A USB device management system based on registry analysis

Abstract

The present invention relates to the technical field of USB device management, and in particular to a USB device management system based on registry analysis, comprising: a data acquisition module, a first determination module, a second determination module, a determination module, an adjustment module, and a control module. The present invention utilizes a multi-layered real-time monitoring and determination mechanism to effectively improve the security of device access and the accuracy of management. By combining real-time device usage frequency, communication frequency, workload, and registry information, the present invention intelligently identifies potentially abnormal devices and dynamically adjusts load thresholds based on historical device data and behavioral fluctuations, thereby adjusting access permissions in real time to avoid non-compliant or dangerous device behavior. Based on pre-set rules and real-time changes, the present invention flexibly responds to security threats in different scenarios, effectively reducing human interference and system load, and effectively addressing the issues of low performance ceilings and poor management flexibility caused by over-reliance on cloud platforms and virtual machines.

Description

Technical Field

[0001] The present invention relates to the technical field of USB device management, and in particular to a USB device management system based on registry analysis. Background Art

[0002] With the continuous development of digitalization and networking, USB devices are increasingly used in various computer and virtual machine systems, becoming an important medium for data storage, device connection, and information exchange. How to efficiently and stably manage and distribute these devices to ensure smooth operation in complex working environments has become a major challenge in modern information technology.

[0003] Patent document with publication number CN114153552A discloses a USB device management method and apparatus, which includes: being applied to a host, each host being in communication with a cloud management platform, and the method including: if a USB device is detected to be connected locally, obtaining device information of the USB device, and updating the device information of the USB device to a locally maintained USB device information list; receiving a target USB device redirection instruction issued by the cloud management platform, wherein the target USB device redirection instruction includes the device information of the target USB and the target virtual machine information; based on the target USB device redirection instruction, starting the redirection service of the target USB device, and redirecting the target USB device to the target virtual machine.

[0004] It can be seen that the USB device management method has the following problems: the method is too dependent on the cloud management platform, and device redirection will fail when the network is unstable or the platform fails; each USB device access and redirection needs to rely on the cloud platform and virtual machine processing, resulting in excessive resource consumption and performance bottlenecks; when multiple virtual machines or complex devices are involved, the method cannot provide a sufficiently flexible redirection and management mechanism. Summary of the Invention

[0005] To this end, the present invention provides a USB device management system based on registry analysis, which is used to overcome the problems of low performance ceiling and poor management flexibility in the prior art due to over-reliance on cloud platforms and virtual machines by analyzing registry information.

[0006] To achieve the above object, the present invention provides a USB device management system based on registry analysis, comprising:

[0007] A data collection module is used to collect the real-time device usage frequency, real-time communication frequency, real-time registration table of the current access device and the real-time workload of the user using the access device;

[0008] a first determination module, connected to the data acquisition module, configured to determine that the access device is a first temporary target according to the real-time workload and a preset load threshold;

[0009] a second determination module, connected to the first determination module and the data acquisition module respectively, for determining whether the first temporary target is a second temporary target based on the real-time device usage frequency and the real-time communication frequency of the first temporary target;

[0010] a determination module, connected to the data acquisition module and the second determination module respectively, for determining that the second temporary target is an abnormal target according to the real-time registration table of the second temporary target;

[0011] an adjustment module, connected to the determination module, configured to adjust the preset load threshold according to the second temporary target and the abnormal target to form an adjusted load threshold;

[0012] A control module is connected to the adjustment module, the determination module and the data acquisition module respectively, and is used to control the authority of the abnormal target determined based on the adjustment load threshold according to the real-time registration table and the real-time communication frequency.

[0013] Furthermore, the first determination module includes:

[0014] a load comparison unit, configured to compare the real-time workload with the preset load threshold to form a load comparison result;

[0015] The first determination unit is connected to the load comparison unit and is configured to determine that the access device is a first temporary target when the load comparison result shows that the real-time workload is greater than the preset load threshold.

[0016] Furthermore, the second determination module includes:

[0017] A usage frequency fluctuation calculation unit is used to calculate the standard deviation of the usage frequency of the real-time device within a preset determination time period to form a usage frequency fluctuation value;

[0018] a communication frequency fluctuation calculation unit, configured to calculate a standard deviation of the real-time communication frequency within the preset determination time period to form a communication frequency fluctuation value;

[0019] The second determination unit is connected to the usage frequency fluctuation calculation unit and the communication frequency fluctuation calculation unit respectively, and is used to determine whether the first temporary destination is a second temporary destination according to the usage frequency fluctuation value and the communication frequency fluctuation value.

[0020] Furthermore, the second determining unit includes:

[0021] A usage frequency curve drawing subunit is used to draw a variation curve of the usage frequency fluctuation value to form a usage frequency curve;

[0022] a communication frequency curve drawing subunit, used for drawing a change curve of the communication frequency fluctuation value to form a communication frequency curve;

[0023] a consistency calculation subunit, connected to the usage frequency curve drawing subunit and the communication frequency curve drawing subunit respectively, for calculating the cosine similarity of the usage frequency curve and the communication frequency curve to form a change consistency;

[0024] The second determination subunit is connected to the consistency calculation subunit and is used to determine that the first temporary target is the second temporary target when the change consistency is less than a preset consistency threshold.

