USB equipment management system based on registry analysis

Abstract

The invention relates to the technical field of USB equipment management, in particular to a USB equipment management system based on registry analysis, which comprises a data acquisition module, a first judgment module, a second judgment module, a determination module, an adjustment module and a control module. Through a multi-level real-time monitoring and judging mechanism, the safety of equipment access and the accuracy of management can be effectively improved, potential abnormal equipment is intelligently identified in combination with real-time equipment use frequency, communication frequency, workload and registry information, and a load threshold is dynamically adjusted according to historical data and behavior fluctuation of the equipment, so that the safety of equipment access is improved. Therefore, the access authority is adjusted in real time, non-compliant or dangerous equipment behaviors are avoided, security threats in different scenes are flexibly coped according to preset rules and real-time changes, man-made interference and system loads are effectively reduced, and the problems of low performance upper limit and poor management flexibility caused by excessive dependence on a cloud platform and a virtual machine are effectively solved.

Description

Technical Field

[0001] The present invention relates to the technical field of USB device management, and in particular, to a USB device management system based on registry analysis. Background Art

[0002] With the continuous development of digitalization and networking, USB devices are increasingly widely used in various computer and virtual machine systems, becoming an important medium for data storage, device connection, and information exchange. How to efficiently and stably manage and allocate these devices to ensure smooth operation in a complex working environment has become a major challenge in modern information technology.

[0003] The patent document with the publication number CN114153552A discloses a USB device management method and device. The method is applied to a host, and each host is communicatively connected to a cloud management platform. The method includes: if it is monitored that a USB device is connected to the local, obtaining the device information of the USB device and updating the device information of the USB device to the USB device information list maintained locally; receiving a target USB device redirection instruction issued by the cloud management platform, where the target USB device redirection instruction includes the device information of the target USB and the target virtual machine information; based on the target USB device redirection instruction, starting the redirection service of the target USB device and redirecting the target USB device to the target virtual machine.

[0004] It can be seen that the USB device management method has the following problems: this method is overly dependent on the cloud management platform, and when the network is unstable or the platform fails, device redirection fails; each time a USB device is connected and redirected, it needs to rely on the cloud platform and virtual machine for processing, resulting in excessive resource consumption and performance bottlenecks; when multiple virtual machines or complex devices are involved, this method cannot provide a sufficiently flexible redirection and management mechanism. Summary of the Invention

[0005] For this reason, the present invention provides a USB device management system based on registry analysis to overcome the problems of low performance upper limit and poor management flexibility in the prior art due to excessive dependence on the cloud platform and virtual machines by analyzing registry information.

[0006] To achieve the above object, the present invention provides a USB device management system based on registry analysis, including:

[0007] A data acquisition module for collecting the real-time device usage frequency, real-time communication frequency, real-time registry of the currently accessed device, and the real-time workload of the user using the accessed device;

[0008] The first determination module, which is connected to the data acquisition module, is used to determine that the access device is a first temporary target according to the real-time workload and a preset workload threshold;

[0009] The second determination module, which is respectively connected to the first determination module and the data acquisition module, is used to determine that the first temporary target is a second temporary target according to the real-time device usage frequency and the real-time communication frequency of the first temporary target;

[0010] The determination module, which is respectively connected to the data acquisition module and the second determination module, is used to determine that the second temporary target is an abnormal target according to the real-time registry of the second temporary target;

[0011] The adjustment module, which is connected to the determination module, is used to adjust the preset workload threshold according to the second temporary target and the abnormal target to form an adjusted workload threshold;

[0012] The control module, which is respectively connected to the adjustment module, the determination module, and the data acquisition module, is used to control the permissions of the abnormal target determined based on the adjusted workload threshold according to the real-time registry and the real-time communication frequency.

[0013] Further, the first determination module includes:

[0014] The workload comparison unit, which is used to compare the real-time workload and the preset workload threshold to form a workload comparison result;

[0015] The first determination unit, which is connected to the workload comparison unit, is used to determine that the access device is a first temporary target when the workload comparison result is that the real-time workload is greater than the preset workload threshold.

[0016] Further, the second determination module includes:

[0017] The usage frequency fluctuation calculation unit, which is used to calculate the standard deviation of the real-time device usage frequency within a preset determination duration to form a usage frequency fluctuation value;

[0018] The communication frequency fluctuation calculation unit, which is used to calculate the standard deviation of the real-time communication frequency within the preset determination duration to form a communication frequency fluctuation value;

[0019] The second determination unit, which is respectively connected to the usage frequency fluctuation calculation unit and the communication frequency fluctuation calculation unit, is used to determine that the first temporary target is a second temporary target according to the usage frequency fluctuation value and the communication frequency fluctuation value.

[0020] Further, the second determination unit includes:

[0021] A usage frequency curve plotting subunit for plotting a change curve of the usage frequency fluctuation value to form a usage frequency curve;

[0022] A communication frequency curve plotting subunit for plotting a change curve of the communication frequency fluctuation value to form a communication frequency curve;

[0023] A consistency calculation subunit, which is respectively connected to the usage frequency curve plotting subunit and the communication frequency curve plotting subunit, for calculating the cosine similarity between the usage frequency curve and the communication frequency curve to form a change consistency;

[0024] A second determination subunit, which is connected to the consistency calculation subunit, for determining the first temporary target as the second temporary target when the change consistency is less than a preset consistency threshold.

