount of data is found to be transferred to a specific IP address, which may involve malicious data transmission behavior.

[0136] Charts and visualizations:

[0137] Abnormal call record trend: The chart shows the trend of call records in the past 30 days, marking the time points of abnormal call events.

[0138] Abnormal distribution of location information: The map shows the abnormal distribution of mobile phone location information and marks the locations of abnormal movements.

[0139] Recommended Action Steps:

[0140] Based on the abnormal behavior detected, here are some recommended action steps:

[0141] In case of abnormal call records, it is recommended to review the relevant call records to understand whether there is call abuse and restrict call permissions if necessary.

[0142] In case of abnormal location information, it is recommended to verify the reliability of the mobile phone positioning function to ensure accurate location reporting.

[0143] In case of abnormal application usage records, it is recommended to review the applications involved to check whether there are malicious applications or abuse.

[0144] In case of abnormal network activity, it is recommended to monitor data transmission and identify possible malicious behavior.

[0145] Risk Management Strategy:

[0146] For detected risks, some risk management strategies are provided to help reduce the impact of potential risks.

[0147] To improve the security and compliance of your phone, here are some suggestions:

[0148] Update your phone apps to fix vulnerabilities that could lead to unusual app usage records. Review call logs regularly and monitor for unusual call activity. Check for updates to your phone’s operating system and apps to keep them secure.

[0149] According to another embodiment of the present invention, Figure 2 A method for analyzing abnormal behavior based on multi-dimensional data of mobile phones is shown in a schematic diagram. The steps are as follows:

[0150] S100, a data extraction module extracts multi-dimensional data from a mobile phone;

[0151] S200, the user sets parameters in the data inspection module in the inspection setting module and configures abnormal behaviors to be checked;

[0152] S300, the data verification module automatically selects the verification method through the SVM algorithm: select mobile phone verification, go to step S400; select AI verification, go to step S500; select wireless verification, go to step S600;

[0153] S400, multidimensional data cleaning and preprocessing;

[0154] S401, performing abnormal behavior detection;

[0155] S402, generating a detection result of the mobile phone point verification mode, and proceeding to step S700;

[0156] S500, Apply natural language processing technology to analyze text data;

[0157] S501. Use image recognition and analysis technology to detect abnormal content;

[0158] S502, automatically learning the normal behavior patterns of mobile phone users through pattern recognition technology;

[0159] S503, generating the detection result of the AI ​​inspection mode, and proceeding to step S700;

[0160] S600, monitors the phone's network traffic, analyzing packets, requests, and responses to detect potential abnormal behavior;

[0161] S601, check whether there is a risk in the connection of the mobile phone;

[0162] S602, generating the detection result of the wireless point verification mode, and proceeding to step S700;

[0163] S700: A report generation module generates a report.

[0164] This example runs in the following operating environment:

[0165] Operating system: Windows, 64-bit operating system, hard disk space: 256GB SSD + 2TB SSD, memory: 32G, processor: AMD R78 core 3.2GHz main frequency.

[0166] By executing an abnormal behavior analysis method based on multi-dimensional data of mobile phones, the present invention:

[0167] Supports detection via USB, WIFI, QR code scanning, Bluetooth and other methods.

[0168] Supports mainstream mobile phone brands such as Huawei, Vivo, Xiaomi, OPPO, Samsung, Meizu, Gionee, and Apple. No driver installation is required, and it can automatically identify and connect.

[0169] Supports checking Harmony0S, Android, and IOS mainstream smartphone operating systems.

[0170] The system software can be updated online by connecting to the Internet, or updated via an offline package to supplement support for the latest version of the mobile phone operating system and the latest version of the APP.

[0171] It supports analysis through USB debugging, simulated device replacement, backup analysis, image analysis, and QR code scanning forensics. The system can automatically adapt to the best detection method.

[0172] Supports data analysis and recovery of 95 common social chat apps including WeChat, QQ, Weibo, Momo, Tantan, Sou1, and DingTalk, and supports voice-to-text conversion.

[0173] Supports data analysis and recovery for apps related to sports and fitness, lifestyle travel, mobile banking, e-commerce, online lending, and virtual currency online trading.

[0174] Supports data analysis and recovery of QQ Music, Kugou Music, Qianqian Music, iQiyi, Tencent Video, Sohu Video, Youku Video, Hualihuali, Huya Live, and Youtube audio-visual entertainment apps.

[0175] Supports data analysis and recovery of Tencent Maps, Amap, Baidu Maps, Sogou Maps, Apple Maps and map application apps, and supports displaying coordinate points on the map.

[0176] Supports data analysis and recovery of 20 browser apps including system built-in browser, UC, Baidu, QQ, and Firefox.

