Tablet computer user privacy protection data optimization method based on federal learning

Abstract

The invention relates to the technical field of computer security and privacy protection, in particular to a federated learning-based tablet computer user privacy protection data optimization method. The method comprises the following steps: acquiring tablet touch dynamic data; extracting a sliding track feature vector from the tablet touch dynamic data; performing user behavior pattern analysis according to the sliding track feature vector to obtain a user behavior pattern classification result and a behavior feature vector set; extracting a feature information entropy vector and a feature time sequence correlation vector of the behavior feature vector set; and performing dual evaluation weight fusion processing on the feature information entropy vector and the feature time sequence correlation vector to obtain a safety sensitivity weight matrix. According to the method, the problem of privacy disclosure caused by abnormal use of the tablet equipment in the federated learning environment is solved through a behavior feature security sensitivity evaluation mechanism and behavior offset tolerance calculation, data security is guaranteed, and the system resource use efficiency is optimized.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security and privacy protection, and in particular to a method for optimizing tablet computer user privacy protection data based on federated learning. Background Art

[0002] Existing tablet user privacy protection technologies generally use static feature weights and fixed threshold mechanisms for anomaly detection and privacy protection. These mechanisms are unable to dynamically adjust to different user habits, usage scenarios, and application sensitivity. This results in the system either over-protecting and consuming resources, or under-protecting and posing security risks.

[0003] Furthermore, traditional anomaly detection algorithms struggle to accurately distinguish natural changes in user behavior from truly abnormal behavior. They lack the adaptability and tolerance calculation mechanisms to the gradual evolution of user habits and often misjudge normal changes in user behavior as abnormalities, leading to frequent false alarms and unnecessary security measures, severely impacting user experience.

[0004] At the same time, most existing privacy protection solutions adopt a coarse-grained overall protection strategy, which is unable to identify and specifically protect specific high-risk operations (such as password input, sensitive information filling, file uploading, etc.), resulting in insufficient protection at key privacy points or waste of resources in low-risk scenarios.

[0005] In summary, existing technologies have problems such as lack of dynamic adaptability, high false alarm rate and coarse protection granularity that need to be solved urgently. Summary of the Invention

[0006] Based on this, it is necessary to provide a tablet user privacy protection data optimization method based on federated learning to solve at least one of the above technical problems.

[0007] To achieve the above objectives, a tablet user privacy protection data optimization method based on federated learning includes the following steps:

[0008] Step S1: obtaining tablet touch dynamic data and tablet system logs; extracting sliding trajectory feature vectors from the tablet touch dynamic data; performing user behavior pattern analysis based on the sliding trajectory feature vectors and tablet system logs to obtain user behavior pattern classification results and a behavior feature vector set;

[0009] Step S2: extracting the feature information entropy vector and the feature time series correlation vector of the behavior feature vector set; performing dual evaluation weight fusion processing on the feature information entropy vector and the feature time series correlation vector according to the user behavior pattern classification result to obtain a security sensitivity weight matrix;

[0010] Step S3: Construct a baseline behavior pattern based on the behavior feature vector set to obtain a user behavior baseline library; calculate the behavior deviation tolerance based on the user behavior baseline library to obtain a behavior deviation tolerance table; set multi-level thresholds based on the behavior deviation tolerance table and the security sensitivity weight matrix to obtain a multi-dimensional abnormality threshold configuration table;

[0011] Step S4: The current behavior is judged as abnormal according to the multi-dimensional abnormal threshold configuration table to obtain the abnormal level judgment result; the federated learning participation adjustment strategy is selected according to the abnormal level judgment result to obtain the participation adjustment strategy; the protection parameter instruction is executed according to the participation adjustment strategy to achieve the privacy protection data optimization task.