[0025] Further, the determination module includes:

[0026] An extraction unit for extracting the global disabled access value and the global disk unwritable value from the real-time registry;

[0027] A determination unit, which is connected to the extraction unit, for determining the second temporary target as an abnormal target according to the global disabled access value, or determining the second temporary target as an abnormal target according to the global disk unwritable value.

[0028] Further, the adjustment module includes:

[0029] A temporary quantity fluctuation calculation unit for calculating the standard deviation of the quantity of the second temporary target within a preset period to form a temporary quantity fluctuation value;

[0030] An abnormal quantity fluctuation calculation unit for calculating the standard deviation of the quantity of the abnormal target within the preset period to form an abnormal quantity fluctuation value;

[0031] An adjustment unit, which is respectively connected to the temporary quantity fluctuation calculation unit and the abnormal quantity fluctuation calculation unit, for adjusting the preset load threshold according to the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form an adjusted load threshold.

[0032] Further, the adjustment unit includes:

[0033] A deviation calculation subunit for calculating the relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form a quantity fluctuation deviation;

[0034] An adjustment subunit, connected to the deviation calculation subunit, for increasing the preset load threshold to form an adjusted load threshold according to the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold and a preset adjustment coefficient when the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold.

[0035] Further, the control module includes:

[0036] A prohibition unit, for prohibiting access to the abnormal target according to the global disable access value and the real-time communication frequency of the abnormal target;

[0037] A setting unit, for setting the abnormal target to a read-only mode according to the global disk unwritable value and the real-time communication frequency of the abnormal target.

[0038] Further, the prohibition unit includes:

[0039] A first historical fluctuation calculation subunit, for calculating the standard deviation of the real-time communication frequency within a preset first historical duration to form a first historical fluctuation value;

[0040] A first prohibition subunit, connected to the first historical fluctuation calculation subunit, for prohibiting access to the abnormal target when the global disable access value is 0 and the first historical fluctuation value is greater than a preset first historical fluctuation threshold;

[0041] A second prohibition subunit, for prohibiting access to the abnormal target when the global disable access value is 1.

[0042] Further, the setting unit includes:

[0043] A second historical fluctuation calculation subunit, for calculating the standard deviation of the real-time communication frequency within a preset second historical duration to form a second historical fluctuation value;

[0044] A first setting subunit, connected to the second historical fluctuation calculation subunit, for setting the abnormal target to a read-only mode when the global disk unwritable value is 0 and the second historical fluctuation value is greater than a preset second historical fluctuation threshold;

[0045] A second setting subunit, for setting the abnormal target to a read-only mode when the historical fluctuation value is 1.

[0046] Compared with the prior art, the beneficial effects of the present invention are as follows. Through a multi-level real-time monitoring and determination mechanism, the security of device access and the accuracy of management can be effectively improved. By combining real-time device usage frequency, communication frequency, workload, and registry information, potential abnormal devices can be intelligently identified, and the load threshold can be dynamically adjusted according to the historical data and behavior fluctuations of the devices, thereby adjusting access permissions in real time to avoid non-compliant or dangerous device behaviors. According to preset rules and real-time changes, different security threats in different scenarios can be flexibly addressed, effectively reducing human interference and system load, improving the intelligent level of USB device management, ensuring precise control of device access permissions, and at the same time enhancing the overall system stability, reliability, and resource utilization efficiency, effectively solving the problems of low performance ceiling and poor management flexibility caused by over-reliance on cloud platforms and virtual machines.

[0047] Furthermore, by introducing a preset load threshold, the system can automatically evaluate the user's working status based on specific load criteria and promptly detect situations where performance may decline due to overload. The setting of the threshold provides a dynamic evaluation basis for the system, enabling the system to automatically identify and take adjustment measures when the user's workload is too high, thereby avoiding overloading of the device and ensuring the stability of the system and the user experience.

[0048] Furthermore, by introducing the fluctuation analysis of usage frequency and communication frequency, the stability of device usage and communication can be more accurately identified, which helps to discover potential abnormal patterns during device usage, especially high-frequency changes, indicating possible abnormal operations or faults. The second temporary target can be promptly identified to prevent resource abuse, performance degradation, or security risks, thereby ensuring the healthy operation of the device and enhancing the reliability and stability of the system.

[0049] Furthermore, by introducing a method for judging the consistency of changes in usage frequency and communication frequency fluctuations, the system can more accurately identify abnormal patterns that occur during device operations. Compared with the judgment based solely on single-frequency fluctuations, the curve consistency analysis of the two can more comprehensively evaluate the stability and abnormality of the device, effectively avoiding misjudgment and enhancing the intelligent recognition ability of the system, thereby better managing and regulating the usage permissions and status of the device.

[0050] Furthermore, by extracting the global disable access value and the global disk non-writable value from the registry, the determination module can quickly identify whether there are permission or operation abnormalities in the device, thereby effectively ensuring system security. It not only improves the system's detection ability for abnormal devices but also enhances the system's efficiency in responding to potential threats, avoiding data loss or security risks caused by device failures or malicious operations.

[0051] Furthermore, by dynamically adjusting the load threshold, the system can more accurately determine the load status of the device, avoid overloading or resource waste, and ensure the efficient and stable operation of the device. In addition, it avoids misjudgment or lag that may be caused by traditional static threshold settings, and improves the response speed and accuracy of the system.