[0025] Furthermore, the determining module includes:

[0026] An extraction unit, configured to extract a global access-disabled value and a global disk-unwritable value from the real-time registry;

[0027] A determining unit is connected to the extracting unit and is configured to determine that the second temporary target is an abnormal target according to the global access-disabled value, or determine that the second temporary target is an abnormal target according to the global disk-unwritable value.

[0028] Furthermore, the adjustment module includes:

[0029] a temporary quantity fluctuation calculation unit, configured to calculate a standard deviation of the quantity of the second temporary target within a preset period to form a temporary quantity fluctuation value;

[0030] an abnormal quantity fluctuation calculation unit, configured to calculate a standard deviation of the number of abnormal targets within the preset period to form an abnormal quantity fluctuation value;

[0031] An adjustment unit is connected to the temporary quantity fluctuation calculation unit and the abnormal quantity fluctuation calculation unit respectively, and is used to adjust the preset load threshold according to the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form an adjusted load threshold.

[0032] Furthermore, the adjustment unit includes:

[0033] a deviation calculation subunit, configured to calculate a relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form a quantity fluctuation deviation;

[0034] The adjustment subunit is connected to the deviation calculation subunit and is used to increase the preset load threshold according to the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold and the preset adjustment coefficient when the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold, so as to form an adjusted load threshold.

[0035] Furthermore, the control module includes:

[0036] a prohibition unit, configured to prohibit access to the abnormal target according to the global access prohibition value of the abnormal target and the real-time communication frequency;

[0037] A setting unit is configured to set the abnormal target to a read-only mode according to the global disk unwritable value of the abnormal target and the real-time communication frequency.

[0038] Furthermore, the prohibition unit includes:

[0039] A first historical fluctuation calculation subunit is configured to calculate a standard deviation of the real-time communication frequency within a preset first historical duration to form a first historical fluctuation value;

[0040] a first prohibition subunit connected to the first historical fluctuation calculation subunit, configured to prohibit access to the abnormal target when the global access prohibition value is 0 and the first historical fluctuation value is greater than a preset first historical fluctuation threshold;

[0041] The second prohibition subunit is configured to prohibit the abnormal target access when the global prohibition access value is 1.

[0042] Furthermore, the setting unit includes:

[0043] A second historical fluctuation calculation subunit is used to calculate the standard deviation of the real-time communication frequency within a preset second historical period to form a second historical fluctuation value;

[0044] a first setting subunit, connected to the second historical fluctuation calculation subunit, configured to set the abnormal target to a read-only mode when the global disk unwritable value is 0 and the second historical fluctuation value is greater than a preset second historical fluctuation threshold;

[0045] The second setting subunit is configured to set the abnormal target to a read-only mode when the historical fluctuation value is 1.

[0046] Compared with the existing technology, the beneficial effect of the present invention is that, through a multi-level real-time monitoring and judgment mechanism, it can effectively improve the security of device access and the accuracy of management, combine the real-time device usage frequency, communication frequency, workload and registry information, intelligently identify potential abnormal devices, and dynamically adjust the load threshold according to the device's historical data and behavior fluctuations, so as to adjust access rights in real time to avoid non-compliant or dangerous device behavior, and flexibly respond to security threats in different scenarios according to preset rules and real-time changes, effectively reduce human interference and system load, improve the intelligence level of USB device management, ensure precise control of device access rights, and at the same time improve the stability, reliability and resource utilization efficiency of the overall system, effectively solving the problems of low performance ceiling and poor management flexibility due to over-reliance on cloud platforms and virtual machines.

[0047] Furthermore, by introducing preset load thresholds, the system can automatically assess user workloads based on specific load criteria, promptly identifying potential performance degradation due to overload. This threshold setting provides a dynamic assessment basis for the system, enabling it to automatically identify and take corrective measures when a user's workload becomes excessive, thereby preventing device overload and ensuring system stability and user experience.

[0048] Furthermore, by introducing fluctuation analysis of usage frequency and communication frequency, the stability of device usage and communication can be identified more accurately, which helps to discover potential abnormal patterns during device use, especially high-frequency changes, which indicate possible abnormal operation or failure. It can promptly identify the second temporary target and prevent resource abuse, performance degradation or safety hazards, thereby ensuring the healthy operation of the equipment and improving the reliability and stability of the system.

[0049] Furthermore, by introducing a method to judge the consistency of changes in usage frequency and communication frequency fluctuations, the system can more accurately identify abnormal patterns in device operation. Compared with judgments based solely on single frequency fluctuations, the use of curve consistency analysis of the two can more comprehensively evaluate the stability and abnormality of the device, effectively avoid misjudgment, and enhance the system's intelligent recognition capabilities, thereby better managing and regulating the device's usage rights and status.

[0050] Furthermore, by extracting the global disabled access value and the global disk unwritable value from the registry, the determination module can quickly identify whether the device has permission or operation abnormalities, thereby effectively ensuring system security. It not only improves the system's ability to detect abnormal devices, but also enhances the system's efficiency in responding to potential threats, avoiding data loss or security risks caused by device failure or malicious operations.