[0177] Supports data analysis and recovery of shared apps such as Baidu Netdisk, 360 Cloud Disk, 115 Netdisk, Alibaba Cloud Disk, Tianyi Cloud, and WeCloud Netdisk.

[0178] Supports data analysis and recovery of Sunflower and ToDesk remote desktop monitoring apps.

[0179] Supports searching for inspection records and data by setting keywords, wildcards, and regular expressions; supports searching by setting time, and search results can be located.

[0180] Supports the export of test results and the export of key content to tables, web pages, etc.

[0181] Supports single and batch export of HTML, PDF, and WORD inspection reports. The report content is clear and concise, and the batch report includes early warning statistics, sorting and analysis content.

[0182] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0183] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An abnormal behavior analysis system based on mobile phone multi-dimensional data, characterized by: It includes data extraction module, verification setting module, data verification module and report generation module; The data extraction module is used to extract multi-dimensional data from the mobile phone, and the multi-dimensional data includes the usage records of mobile phone applications, call records, text message records, location information, network activities, and device information; The verification setting module allows the user to set parameters in the data verification module, specify the time range for verification, select the data type to be analyzed, configure abnormal behavior to be checked, define screening conditions, configure access control, and set the review process; The data verification module receives multi-dimensional data from the data extraction module and provides three verification modes, including mobile phone verification, AI verification, and wireless verification; uses the SVM algorithm and detects potential abnormal behaviors according to the set rules; when the abnormal behavior detection is completed, the data verification module will generate a result; The report generation module obtains the detected abnormal behaviors from the data verification module, and the user can select the required report format and select a predefined report template; the report generation module lists each detected abnormal behavior in combination with a chart, and provides recommended action steps, risk management strategies and improvement suggestions.

2. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 1 is characterized by: The data extraction module supports extracting data from mobile phones based on mainstream smartphone operating systems, including HarmonyOS, Android, and IOS; The operating system records the usage of applications and stores the usage records in the system log, which can be accessed by the system administrator or authorized users. Some mobile applications provide APIs to allow third-party applications to access and extract application usage data, and the data extraction module can obtain it through the API. The operating system maintains a call record database, and the data extraction module extracts the data by accessing the database or using the API provided by the operating system; The operating system maintains a SMS database to record the sending and receiving of SMS messages; The data extraction module extracts data by accessing the database or using relevant APIs; The mobile phone uses GPS or Beidou satellite navigation to determine the location and record the coordinates; the data extraction module obtains through the GPS module, Beidou satellite navigation module or related API; The operating system records logs of network activities, including data usage and visited websites. The data extraction module is accessed through system management privileges. The operating system provides information about the device model, operating system version, and hardware configuration, which the data extraction module obtains through system settings or APIs.

3. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 1 is characterized in that: In the inspection setting module, the user can select the data type to be analyzed, the data type comes from the multidimensional data, and the user can select several data types for analysis; Users can configure abnormal behaviors to be checked in the Point Verification Settings module and define filtering conditions to exclude data that does not need to be analyzed or limit the data to be analyzed; filtering includes excluding data from specific applications, ignoring certain call records or text messages, and filtering based on geographic location; The verification settings module allows users to configure access control to ensure that only authorized personnel can perform verification operations; Access control configuration items include authentication, access control lists, and permission levels; Users can configure the review process, which includes: designation of reviewers, review procedures and processes, and recording and processing of review results.

4. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 1 is characterized in that: The mobile phone verification of the data verification module includes fast verification and regular verification, using the multi-dimensional data of the mobile phone itself to detect abnormal behavior, and the system analyzes the data stored on the mobile phone; mobile phone verification is a localized verification method used to analyze local data on the mobile phone; mobile phone verification can provide more detailed information on mobile phone usage, but requires the cooperation or access rights of the mobile phone user; The AI ​​verification of the data verification module uses AI technology to analyze multi-dimensional data of mobile phones. The AI ​​technology includes natural language processing, image analysis, and pattern recognition to detect abnormal behavior in an automated manner. AI verification is applied to large-scale data verification tasks, which require processing of large amounts of multi-dimensional data without manual intervention by users. The wireless inspection includes WIFI inspection and Bluetooth inspection, focusing on the wireless communication activities of the mobile phone. The system monitors the interaction with the wireless network or Bluetooth to detect potential abnormal behavior.

5. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 4 is characterized by: The data verification module can automatically select the optimal verification mode through the SVM algorithm and define the following parameters: T: task nature, D: data availability, R: resource requirements, Time: time limit, B: budget; the parameter values ​​are set by the user in the verification setting module; then, the parameters are combined to form a feature vector X, where each parameter is a component of the feature vector: X = [T, D, R, Time, B]; Next, define a target variable Y, where Y represents the best verification mode and is a positive integer representing different verification modes, where Y=1 represents the mobile verification mode, Y=2 represents the AI ​​verification mode, and Y=3 represents the wireless verification mode. Use SVM to build a multi-class classification model. In the multi-class SVM, each class corresponds to a verification mode. The model will learn how to predict the best verification mode Y based on the input feature vector X. The training formula is as follows: where ω is the normal vector of the hyperplane, ||ω|| 2 Represents the square of the normal vector, W T The weight of the parameter task nature, W D represents the weight of data availability, W R represents the weight of resource demand, W Time represents the weight of the time limit, W B Indicates the weight of the budget; The weights of the parameters are automatically set by the system, satisfying the following conditions: Where N is the total number of weights.

6. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 5 is characterized by: The mathematical formula for setting the weight of the task nature is as follows: Among them, W T is the weight of the task nature, N is the total number of task types, and G is the task type weight; The mathematical formula for setting the weight of data availability is as follows: Among them, W D is the weight of data availability, Q is the data quality score, and S is the availability score of the data source; The mathematical formula for setting the weight of resource requirements is as follows: Among them, W R is the weight of the resource demand parameter, K is the resource demand, C is the weight of the resource type, and M is the total number of resource types; The mathematical formula for setting the weight of the time limit is as follows: Among them, W Time is the weight of the time limit, U represents the task urgency score, and V represents the time from the task deadline; The mathematical formula for budget weight is as follows: Among them, P is the budget of the task, and H is the maximum budget of the task.

7. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 4 is characterized by: The mobile phone inspection includes ultra-fast inspection and regular inspection. The ultra-fast inspection detects abnormal behavior as quickly as possible, focusing on quickly identifying obvious abnormal behaviors. The inspection content provided includes malicious application installation, high-risk website visits, abnormal network activities, large-value fund transactions, abnormal application behavior, abnormal communication behavior, and abnormal location changes; Conventional verification is slower than fast verification and provides more in-depth multi-dimensional data analysis. The detection content provided includes the detection content in the fast verification, application usage records, call records, SMS records, location information, and network activities.

8. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 4 is characterized by: In the AI ​​verification, NLP technology is used to analyze text data, including sentiment analysis, topic modeling, keyword extraction and entity recognition; abnormal behaviors are extracted from the verification setting module and filtered by the user; if the call record includes voice information, voice recognition technology converts the voice into text, which is then analyzed using NLP; For image and video data, image analysis techniques are used for object recognition, face recognition, and image content classification. Abnormal patterns in images are detected using pattern recognition techniques. If a certain pattern or color exists, it indicates an abnormality. For call records and other time series data, pattern recognition technology is used to detect abnormal patterns and identify abnormal call periods, frequencies, and call volumes.

9. The abnormal behavior analysis system based on mobile phone multi-dimensional data according to claim 1 is characterized by: The report generation module first receives the abnormal behavior data from the data verification module, and organizes, classifies and sorts the data; the user can select the required report format according to his needs, and the report format includes HTML, PDF, WORD, EXCEL, and supports batch export; The report generation module provides preset report templates, and users can choose according to their needs; the content of the report includes a list of abnormal behaviors, a visual abnormal behavior chart, a detailed description of abnormal behaviors, recommended action steps, risk management strategies, and improvement suggestions; the charts are expressed using bar charts, line charts, and pie charts.

10. A method for analyzing abnormal behavior based on multi-dimensional data of mobile phones, characterized by: Here are the steps: S100, a data extraction module extracts multi-dimensional data from a mobile phone; S200, the user sets parameters in the data inspection module in the inspection setting module and configures abnormal behaviors to be checked; S300, the data verification module automatically selects the verification method through the SVM algorithm: select mobile phone verification, go to step S400; select AI verification, go to step S500; select wireless verification, go to step S600; S400, multidimensional data cleaning and preprocessing; S401, performing abnormal behavior detection; S402, generating a detection result of the mobile phone point verification mode, and proceeding to step S700; S500, Apply natural language processing technology to analyze text data; S501. Use image recognition and analysis technology to detect abnormal content; S502, automatically learning the normal behavior patterns of mobile phone users through pattern recognition technology; S503, generating the detection result of the AI ​​inspection mode, and proceeding to step S700; S600, monitors the phone's network traffic, analyzing packets, requests, and responses to detect potential abnormal behavior; S601, check whether there is a risk in the connection of the mobile phone; S602, generating the detection result of the wireless point verification mode, and proceeding to step S700; S700: A report generation module generates a report.

Images