[0052] Furthermore, through the dynamic adjustment mechanism, the system can respond in real time to load fluctuations, ensuring that the device can still maintain a good operating state even when the load fluctuates greatly. Increasing the adjustment of the load threshold helps to avoid misjudgment and enables the system to tolerate a certain range of fluctuations, reducing unnecessary restrictions or resource waste caused by excessive restrictions. By combining the quantity fluctuation deviation, the preset fluctuation deviation threshold, and the adjustment coefficient, the system's response is more precise, and it can flexibly adjust the load threshold according to the actual situation, improving the stability and operating efficiency of the device.

[0053] Furthermore, through the implementation of this control module, the system can implement immediate and precise access control for abnormal targets. The prohibition unit effectively curbs potential malicious access or overly frequent device usage behaviors, reducing the risk of system abuse. The setting unit effectively protects the security of data by setting abnormal targets to read-only mode, preventing damage to data caused by unnecessary write operations, effectively preventing system failures and data loss that may occur under abnormal loads or security threats, and ensuring the healthy operation of the device and data.

[0054] Furthermore, by introducing the calculation and analysis of historical fluctuations, the prohibition unit can more accurately determine the access risk of abnormal targets, avoiding the limitations of simply relying on real-time data. The first historical fluctuation calculation subunit can identify abnormal fluctuations in communication frequency, thereby preventing unreasonable access from continuing to be allowed when the system load is abnormal. The first prohibition subunit ensures the rationality and stability of access control based on the comparison of the historical fluctuation value with the preset threshold, avoiding misjudgment due to accidental frequency fluctuations. The second prohibition subunit provides a mandatory security mechanism to ensure that when the global access disable value is 1, any abnormal target is immediately prohibited from accessing, unconditionally guaranteeing the security of the system.

[0055] Furthermore, the setting unit can timely adjust the access rights of the device according to the historical fluctuation of the communication frequency, ensuring that the device can automatically restrict write operations to the disk when abnormal behaviors occur, thereby effectively avoiding potential security threats and data damage. By combining the setting of the global disk non-writable value, a flexible permission control mechanism can be provided, improving the security and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of the USB device management system based on registry analysis in this embodiment;

[0057] Figure 2 This is the decision logic diagram for the first decision module in this embodiment to determine the first temporary target;

[0058] Figure 3 This is the decision logic diagram for the second decision sub-unit in this embodiment to determine the second temporary target;

[0059] Figure 4 This is the decision logic diagram for the adjustment sub-unit in this embodiment to determine the adjusted preset load threshold. Detailed implementation manners

[0060] In order to make the objectives and advantages of the present invention more clear, the present invention will be further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0061] The preferred implementation manners of the present invention will be described below with reference to the accompanying drawings. Those skilled in the art should understand that these implementation manners are only used to explain the technical principles of the present invention and do not limit the protection scope of the present invention.

[0062] Please refer to Figure 1 as shown, which is a schematic diagram of the USB device management system based on registry analysis in this embodiment;

[0063] This embodiment provides a USB device management system based on registry analysis, including:

[0064] A data acquisition module for acquiring the real-time device usage frequency, real-time communication frequency, real-time registry of the currently accessed device, and the real-time workload of the user using the accessed device;

[0065] A first decision module, connected to the data acquisition module, for determining the accessed device as a first temporary target according to the real-time workload and the preset load threshold;

[0066] A second decision module, respectively connected to the first decision module and the data acquisition module, for determining the first temporary target as a second temporary target according to the real-time device usage frequency and the real-time communication frequency of the first temporary target;

[0067] A determination module, respectively connected to the data acquisition module and the second decision module, for determining the second temporary target as an abnormal target according to the real-time registry of the second temporary target;

[0068] An adjustment module, connected to the determination module, for adjusting the preset load threshold according to the second temporary target and the abnormal target to form an adjusted load threshold;

[0069] A control module, which is respectively connected to the adjustment module, the determination module, and the data acquisition module, and is used to control the permissions of the abnormal targets determined based on the adjustment load threshold according to the real-time registry and the real-time communication frequency.

[0070] The real-time workload refers to the total duration of continuous task operations by the user within a specific time period. It is measured by monitoring the user's interaction behaviors with the access device (such as keyboard input, mouse clicks, and program running), and reflects the actual consumption and usage intensity of system resources by the user during this time period. In short, the real-time workload is the duration of the user's active work, which can reflect the working intensity of the access device within a specific period, and thus helps the system determine whether it is necessary to adjust the resource allocation or access permissions of the access device.

[0071] The data acquisition module collects the real-time device usage frequency, real-time communication frequency, real-time registry, and real-time workload by monitoring and recording the user's interaction behaviors with the device. The device usage frequency is obtained by recording the access times and operation frequencies of the device within a specific time; the communication frequency is obtained by analyzing the data transmission frequency between the device and the external system; the real-time registry information is obtained by regularly reading the registry data of the device to monitor changes in device configuration and system status.

[0072] The preset load threshold refers to the duration threshold for the system to decide whether to make adjustments when detecting the user's workload, which depends on the processing capacity of the device, the average duration of user operations, and the response requirements of the system. It is usually set between 10 minutes and 2 hours. In this embodiment, it is set to 30 minutes to ensure the stability of the device under a reasonable workload and avoid overloading, and can effectively make timely adjustments when the load is too high to ensure the long-term efficient operation of the device.