[0051] Furthermore, by dynamically adjusting the load threshold, the system can more accurately determine the load status of the device, avoiding excessive load or waste of resources, and ensuring efficient and stable operation of the device. Furthermore, this avoids the misjudgment or lag that can result from traditional static threshold settings, improving the system's response speed and accuracy.

[0052] Furthermore, through a dynamic adjustment mechanism, the system can respond to load fluctuations in real time, ensuring that equipment maintains optimal operating conditions even with large load fluctuations. Increasing the load threshold adjustment helps avoid misjudgments and enables the system to tolerate fluctuations within a certain range, reducing unnecessary restrictions or resource waste caused by excessive restrictions. By combining quantity fluctuation deviation, preset fluctuation deviation thresholds, and adjustment coefficients, the system's response is more precise, enabling flexible adjustment of load thresholds based on actual conditions, improving equipment stability and operational efficiency.

[0053] Furthermore, through the implementation of this control module, the system can implement immediate and precise access control for abnormal targets. The prohibition unit effectively curbs potential malicious access or excessive device usage, reducing the risk of system abuse. The setting unit effectively protects data security by setting abnormal targets to read-only mode, preventing data corruption caused by unnecessary write operations. This effectively prevents system failures and data loss that may occur under abnormal loads or security threats, ensuring the healthy operation of devices and data.

[0054] Furthermore, by introducing the calculation and analysis of historical fluctuations, the prohibition unit can more accurately determine the access risk of abnormal targets, avoiding the limitations of relying solely on real-time data. The first historical fluctuation calculation subunit can identify abnormal fluctuations in communication frequency, thereby preventing unreasonable access from continuing when the system load is abnormal. The first prohibition subunit ensures the rationality and stability of access control based on the comparison of historical fluctuation values with preset thresholds, avoiding misjudgments due to accidental frequency fluctuations. The second prohibition subunit provides a mandatory security mechanism, ensuring that when the global access prohibition value is 1, any abnormal target is immediately prohibited from access, unconditionally ensuring system security.

[0055] Furthermore, the configuration unit can adjust device access permissions based on historical fluctuations in communication frequency, ensuring that write access to the disk is automatically restricted when the device exhibits abnormal behavior, effectively preventing potential security threats and data corruption. Combined with the global disk write-blocking value, this provides a flexible permission control mechanism, improving system security and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 Schematic diagram of a USB device management system based on registry analysis in this embodiment;

[0057] Figure 2 This is a determination logic diagram for determining the first temporary target by the first determination module of this embodiment;

[0058] Figure 3 A determination logic diagram for determining a second temporary target by the second determination subunit of this embodiment;

[0059] Figure 4 This is a decision logic diagram for adjusting the preset load threshold value by the adjustment subunit in this embodiment. DETAILED DESCRIPTION

[0060] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention.

[0061] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0062] See also Figure 1 As shown, it is a schematic diagram of the USB device management system based on registry analysis in this embodiment;

[0063] This embodiment provides a USB device management system based on registry analysis, including:

[0064] A data collection module is used to collect the real-time device usage frequency, real-time communication frequency, real-time registration table of the current access device and the real-time workload of the user using the access device;

[0065] a first determination module, connected to the data acquisition module, configured to determine that the access device is a first temporary target according to the real-time workload and a preset load threshold;

[0066] a second determination module, connected to the first determination module and the data acquisition module respectively, for determining whether the first temporary target is a second temporary target based on the real-time device usage frequency and the real-time communication frequency of the first temporary target;

[0067] a determination module, connected to the data acquisition module and the second determination module respectively, for determining that the second temporary target is an abnormal target according to the real-time registration table of the second temporary target;

[0068] an adjustment module, connected to the determination module, configured to adjust the preset load threshold according to the second temporary target and the abnormal target to form an adjusted load threshold;

[0069] A control module is connected to the adjustment module, the determination module and the data acquisition module respectively, and is used to control the authority of the abnormal target determined based on the adjustment load threshold according to the real-time registration table and the real-time communication frequency.

[0070] Real-time workload refers to the total duration of a user's continuous task operations within a specific time period. It is measured by monitoring user interactions with the access device (such as keyboard input, mouse clicks, and program execution), reflecting the user's actual consumption and intensity of system resources during that time period. Simply put, real-time workload is the duration of active user work, reflecting the intensity of the access device's work during a specific period, thereby helping the system determine whether adjustments to the device's resource allocation or access permissions are necessary.

[0071] The data collection module collects real-time device usage frequency, communication frequency, registry information, and workload by monitoring and recording user interactions with devices. Device usage frequency is measured by recording the number of device accesses and operation frequency within a specific timeframe; communication frequency is determined by analyzing the frequency of data transmission between the device and external systems; and real-time registry information is obtained by periodically reading the device's registry data to monitor changes in device configuration and system status.

[0072] The preset load threshold is the duration at which the system determines whether to adjust when detecting user workload. It depends on the device's processing power, the average duration of user operations, and the system's response requirements. It is typically set between 10 minutes and 2 hours. In this embodiment, it is set to 30 minutes to ensure device stability and avoid excessive load under a reasonable workload. It effectively enables timely adjustments when the load is too high, ensuring long-term and efficient operation of the device.