[0073] The access permissions of the device are monitored and managed in real time through the collaborative work of multiple modules. First, the data acquisition module obtains the device usage frequency, communication frequency, registry information, and the user's workload in real time. Then, the first determination module determines whether the device is a "first temporary target" based on the workload and the preset threshold. Next, the second determination module further determines whether the device is a "second temporary target" by analyzing the fluctuations in the device usage frequency and communication frequency. On this basis, the determination module combines the registry information to determine whether the device is an "abnormal target". The adjustment module adjusts the load threshold by analyzing the fluctuations in the number of targets. Finally, the control module dynamically adjusts the access permissions of the abnormal device according to the updated threshold and real-time data.

[0074] Through a multi-level real-time monitoring and determination mechanism, the security of device access and the accuracy of management can be effectively improved. By combining real-time device usage frequency, communication frequency, workload, and registry information, potential abnormal devices can be intelligently identified, and the load threshold can be dynamically adjusted according to the historical data and behavior fluctuations of the devices, so as to adjust access permissions in real time, avoid non-compliant or dangerous device behaviors, flexibly respond to security threats in different scenarios according to preset rules and real-time changes, effectively reduce human interference and system load, improve the intelligence level of USB device management, ensure the precise control of device access permissions, and at the same time enhance the overall system stability, reliability, and resource utilization efficiency, effectively solving the problems of low performance ceiling and poor management flexibility caused by over-reliance on cloud platforms and virtual machines.

[0075] Please continue to refer to Figure 2 As shown, it is the determination logic diagram of the first determination module for determining the first temporary target in this embodiment;

[0076] The first determination module includes:

[0077] A load comparison unit for comparing the real-time workload and the preset load threshold to form a load comparison result;

[0078] A first determination unit, which is connected to the load comparison unit, for determining that the access device is the first temporary target when the load comparison result is that the real-time workload is greater than the preset load threshold.

[0079] Through the load comparison unit, the real-time workload is compared with the preset load threshold. The real-time workload refers to the duration of continuous task operations by the user within a specific time period, while the preset load threshold is a standard set by the system, representing the upper limit of the working time of the user in a high-load state. When the real-time workload exceeds this threshold, the load comparison unit will generate a load comparison result, and then the first determination unit determines that the access device is the first temporary target. This process helps the system evaluate the user's current workload and make corresponding determinations when the load is too high.

[0080] By introducing a preset load threshold, the system can automatically evaluate the user's working state based on specific load criteria and timely detect situations that may lead to performance degradation due to overload. The setting of the threshold provides a dynamic evaluation basis for the system, enabling the system to automatically identify and take adjustment measures when the user's workload is too high, thus avoiding overloading of the device and ensuring the stability of the system and the user experience.

[0081] Specifically, the second determination module includes:

[0082] A usage frequency fluctuation calculation unit is configured to calculate the standard deviation of the real-time device usage frequency within a preset determination duration to form a usage frequency fluctuation value;

[0083] A communication frequency fluctuation calculation unit is configured to calculate the standard deviation of the real-time communication frequency within the preset determination duration to form a communication frequency fluctuation value;

[0084] A second determination unit, which is respectively connected to the usage frequency fluctuation calculation unit and the communication frequency fluctuation calculation unit, is configured to determine the first temporary target as the second temporary target according to the usage frequency fluctuation value and the communication frequency fluctuation value.

[0085] The preset determination duration refers to the time period referred to when judging the fluctuations of the device usage frequency and communication frequency. It is usually used to calculate the standard deviation to help identify abnormal fluctuations in device operations. It depends on the system's response requirements and the average cycle of device usage. It is necessary to ensure that it can reflect the changes in device usage and is not interfered by short-term fluctuations. It is usually set between 5 minutes and 30 minutes. In this embodiment, it is set to 10 minutes, which can balance the real-time performance and accuracy of the system. It can quickly respond to the frequency fluctuations of the device and avoid misjudging device abnormalities due to short-term fluctuations, ensuring the stability and effectiveness of device management.

[0086] First, calculate the standard deviation of the real-time device usage frequency according to the preset determination duration to form a usage frequency fluctuation value. At the same time, calculate the standard deviation of the real-time communication frequency according to the same time period to generate a communication frequency fluctuation value. Then, based on the comparison of these two fluctuation values, evaluate whether there are signs of frequent changes, so as to judge whether the first temporary target needs to be promoted to the second temporary target, which can help the system further confirm whether the device has entered an abnormal state.

[0087] By introducing the fluctuation analysis of the usage frequency and communication frequency, the stability of device usage and communication can be more accurately identified, which helps to discover potential abnormal patterns during the access device usage process, especially high-frequency changes, indicating that there may be abnormal operations or faults. It can timely identify the second temporary target, prevent resource abuse, performance degradation or security risks, so as to ensure the healthy operation of the access device and improve the reliability and stability of the system.

[0088] Please continue to refer to Figure 3 as shown, which is the determination logic diagram of the second determination subunit in this embodiment for determining the second temporary target;

[0089] The second determination unit includes:

[0090] A usage frequency curve drawing subunit is configured to draw a change curve of the usage frequency fluctuation value to form a usage frequency curve;

[0091] A communication frequency curve plotting subunit, which is used to plot the change curve of the communication frequency fluctuation value to form a communication frequency curve;

[0092] A consistency calculation subunit, which is respectively connected to the usage frequency curve plotting subunit and the communication frequency curve plotting subunit, and is used to calculate the cosine similarity between the usage frequency curve and the communication frequency curve to form a change consistency;

[0093] A second determination subunit, which is connected to the consistency calculation subunit, and is used to determine that the first temporary target is the second temporary target when the change consistency is less than a preset consistency threshold.

[0094] The preset consistency threshold is a critical value for judging the change consistency between the usage frequency curve and the communication frequency curve, and is used to determine whether these two curves meet the predetermined similarity standard. It depends on the characteristics of the device usage frequency and communication frequency fluctuations, as well as the accuracy requirements for abnormal determination. Usually, it is set between 0.7 and 0.9. In this embodiment, it is set to 0.8, which can avoid misjudging normal devices as abnormal due to overly strict standards while ensuring relatively high accuracy.

[0095] First, through the usage frequency curve plotting subunit and the communication frequency curve plotting subunit, the fluctuation change curves of the device usage frequency and communication frequency within the preset determination duration are respectively plotted. Then, the cosine similarity of these two curves is calculated by the consistency calculation subunit to obtain the change consistency. Finally, if the calculated change consistency is less than the preset consistency threshold, it is determined that the first temporary target is the second temporary target, indicating that the usage behavior of the device has large fluctuations and may be abnormal.

[0096] By introducing a method for judging the change consistency of the usage frequency and communication frequency fluctuations, the system can more accurately identify abnormal patterns in device operations. Compared with the judgment based solely on the single frequency fluctuation, the curve consistency analysis of the two can more comprehensively evaluate the stability and abnormality of the device, effectively avoid misjudgment, improve the intelligent recognition ability of the system, and thus better manage and control the usage rights and status of the device.

[0097] Specifically, the determination module includes:

[0098] An extraction unit, which is used to extract the global disable access value and the global disk non-writable value in the real-time registry;

[0099] A determination unit, which is connected to the extraction unit, and is used to determine that the second temporary target is an abnormal target according to the global disable access value, or determine that the second temporary target is an abnormal target according to the global disk non-writable value;

[0100] Among them, the global access disable value is an identifier in the registry, indicating whether the system allows access to certain resources (such as devices, files, networks, etc.). When this value is set to "disabled", no user or application can access these resources, thus avoiding unnecessary or illegal operations. This value is mainly used by system administrators to restrict the use of devices or resources in specific situations. The global disk non-writable value is another identifier in the registry, indicating whether files on the disk are allowed to be written. When this value is set to "non-writable", all write operations to the disk will be rejected. This setting is often used to protect the system from malware and prevent important files from being overwritten or tampered with.

[0101] The setting of the global access disable value in the live registry is as follows:

[0102]

[0103] Specifically, the global access disable value "Removab l eStorageC l asses_DenyAl l_Access_1" is a policy configured through the Windows registry, aiming to disable the access rights to all removable storage devices. This policy is located under the path of "System > Removable Storage Access" in the user configuration. The specific registry key is "Software\Po lic ies\M icrosoft\Wi ndows\Removab l eStorageDev ices", and the access rights are controlled by setting the registry value "Deny_Al l". The type of the registry value is "DWORD". When its value is "1", it means to disable the access to all removable storage devices; when the value is "0", it means not to disable the access. This policy is implemented through the ADMX file "Removab leStorage.admx" and is mainly used to enhance system security and prevent potential threats brought by external storage devices.

[0104] The setting of the global disk non-writable value in the live registry is as follows:

[0105]

[0106] Specifically, the global disk unwritable value "WriteProtect" is a policy set through the Windows registry to control the write permissions of removable disks. This policy is located under the registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies", and specifically enables or disables write protection by setting the "WriteProtect" registry value. When the value is "1", it indicates that write protection is enabled and writing operations to removable disks are prohibited; when the value is "0", it indicates that write protection is cancelled and writing operations to the disk are allowed. This setting is commonly used to prevent data loss or the spread of malware through external storage devices.

[0107] In the determination module, the extraction unit is responsible for extracting the global access disabled value and the global disk unwritable value from the real-time registry. These values provide key information about device access permissions and disk writability. Then, the determination unit determines whether the second temporary target is an abnormal target based on the extracted values. If the global access disabled value indicates that device access is disabled, or the global disk unwritable value indicates that the disk cannot be written, the system determines that the temporary target is an abnormal target.

[0108] By extracting the global access disabled value and the global disk unwritable value from the registry, the determination module can quickly identify whether there are permission or operation abnormalities in the device, thus effectively ensuring system security. It not only improves the system's detection ability for abnormal devices but also enhances the system's efficiency in responding to potential threats, avoiding data loss or security risks caused by device failures or malicious operations.

[0109] Specifically, the adjustment module includes:

[0110] A temporary quantity fluctuation calculation unit for calculating the standard deviation of the quantity of the second temporary target within a preset period to form a temporary quantity fluctuation value;

[0111] An abnormal quantity fluctuation calculation unit for calculating the standard deviation of the quantity of the abnormal target within the preset period to form an abnormal quantity fluctuation value;

[0112] An adjustment unit, which is respectively connected to the temporary quantity fluctuation calculation unit and the abnormal quantity fluctuation calculation unit, for adjusting the preset load threshold according to the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form an adjusted load threshold.