[0073] Multiple modules work together to monitor and manage device access rights in real time. First, the data acquisition module acquires the device's usage frequency, communication frequency, registry information, and user workload in real time. Then, the first determination module determines whether the device is a "first temporary target" based on the workload and a preset threshold. Next, the second determination module further determines whether the device is a "second temporary target" by analyzing fluctuations in the device's usage frequency and communication frequency. Based on this, the determination module combines registry information to determine whether the device is an "abnormal target." The adjustment module adjusts the load threshold by analyzing fluctuations in the number of targets. Finally, the control module dynamically adjusts the access rights of abnormal devices based on updated thresholds and real-time data.

[0074] Through a multi-level real-time monitoring and judgment mechanism, the security of device access and the accuracy of management can be effectively improved. Combined with real-time device usage frequency, communication frequency, workload and registry information, it can intelligently identify potential abnormal devices and dynamically adjust the load threshold according to the device's historical data and behavior fluctuations, thereby adjusting access rights in real time to avoid non-compliant or dangerous device behavior. According to preset rules and real-time changes, it can flexibly respond to security threats in different scenarios, effectively reduce human interference and system load, improve the intelligence level of USB device management, ensure precise control of device access rights, and at the same time improve the stability, reliability and resource utilization efficiency of the overall system, effectively solving the problems of low performance ceiling and poor management flexibility due to over-reliance on cloud platforms and virtual machines.

[0075] Please continue reading Figure 2 As shown, it is a determination logic diagram of the first determination module determining the first temporary target in this embodiment;

[0076] The first determination module includes:

[0077] a load comparison unit, configured to compare the real-time workload with the preset load threshold to form a load comparison result;

[0078] The first determination unit is connected to the load comparison unit and is configured to determine that the access device is a first temporary target when the load comparison result shows that the real-time workload is greater than the preset load threshold.

[0079] The load comparison unit compares the real-time workload with a preset load threshold. The real-time workload refers to the duration of a user's continuous task operations within a specific time period, while the preset load threshold is a system-set standard that represents the upper limit of the user's work time under high load. When the real-time workload exceeds this threshold, the load comparison unit generates a load comparison result, and the first determination unit then determines that the access device is the first temporary target. This process helps the system assess the user's current workload and make appropriate determinations when the workload is too high.

[0080] By introducing preset load thresholds, the system can automatically assess user workloads based on specific load criteria, promptly identifying potential performance degradation due to overload. These thresholds provide a dynamic basis for assessment, enabling the system to automatically identify and implement adjustments when user workloads become excessive, thereby preventing excessive device load and ensuring system stability and user experience.

[0081] Specifically, the second determination module includes:

[0082] A usage frequency fluctuation calculation unit is used to calculate the standard deviation of the usage frequency of the real-time device within a preset determination time period to form a usage frequency fluctuation value;

[0083] a communication frequency fluctuation calculation unit, configured to calculate a standard deviation of the real-time communication frequency within the preset determination time period to form a communication frequency fluctuation value;

[0084] The second determination unit is connected to the usage frequency fluctuation calculation unit and the communication frequency fluctuation calculation unit respectively, and is used to determine whether the first temporary destination is a second temporary destination according to the usage frequency fluctuation value and the communication frequency fluctuation value.

[0085] The preset judgment time refers to the time period used as a reference when judging fluctuations in device usage frequency and communication frequency. It is usually used to calculate the standard deviation to help identify abnormal fluctuations in device operation. It depends on the system's response requirements and the average cycle of device usage. It must ensure that it can reflect changes in device usage without being disturbed by short-term fluctuations. It is usually set between 5 minutes and 30 minutes. In this embodiment, it is set to 10 minutes, which can balance the real-time and accuracy of the system, and can quickly respond to frequency fluctuations of the device while avoiding misjudging device abnormalities due to short-term fluctuations, thereby ensuring the stability and effectiveness of device management.

[0086] First, the standard deviation of the real-time device usage frequency is calculated based on the preset judgment period, thus forming a usage frequency fluctuation value. Simultaneously, the standard deviation of the real-time communication frequency is calculated based on the same time period, generating a communication frequency fluctuation value. Next, by comparing these two fluctuation values, an assessment is made to determine whether there are signs of frequent changes, thereby determining whether the first temporary target should be promoted to the second temporary target. This helps the system further confirm whether the device has entered an abnormal state.

[0087] By introducing fluctuation analysis of usage frequency and communication frequency, the stability of device usage and communication can be identified more accurately, which helps to discover potential abnormal patterns in the use of access devices, especially high-frequency changes, which may indicate abnormal operation or failure. It can promptly identify the second temporary target and prevent resource abuse, performance degradation or security risks, thereby ensuring the healthy operation of access devices and improving system reliability and stability.

[0088] Please continue reading Figure 3 As shown, it is a determination logic diagram of the second determination subunit determining the second temporary target in this embodiment;

[0089] The second determining unit includes:

[0090] A usage frequency curve drawing subunit is used to draw a variation curve of the usage frequency fluctuation value to form a usage frequency curve;

[0091] a communication frequency curve drawing subunit, used for drawing a change curve of the communication frequency fluctuation value to form a communication frequency curve;

[0092] a consistency calculation subunit, connected to the usage frequency curve drawing subunit and the communication frequency curve drawing subunit respectively, for calculating the cosine similarity of the usage frequency curve and the communication frequency curve to form a change consistency;

[0093] The second determination subunit is connected to the consistency calculation subunit and is used to determine that the first temporary target is the second temporary target when the change consistency is less than a preset consistency threshold.