[0113] The preset period is the time period used to calculate the fluctuations in the number of the second temporary target and the abnormal target, which depends on the usage scenario of the system and the frequency of device access. It is usually set between 1 hour and 24 hours. In this embodiment, it is set to 1 hour, which can accurately capture the immediate changes in the device usage status and the target quantity, avoid the reaction lag caused by too long time periods, and at the same time is applicable to usage scenarios with frequent fluctuations, improving the system response speed and accuracy.

[0114] The adjustment module calculates the standard deviations of the number of the second temporary target and the abnormal target within the preset period through two calculation units respectively, forming a temporary quantity fluctuation value and an abnormal quantity fluctuation value. Then, through the adjustment unit, the preset load threshold is adjusted according to these two fluctuation values to form an adjusted load threshold. This process dynamically optimizes the load threshold by monitoring the fluctuations in the target quantity, ensuring that the system can make real-time adjustments according to the changes in device load.

[0115] By dynamically adjusting the load threshold, the system can more accurately judge the load status of the device, avoid overloading or resource waste, and ensure the efficient and stable operation of the device. In addition, it avoids the misjudgment or lag that may be caused by traditional static threshold settings, improving the system response speed and accuracy.

[0116] Please continue to refer to Figure 4 as shown, which is the decision logic diagram for the adjustment subunit of this embodiment to determine and adjust the preset load threshold;

[0117] The adjustment unit includes:

[0118] A deviation calculation subunit for calculating the relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form a quantity fluctuation deviation;

[0119] An adjustment subunit, which is connected to the deviation calculation subunit, for increasing the preset load threshold according to the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold and the preset adjustment coefficient when the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold to form an adjusted load threshold, where the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold and the adjusted load threshold are positively correlated.

[0120] The preset fluctuation deviation threshold is a reference standard used to judge whether the quantity fluctuation deviation exceeds the normal range, which depends on the load fluctuation characteristics of the system and the stability requirements of business needs. It is usually set between 0.05 and 0.15 to adapt to most load fluctuation situations. In this embodiment, it is set to 0.1, aiming to balance the response speed and system stability, avoid frequent adjustment of the load threshold, and at the same time ensure that adjustment measures are taken in a timely manner in case of large fluctuations.

[0121] The preset adjustment coefficient is a parameter used to adjust the load threshold, aiming to control the increase amplitude of the load threshold, depending on the performance characteristics of the device, the stability requirements of the system, and the tolerance of load fluctuations in different application scenarios. It is usually set between 0.1 and 2. In this embodiment, it is set to 1.5, which can not only ensure that the system makes appropriate adjustments when the load fluctuates greatly, but also avoid overly relaxing the load threshold, thus maintaining the system stability.

[0122] First, calculate the relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value to obtain the quantity fluctuation deviation. This deviation represents the degree of quantity fluctuation between the temporary target and the abnormal target. If the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold, it indicates that the system detects a large load fluctuation, which may affect the system stability. Based on this judgment, the adjustment subunit will increase the preset load threshold according to the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold, combined with the preset adjustment coefficient, to form a new adjusted load threshold. This is to avoid misjudging the load as too high or too low due to excessive fluctuations, which may affect the device performance.

[0123] Through the dynamic adjustment mechanism, the system can respond to the load fluctuation situation in real time, ensuring that the device can still maintain a good operating state when the load fluctuates greatly. The adjustment of increasing the load threshold helps to avoid misjudgment and enables the system to tolerate a certain range of fluctuations, reducing unnecessary restrictions or resource waste caused by excessive restrictions. By combining the quantity fluctuation deviation, the preset fluctuation deviation threshold, and the adjustment coefficient, the system's response is more precise, and it can flexibly adjust the load threshold according to the actual situation, improving the device stability and operating efficiency.

[0124] Specifically, the control module includes:

[0125] A prohibition unit, used to prohibit the abnormal target from accessing according to the global disable access value of the abnormal target and the real-time communication frequency;

[0126] A setting unit, used to set the abnormal target to read-only mode according to the global disk non-writable value of the abnormal target and the real-time communication frequency.

[0127] The prohibition unit judges whether there is an access behavior of the abnormal target according to the global disable access value (such as the global disable access registry value) of the abnormal target and the real-time communication frequency, and immediately prohibits the target from accessing system resources when an abnormality is found, to prevent potential security threats or system overload. The setting unit judges whether the access permission of the abnormal target should be set to read-only mode according to the global disk non-writable value of the abnormal target and the real-time communication frequency, so as to limit its write operation and avoid data corruption or unauthorized data modification. Through the meticulous management of access control, the expansion of abnormal behaviors is effectively restricted, and the normal operation of the system is protected.

[0128] Through the implementation of this control module, the system can implement immediate and precise access control for abnormal targets. The prohibition unit effectively curbs potential malicious access or overly frequent device usage behaviors, reducing the risk of system abuse. The setting unit effectively protects data security by setting the abnormal target to read-only mode, preventing unnecessary write operations from damaging the data, effectively preventing system failures and data loss that may occur under abnormal loads or security threats, and ensuring the healthy operation of the device and data.