[0094] The preset consistency threshold is the critical value for judging the consistency of changes between the usage frequency curve and the communication frequency curve. It is used to determine whether the two curves meet the predetermined similarity standard. It depends on the characteristics of the device usage frequency and communication frequency fluctuations, as well as the accuracy requirements for abnormality judgment. It is usually set between 0.7 and 0.9. In this embodiment, it is set to 0.8. While ensuring high accuracy, it can avoid overly strict standards that may cause normal devices to be misjudged as abnormal.

[0095] First, the frequency curve plotting subunit and the communication frequency curve plotting subunit are used to plot the fluctuation curves of the device usage frequency and communication frequency, respectively, within a preset determination time period. Next, the consistency calculation subunit calculates the cosine similarity of these two curves to determine the change consistency. Finally, if the calculated change consistency is less than the preset consistency threshold, the first temporary target is determined to be the second temporary target, indicating that the device's usage behavior is highly fluctuating and may be abnormal.

[0096] By introducing a method to determine the consistency of changes in usage frequency and communication frequency fluctuations, the system can more accurately identify abnormal patterns in device operation. Compared with judgments based solely on single frequency fluctuations, the use of curve consistency analysis of the two can more comprehensively evaluate the stability and abnormality of the device, effectively avoid misjudgments, and enhance the system's intelligent recognition capabilities, thereby better managing and regulating the device's usage permissions and status.

[0097] Specifically, the determination module includes:

[0098] An extraction unit, configured to extract a global access-disabled value and a global disk-unwritable value from the real-time registry;

[0099] a determining unit connected to the extracting unit, configured to determine that the second temporary target is an abnormal target according to the global access-disabled value, or to determine that the second temporary target is an abnormal target according to the global disk-unwritable value;

[0100] Among them, the global disable access value is an identifier in the registry, which indicates whether the system allows access to certain resources (such as devices, files, networks, etc.). When this value is set to "disabled", no user or application can access these resources, thus avoiding unnecessary or illegal operations. This value is mainly used by system administrators to limit the use of devices or resources in specific circumstances. The global disk non-writable value is another identifier in the registry, which indicates whether files on the disk are allowed to be written. When this value is set to "non-writable", all write operations to the disk will be denied. This setting is often used to protect the system from malware and prevent important files from being overwritten or tampered with.

[0101] The global disable access value is set in the real-time registry as follows:

[0102]

[0103] Specifically, the global access disable value "RemovableStorageClasses_DenyAll_Access_1" is a policy configured through the Windows registry that disables access to all removable storage devices. This policy is located in the user configuration directory "System > Removable Storage Access" under the registry key "Software\Policies\Microsoft\Windows\RemovableStorageDevices." Access is controlled by setting the registry value "Deny_All." This registry value is a DWORD value. A value of "1" disables access to all removable storage devices, while a value of "0" does not disable access. This policy is implemented through the ADMX file "RemovableStorage.admx" and is primarily used to strengthen system security and prevent potential threats posed by external storage devices.

[0104] The global disk unwritable value is set in the real-time registry as follows:

[0105]

[0106] Specifically, the global disk write-protection value "WriteProtect" is a policy set through the Windows Registry that controls write permissions for removable disks. This policy is located under the registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies." Write protection is enabled or disabled by setting the "WriteProtect" registry value. A value of "1" enables write protection, prohibiting write operations to removable disks; a value of "0" disables write protection, allowing write operations to the disk. This setting is often used to prevent data loss or the spread of malware through external storage devices.

[0107] In the determination module, the extraction unit is responsible for extracting the global access-disabled value and the global disk-unwritable value from the real-time registry. These values provide critical information regarding device access permissions and disk writability. The determination unit then uses the extracted values to determine whether the second temporary target is an abnormal target. If the global access-disabled value indicates that device access is disabled, or the global disk-unwritable value indicates that the disk cannot be written to, the system determines that the temporary target is an abnormal target.

[0108] By extracting the global disabled access value and the global disk unwritable value from the registry, the determination module can quickly identify whether the device has permission or operation abnormalities, thereby effectively ensuring system security. This not only improves the system's ability to detect abnormal devices, but also enhances the system's efficiency in responding to potential threats, avoiding data loss or security risks caused by device failure or malicious operations.

[0109] Specifically, the adjustment module includes:

[0110] a temporary quantity fluctuation calculation unit, configured to calculate a standard deviation of the quantity of the second temporary target within a preset period to form a temporary quantity fluctuation value;

[0111] an abnormal quantity fluctuation calculation unit, configured to calculate a standard deviation of the number of abnormal targets within the preset period to form an abnormal quantity fluctuation value;

[0112] An adjustment unit is connected to the temporary quantity fluctuation calculation unit and the abnormal quantity fluctuation calculation unit respectively, and is used to adjust the preset load threshold according to the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form an adjusted load threshold.

[0113] The preset period is the time period used to calculate the fluctuations in the number of second temporary targets and abnormal targets. It depends on the system usage scenario and the frequency of device access. It is usually set between 1 hour and 24 hours. In this embodiment, it is set to 1 hour. It can accurately capture the real-time changes in the device usage status and the number of targets, avoid response delays caused by too long time periods, and is suitable for usage scenarios with frequent fluctuations, improving system response speed and accuracy.

[0114] The adjustment module uses two calculation units to calculate the standard deviation of the second temporary target and the abnormal target over a preset period, respectively, to generate a temporary quantity fluctuation value and an abnormal quantity fluctuation value. The adjustment unit then adjusts the preset load threshold based on these two fluctuation values, forming an adjusted load threshold. This process dynamically optimizes the load threshold by monitoring target quantity fluctuations, ensuring that the system can make real-time adjustments based on changes in equipment load.

[0115] By dynamically adjusting the load threshold, the system can more accurately determine the load status of the device, avoiding excessive load or waste of resources, and ensuring efficient and stable operation of the device. Furthermore, it avoids the misjudgment or lag that can result from traditional static threshold settings, improving the system's response speed and accuracy.

[0116] Please continue reading Figure 4 As shown, it is a decision logic diagram of the adjustment subunit in this embodiment for determining and adjusting the preset load threshold;

[0117] The adjustment unit includes:

[0118] a deviation calculation subunit, configured to calculate a relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form a quantity fluctuation deviation;

[0119] An adjustment subunit is connected to the deviation calculation subunit and is used to increase the preset load threshold according to the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold and the preset adjustment coefficient when the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold, so as to form an adjusted load threshold, wherein the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold is positively correlated with the adjusted load threshold.

[0120] The preset fluctuation deviation threshold is a reference standard for determining whether quantity fluctuation deviation exceeds the normal range. It depends on the system's load fluctuation characteristics and the stability requirements of business needs. It is usually set between 0.05 and 0.15 to accommodate most load fluctuations. In this embodiment, it is set to 0.1 to balance response speed and system stability, avoiding frequent load threshold adjustments while ensuring timely adjustment measures in the event of large fluctuations.

[0121] The preset adjustment coefficient is a parameter used to adjust the load threshold, which aims to control the increase in the load threshold. It depends on the performance characteristics of the equipment, the stability requirements of the system, and the tolerance for load fluctuations in different application scenarios. It is usually set between 0.1 and 2. In this embodiment, it is set to 1.5. It can ensure that the system makes appropriate adjustments when the load fluctuates greatly, and avoids excessive relaxation of the load threshold, thereby maintaining system stability.

[0122] First, the relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value is calculated to obtain the quantity fluctuation deviation. This deviation indicates the degree of quantity fluctuation between the temporary target and the abnormal target. If the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold, it indicates that the system has detected a large load fluctuation, which may affect system stability. Based on this judgment, the adjustment subunit will increase the preset load threshold based on the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold, combined with a preset adjustment coefficient, to form a new adjusted load threshold. This is done to avoid misjudging excessive load or low load due to excessive fluctuations, which could affect equipment performance.

[0123] Through a dynamic adjustment mechanism, the system can respond to load fluctuations in real time, ensuring that equipment maintains optimal operation even under large load fluctuations. Increasing the load threshold adjustment helps avoid misjudgments and allows the system to tolerate fluctuations within a certain range, reducing unnecessary restrictions or resource waste caused by excessive restrictions. By combining quantity fluctuation deviation, preset fluctuation deviation thresholds, and adjustment coefficients, the system's response is more precise, allowing for flexible adjustment of load thresholds based on actual conditions, improving equipment stability and operational efficiency.

[0124] Specifically, the control module includes:

[0125] a prohibition unit, configured to prohibit access to the abnormal target according to the global access prohibition value of the abnormal target and the real-time communication frequency;

[0126] A setting unit is configured to set the abnormal target to a read-only mode according to the global disk unwritable value of the abnormal target and the real-time communication frequency.

[0127] The prohibition unit determines whether there is any access behavior of an abnormal target based on the abnormal target's global disabled access value (such as the global disabled access registry value) and the real-time communication frequency, and immediately prohibits the target from accessing system resources when an abnormality is found to prevent potential security threats or system overloads. The setting unit determines whether the access rights of the abnormal target should be set to read-only mode based on the abnormal target's global disk non-writable value and real-time communication frequency, thereby restricting its write operations and avoiding data corruption or unauthorized data modification. Through meticulous management of access control, the expansion of abnormal behavior is effectively limited and the normal operation of the system is protected.

[0128] Through the implementation of this control module, the system can implement immediate and precise access control for abnormal targets. The prohibition unit effectively curbs potential malicious access or excessive device usage, reducing the risk of system abuse. The setting unit effectively protects data security by setting abnormal targets to read-only mode, preventing data corruption caused by unnecessary write operations. This effectively prevents system failures and data loss that may occur under abnormal loads or security threats, ensuring the healthy operation of equipment and data.

[0129] Specifically, the prohibition unit includes:

[0130] A first historical fluctuation calculation subunit is configured to calculate a standard deviation of the real-time communication frequency within a preset first historical duration to form a first historical fluctuation value;

[0131] a first prohibition subunit connected to the first historical fluctuation calculation subunit, configured to prohibit access to the abnormal target when the global access prohibition value is 0 and the first historical fluctuation value is greater than a preset first historical fluctuation threshold;

[0132] The second prohibition subunit is configured to prohibit the abnormal target access when the global prohibition access value is 1.