[0129] Specifically, the prohibition unit includes:

[0130] The first historical fluctuation calculation subunit is used to calculate the standard deviation of the real-time communication frequency within a preset first historical duration, forming a first historical fluctuation value;

[0131] The first prohibition subunit, which is connected to the first historical fluctuation calculation subunit, is used to prohibit the abnormal target from accessing when the global access prohibition value is 0 and the first historical fluctuation value is greater than the preset first historical fluctuation threshold;

[0132] The second prohibition subunit is used to prohibit the abnormal target from accessing when the global access prohibition value is 1.

[0133] The preset first historical duration refers to the time period used by the first historical fluctuation calculation subunit to calculate the standard deviation of the real-time communication frequency, which depends on the change period of the communication frequency fluctuation in actual applications. It is usually set between several hours and one day. In this embodiment, it is set to 8 hours, which can effectively cover communication fluctuations over a long time, help identify potential abnormal fluctuations, and not be affected by accidental changes within a short time.

[0134] The preset first historical fluctuation threshold is a standard value used to determine whether the access of an abnormal target needs to be prohibited. It depends on the normal usage mode of the system, the fluctuation range of the communication frequency, and the tolerance for abnormal behaviors. It is usually set between 0.1 and 2. In this embodiment, it is 1.5, which can effectively balance the difference between normal fluctuations and abnormal fluctuations, avoid triggering unnecessary restrictions due to accidental small fluctuations, and effectively identify large abnormal fluctuations, improving the security and stability of the system.

[0135] First, the first historical fluctuation calculation subunit calculates the standard deviation of the real-time communication frequency according to a preset first historical duration (such as data within a certain past time) to obtain a first historical fluctuation value. This fluctuation value reflects the change in the device communication frequency over a past period. Next, when the first prohibition subunit detects that the global disable access value is 0 (i.e., access is allowed), it checks the first historical fluctuation value. If this fluctuation value is greater than the preset first historical fluctuation threshold, the system determines that the access behavior of the abnormal target is unstable or abnormal, and then prohibits the access of this abnormal target to prevent excessive occupation or possible abuse of system resources. The second prohibition subunit, on the other hand, directly prohibits the access of the abnormal target when the global disable access value is 1, regardless of other factors, to ensure that security is not threatened.

[0136] By introducing the calculation and analysis of historical fluctuations, the prohibition unit can more accurately determine the access risk of abnormal targets, avoiding the limitations of simply relying on real-time data. The first historical fluctuation calculation subunit can identify abnormal fluctuations in the communication frequency, thereby preventing the continued allowance of unreasonable access when the system load is abnormal. The first prohibition subunit ensures the rationality and stability of access control based on the comparison between the historical fluctuation value and the preset threshold, avoiding misjudgment due to accidental frequency fluctuations. The second prohibition subunit provides a forced security mechanism to ensure that when the global disable access value is 1, any abnormal target is immediately prohibited from accessing, unconditionally guaranteeing the security of the system.

[0137] Specifically, the setting unit includes:

[0138] A second historical fluctuation calculation subunit for calculating the standard deviation of the real-time communication frequency within a preset second historical duration to form a second historical fluctuation value;

[0139] A first setting subunit connected to the second historical fluctuation calculation subunit for setting the abnormal target to read-only mode when the global disk unwritable value is 0 and the second historical fluctuation value is greater than the preset second historical fluctuation threshold;

[0140] A second setting subunit for setting the abnormal target to read-only mode when the historical fluctuation value is 1.

[0141] The preset second historical duration is the time period used to calculate the second historical fluctuation value, which depends on the time period that needs to be observed and evaluated to determine whether the communication fluctuation of the device exceeds a predetermined threshold. It is generally set between several hours and one day. In this embodiment, it is set to 12 hours, which can provide sufficient information to analyze abnormal fluctuations while avoiding inaccuracies in too short a cycle.

[0142] The preset second historical fluctuation threshold refers to the standard for triggering a change in the device state when the second historical fluctuation value exceeds this threshold. It depends on the normal range of historical communication fluctuations and the device's tolerance to fluctuations. This threshold is generally set between 0.1 and 0.5. In this embodiment, it is set to 0.3, which can monitor within a reasonable fluctuation range, helping to accurately detect anomalies when there are significant changes in the communication frequency and avoiding overly frequent false triggers.

[0143] By calculating the standard deviation of the real-time communication frequency within the preset second historical duration, a second historical fluctuation value is formed. The first setting subunit will set the abnormal target to read-only mode when the non-writable value of the global disk is 0 and the second historical fluctuation value exceeds the preset threshold; the second setting subunit will directly set the abnormal target to read-only mode when the non-writable value of the global disk is 1. In this way, the setting unit can flexibly set the device access rights according to different conditions of communication frequency fluctuations and the non-writable value of the global disk.

[0144] The setting unit can timely adjust the device access rights according to the historical fluctuation situation of the communication frequency, ensuring that the device can automatically restrict the write operation to the disk when abnormal behavior occurs, thereby effectively avoiding potential security threats and data corruption. By combining the setting of the non-writable value of the global disk, a flexible permission control mechanism can be provided, improving the security and stability of the system.