[0133] The preset first historical duration refers to the time period used by the first historical fluctuation calculation subunit to calculate the standard deviation of the real-time communication frequency. It depends on the change period of the communication frequency fluctuation in actual application and is usually set between a few hours and a day. In this embodiment, it is set to 8 hours, which can effectively cover communication fluctuations over a longer period of time, and helps to identify potential abnormal fluctuations without being affected by accidental changes in a short period of time.

[0134] The preset first historical fluctuation threshold is a standard value used to determine whether abnormal target access needs to be prohibited. It depends on the normal usage mode of the system, the fluctuation range of the communication frequency, and the tolerance for abnormal behavior. It is usually set between 0.1 and 2. In this embodiment, it is 1.5. It can effectively balance the difference between normal fluctuations and abnormal fluctuations, avoid unnecessary restrictions caused by accidental small fluctuations, and effectively identify larger abnormal fluctuations to improve the security and stability of the system.

[0135] First, the first historical fluctuation calculation subunit calculates the standard deviation of the real-time communication frequency based on the preset first historical time length (for example, data within a certain period of time in the past) to obtain the first historical fluctuation value. This fluctuation value reflects the changes in the communication frequency of the device in the past period of time. Then, the first prohibition subunit checks the first historical fluctuation value when it detects that the global access prohibition value is 0 (that is, access is allowed). If this fluctuation value is greater than the preset first historical fluctuation threshold, the system determines that the access behavior of the abnormal target is unstable or abnormal, and then prohibits the access of the abnormal target to prevent excessive occupation or possible abuse of system resources. When the global access prohibition value is 1, the second prohibition subunit directly prohibits the access of the abnormal target regardless of other factors to ensure that security is not threatened.

[0136] By incorporating the calculation and analysis of historical fluctuations, the prohibition unit can more accurately determine the access risk of abnormal targets, avoiding the limitations of relying solely on real-time data. The first historical fluctuation calculation subunit can identify abnormal fluctuations in communication frequency, thereby preventing unreasonable access from continuing when the system load is abnormal. The first prohibition subunit ensures the rationality and stability of access control by comparing historical fluctuation values with preset thresholds, avoiding misjudgments due to accidental frequency fluctuations. The second prohibition subunit provides a mandatory security mechanism, ensuring that when the global access prohibition value is 1, any abnormal target is immediately prohibited from access, unconditionally guaranteeing system security.

[0137] Specifically, the setting unit includes:

[0138] A second historical fluctuation calculation subunit is used to calculate the standard deviation of the real-time communication frequency within a preset second historical period to form a second historical fluctuation value;

[0139] a first setting subunit, connected to the second historical fluctuation calculation subunit, configured to set the abnormal target to a read-only mode when the global disk unwritable value is 0 and the second historical fluctuation value is greater than a preset second historical fluctuation threshold;

[0140] The second setting subunit is configured to set the abnormal target to a read-only mode when the historical fluctuation value is 1.

[0141] The preset second historical duration is the time period used to calculate the second historical fluctuation value, which depends on the time period that needs to be observed and evaluated in order to determine whether the communication fluctuation of the device exceeds the predetermined threshold. It is generally set between a few hours and a day. In this embodiment, it is set to 12 hours, which can provide sufficient information to analyze abnormal fluctuations while avoiding the inaccuracy of too short a period.

[0142] The preset second historical fluctuation threshold refers to the standard for triggering a change in device status when the second historical fluctuation value exceeds the threshold. It depends on the normal range of historical communication fluctuations and the device's tolerance to fluctuations. The threshold is generally set between 0.1 and 0.5. In this embodiment, it is set to 0.3, which can be monitored within a reasonable fluctuation range. It helps to accurately detect anomalies when the communication frequency changes significantly, while avoiding too frequent false triggers.

[0143] The second historical fluctuation value is calculated by calculating the standard deviation of the real-time communication frequency over a preset second historical period. The first setting subunit sets the abnormal target to read-only mode when the global disk unwritable value is 0 and the second historical fluctuation value exceeds a preset threshold. The second setting subunit directly sets the abnormal target to read-only mode when the global disk unwritable value is 1. This allows the setting unit to flexibly set device access rights based on the different conditions of communication frequency fluctuation and global disk unwritable value.

[0144] The settings unit can adjust device access permissions based on historical fluctuations in communication frequency, ensuring that write access to the disk is automatically restricted when the device exhibits abnormal behavior, effectively preventing potential security threats and data corruption. Combined with the global disk write-blocking value, this provides a flexible permission control mechanism, improving system security and stability.

[0145] Thus far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present invention.

Claims

1. A USB device management system based on registry analysis, characterized in that: include: A data collection module is used to collect the real-time device usage frequency, real-time communication frequency, real-time registration table of the current access device and the real-time workload of the user using the access device; a first determination module, connected to the data acquisition module, configured to determine that the access device is a first temporary target according to the real-time workload and a preset load threshold; a second determination module, connected to the first determination module and the data acquisition module respectively, for determining whether the first temporary target is a second temporary target based on the real-time device usage frequency and the real-time communication frequency of the first temporary target; a determination module, connected to the data acquisition module and the second determination module respectively, for determining that the second temporary target is an abnormal target according to the real-time registration table of the second temporary target; an adjustment module, connected to the determination module, configured to adjust the preset load threshold according to the second temporary target and the abnormal target to form an adjusted load threshold; A control module is connected to the adjustment module, the determination module and the data acquisition module respectively, and is used to control the authority of the abnormal target determined based on the adjustment load threshold according to the real-time registration table and the real-time communication frequency.

2. The USB device management system based on registry analysis according to claim 1, characterized in that: The first determination module includes: a load comparison unit, configured to compare the real-time workload with the preset load threshold to form a load comparison result; The first determination unit is connected to the load comparison unit and is configured to determine that the access device is a first temporary target when the load comparison result shows that the real-time workload is greater than the preset load threshold.

3. The USB device management system based on registry analysis according to claim 2, characterized in that: The second determination module includes: A usage frequency fluctuation calculation unit is used to calculate the standard deviation of the usage frequency of the real-time device within a preset determination time period to form a usage frequency fluctuation value; a communication frequency fluctuation calculation unit, configured to calculate a standard deviation of the real-time communication frequency within the preset determination time period to form a communication frequency fluctuation value; The second determination unit is connected to the usage frequency fluctuation calculation unit and the communication frequency fluctuation calculation unit respectively, and is used to determine whether the first temporary destination is a second temporary destination according to the usage frequency fluctuation value and the communication frequency fluctuation value.

4. The USB device management system based on registry analysis according to claim 3, characterized in that: The second determining unit includes: A usage frequency curve drawing subunit is used to draw a variation curve of the usage frequency fluctuation value to form a usage frequency curve; a communication frequency curve drawing subunit, used for drawing a change curve of the communication frequency fluctuation value to form a communication frequency curve; a consistency calculation subunit, connected to the usage frequency curve drawing subunit and the communication frequency curve drawing subunit respectively, for calculating the cosine similarity of the usage frequency curve and the communication frequency curve to form a change consistency; The second determination subunit is connected to the consistency calculation subunit and is used to determine that the first temporary target is the second temporary target when the change consistency is less than a preset consistency threshold.

5. The USB device management system based on registry analysis according to claim 4, characterized in that: The determination module includes: An extraction unit, configured to extract a global access-disabled value and a global disk-unwritable value from the real-time registry; A determining unit is connected to the extracting unit and is configured to determine that the second temporary target is an abnormal target according to the global access-disabled value, or determine that the second temporary target is an abnormal target according to the global disk-unwritable value.

6. The USB device management system based on registry analysis according to claim 5, characterized in that: The adjustment module includes: a temporary quantity fluctuation calculation unit, configured to calculate a standard deviation of the quantity of the second temporary target within a preset period to form a temporary quantity fluctuation value; an abnormal quantity fluctuation calculation unit, configured to calculate a standard deviation of the number of abnormal targets within the preset period to form an abnormal quantity fluctuation value; An adjustment unit is connected to the temporary quantity fluctuation calculation unit and the abnormal quantity fluctuation calculation unit respectively, and is used to adjust the preset load threshold according to the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form an adjusted load threshold.

7. The USB device management system based on registry analysis according to claim 6, characterized in that: The adjustment unit includes: a deviation calculation subunit, configured to calculate a relative deviation between the temporary quantity fluctuation value and the abnormal quantity fluctuation value to form a quantity fluctuation deviation; The adjustment subunit is connected to the deviation calculation subunit and is used to increase the preset load threshold according to the relative deviation between the quantity fluctuation deviation and the preset fluctuation deviation threshold and the preset adjustment coefficient when the quantity fluctuation deviation is greater than the preset fluctuation deviation threshold, so as to form an adjusted load threshold.

8. The USB device management system based on registry analysis according to claim 7, characterized in that: The control module includes: a prohibition unit, configured to prohibit access to the abnormal target according to the global access prohibition value of the abnormal target and the real-time communication frequency; A setting unit is configured to set the abnormal target to a read-only mode according to the global disk unwritable value of the abnormal target and the real-time communication frequency.

9. The USB device management system based on registry analysis according to claim 8, characterized in that: The prohibition unit includes: A first historical fluctuation calculation subunit is configured to calculate a standard deviation of the real-time communication frequency within a preset first historical duration to form a first historical fluctuation value; a first prohibition subunit connected to the first historical fluctuation calculation subunit, configured to prohibit access to the abnormal target when the global access prohibition value is 0 and the first historical fluctuation value is greater than a preset first historical fluctuation threshold; The second prohibition subunit is configured to prohibit the abnormal target access when the global prohibition access value is 1.

10. The USB device management system based on registry analysis according to claim 9, characterized in that: The setting unit includes: A second historical fluctuation calculation subunit is used to calculate the standard deviation of the real-time communication frequency within a preset second historical period to form a second historical fluctuation value; a first setting subunit, connected to the second historical fluctuation calculation subunit, configured to set the abnormal target to a read-only mode when the global disk unwritable value is 0 and the second historical fluctuation value is greater than a preset second historical fluctuation threshold; The second setting subunit is configured to set the abnormal target to a read-only mode when the historical fluctuation value is 1.

Images