[0145] So far, the technical solution of the present invention has been described in combination with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A USB device management system based on registry analysis, characterized in that: include: A data collection module, used to collect the real-time device usage frequency, real-time communication frequency, real-time registration table of the current access device and the real-time workload of the user using the access device; A first determination module, connected to the data acquisition module, for determining that the access device is a first temporary target according to the real-time workload and a preset load threshold; A second determination module, which is connected to the first determination module and the data acquisition module respectively, and is used to determine that the first temporary target is a second temporary target according to the real-time device usage frequency and the real-time communication frequency of the first temporary target; a determination module, which is connected to the data acquisition module and the second determination module respectively, and is used to determine that the second temporary target is an abnormal target according to the real-time registration table of the second temporary target; an adjustment module, connected to the determination module, for adjusting the preset load threshold according to the second temporary target and the abnormal target to form an adjusted load threshold; A control module is connected to the adjustment module, the determination module and the data acquisition module respectively, and is used to control the authority of the abnormal target determined based on the adjustment load threshold according to the real-time registration table and the real-time communication frequency.

2. The USB device management system based on registry analysis according to claim 1, characterized in that: The first determination module comprises: A load comparison unit, used to compare the real-time workload with the preset load threshold to form a load comparison result; The first determination unit is connected to the load comparison unit and is used for determining that the access device is a first temporary target when the load comparison result shows that the real-time workload is greater than the preset load threshold.

3. The USB device management system based on registry analysis according to claim 2, characterized in that: The second determination module comprises: A usage frequency fluctuation calculation unit, used to calculate the standard deviation of the usage frequency of the real-time device within a preset determination time length to form a usage frequency fluctuation value; A communication frequency fluctuation calculation unit, used to calculate the standard deviation of the real-time communication frequency within the preset determination time length to form a communication frequency fluctuation value; The second determination unit is connected to the use frequency fluctuation calculation unit and the communication frequency fluctuation calculation unit respectively, and is used to determine whether the first temporary target is a second temporary target according to the use frequency fluctuation value and the communication frequency fluctuation value.

4. The USB device management system based on registry analysis according to claim 3 is characterized in that: The second determination unit comprises: A usage frequency curve drawing subunit is used to draw a variation curve of the usage frequency fluctuation value to form a usage frequency curve; A communication frequency curve drawing subunit is used to draw a change curve of the communication frequency fluctuation value to form a communication frequency curve; a consistency calculation subunit, which is connected to the usage frequency curve drawing subunit and the communication frequency curve drawing subunit respectively, and is used to calculate the cosine similarity of the usage frequency curve and the communication frequency curve to form a change consistency; The second determination subunit is connected to the consistency calculation subunit, and is used for determining that the first temporary target is the second temporary target when the change consistency is less than a preset consistency threshold.

5. The USB device management system based on registry analysis according to claim 4 is characterized in that: The determination module comprises: An extraction unit, used for extracting a global access-disabled value and a global disk-unwritable value in the real-time registry; A determination unit is connected to the extraction unit and is used to determine that the second temporary target is an abnormal target according to the global access disabled value, or to determine that the second temporary target is an abnormal target according to the global disk unwritable value.

6. The USB device management system based on registry analysis according to claim 5, characterized in that: The adjustment module comprises: a temporary quantity fluctuation calculation unit, configured to calculate a standard deviation of the quantity of the second temporary target within a preset period to form a temporary quantity fluctuation value; an abnormal quantity fluctuation calculation unit, used to calculate the standard deviation of the quantity of the abnormal targets within the preset period to form an abnormal quantity fluctuation value; An adjustment unit is connected to the temporary quantity fluctuation calculation unit and the abnormal quantity fluctuation calculation unit respectively, and is used to adjust the preset load threshold according to the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form an adjusted load threshold.

7. The USB device management system based on registry analysis according to claim 6, characterized in that: The adjustment unit comprises: a deviation calculation subunit, used to calculate the relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form a quantity fluctuation deviation; The adjustment subunit is connected to the deviation calculation subunit and is used to increase the preset load threshold according to the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold and the preset adjustment coefficient when the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold, so as to form an adjusted load threshold.

8. The USB device management system based on registry analysis according to claim 7, characterized in that: The control module comprises: a prohibition unit, configured to prohibit access to the abnormal target according to the global access prohibition value of the abnormal target and the real-time communication frequency; A setting unit is used to set the abnormal target to a read-only mode according to the global disk unwritable value of the abnormal target and the real-time communication frequency.

9. The USB device management system based on registry analysis according to claim 8, characterized in that: The prohibition unit comprises: A first historical fluctuation calculation subunit is used to calculate the standard deviation of the real-time communication frequency within a preset first historical duration to form a first historical fluctuation value; A first prohibition subunit, connected to the first history fluctuation calculation subunit, is used to prohibit the abnormal target access when the global access prohibition value is 0 and the first history fluctuation value is greater than a preset first history fluctuation threshold; The second prohibition subunit is used to prohibit the abnormal target access when the global prohibition access value is 1.

10. The USB device management system based on registry analysis according to claim 9, characterized in that: The setting unit comprises: A second historical fluctuation calculation subunit is used to calculate the standard deviation of the real-time communication frequency within a preset second historical duration to form a second historical fluctuation value; A first setting subunit, connected to the second historical fluctuation calculation subunit, is used to set the abnormal target to a read-only mode when the global disk unwritable value is 0 and the second historical fluctuation value is greater than a preset second historical fluctuation threshold; The second setting subunit is used to set the abnormal target to a read-only mode when the historical fluctuation value is 1.

Images