[0012] This invention collects tablet users' touch dynamics data (coordinates, time, pressure) and system logs (applications, time and space, and operations) in real time and across multiple dimensions, converting them into numerical sliding trajectory features, application interaction sequence features, and spatiotemporal usage pattern feature vectors. This step comprehensively and meticulously characterizes user behavioral habits. Furthermore, by identifying specific behavioral patterns such as delicate operations, stressful operations, sensitive information processing, and unconventional usage, a preliminary assessment of the user's current status and potential risks is achieved. Ultimately, these multi-source, multi-type features are effectively integrated and dimensionalized to generate a compact and information-rich behavioral feature vector set. This provides high-quality input data for subsequent security sensitivity assessment and anomaly detection, significantly improving the depth and breadth of understanding user behavioral characteristics and laying the foundation for accurate security risk assessment and privacy protection. The dual evaluation mechanism of information entropy and temporal correlation overcomes the limitations of traditional methods that use fixed weights or single-dimensional evaluation. By calculating the information entropy of features, their ability to distinguish different behavioral patterns and user identities is quantified; by analyzing the temporal correlation of features, their temporal stability and reliability as user personalization are assessed. By combining the security risk scores of user behavior patterns, features with high information content, temporal stability, and correlation with high-risk patterns are assigned higher security sensitivity weights. This dynamic and adaptive weighting method enables the security sensitivity weight matrix to more accurately reflect the actual importance of different behavioral features in identifying anomalies and assessing risks, improving the accuracy and efficiency of security identification and avoiding excessive focus on low-sensitivity features. A multi-tiered anomaly threshold system based on user behavior baselines and factoring in behavioral excursion tolerance is constructed. First, a detailed user behavior baseline database is established to accurately characterize normal user behavior habits. Second, an innovative behavioral excursion tolerance calculation takes into account the impact of multiple factors, such as time, scenario, operational continuity, and application sensitivity, on the natural variation of user behavior. This enables the system to distinguish between normal changes and true anomalies, significantly reducing false alarm rates and improving user experience. Finally, combining behavioral excursion tolerance and security sensitivity weights, three levels of anomaly thresholds—basic, intermediate, and advanced—are established, implementing hierarchical management of anomaly detection. This tiered threshold system enables differentiated responses based on anomaly severity, improving the flexibility of system security protection and resource efficiency. Dynamically adjust federated learning security participation based on real-time behavior monitoring and anomaly detection. By comparing current behavioral characteristics collected in real time with user behavior baselines and multi-dimensional anomaly thresholds, the system can quickly and accurately determine the abnormality level and potential privacy risks of the current behavior. Based on the comprehensive risk assessment results, the system intelligently selects appropriate federated learning participation adjustment strategies, such as reducing data contribution, enhancing differential privacy noise, pausing model updates, or performing data masking. Specifically, it accurately identifies and triggers the highest level of targeted protection for specific sensitive operations such as form filling and password entry.This real-time, refined, and hierarchical security control mechanism effectively prevents the leakage of sensitive data during the federated learning process in abnormal or high-risk situations. While protecting user privacy, it optimizes the device's data contribution and resource usage in federated learning to the greatest extent, achieving a balance between security and efficiency. Therefore, the present invention provides a tablet user privacy protection data optimization method based on federated learning. By introducing a behavioral feature security sensitivity assessment mechanism and a behavioral deviation tolerance calculation method, it achieves accurate identification and dynamic evaluation of user behavior patterns; at the same time, it establishes a multi-dimensional behavioral pattern recognition and hierarchical privacy protection mechanism, which can automatically adjust the protection strength according to factors such as application sensitivity, usage environment, and operation behavior; in particular, it implements specific sensitive operation identification and targeted protection strategies for high-risk operations such as form filling and password input, effectively solving the privacy leakage problem caused by abnormal use of tablet devices in a federated learning environment, ensuring data security and optimizing system resource utilization efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A flowchart of a method for optimizing tablet user privacy-preserving data based on federated learning.

[0014] Figure 2 Schematic diagram of the detailed implementation steps of step S1 in the present invention.

[0015] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0016] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. It is obvious that the embodiments described are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts are within the scope of protection of the present invention.

[0017] In addition, the accompanying drawings are merely schematic illustrations of the present invention and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor and / or microcontroller approaches.

[0018] It should be understood that although the terms "first," "second," and the like may be used herein to describe various elements, these elements should not be limited by these terms. These terms are used solely to distinguish one element from another. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element, without departing from the scope of the exemplary embodiments. The term "and / or" as used herein includes any and all combinations of one or more of the listed associated items.

[0019] In the embodiment of the present invention, reference Figure 1 FIG. 1 is a flow chart of the steps of the method for optimizing tablet computer user privacy protection data based on federated learning according to the present invention. In this example, the method for optimizing tablet computer user privacy protection data based on federated learning includes the following steps:

[0020] Step S1: obtaining tablet touch dynamic data and tablet system logs; extracting sliding trajectory feature vectors from the tablet touch dynamic data; performing user behavior pattern analysis based on the sliding trajectory feature vectors and tablet system logs to obtain user behavior pattern classification results and a behavior feature vector set;

[0021] In this embodiment of the present invention, raw data from each user touch event on the screen is collected in real time from a tablet touch sensor, including the screen coordinates (x, y), timestamp (t), and pressure value (p) of the touch point. This data forms the raw data of the touch event sequence. Simultaneously, the tablet system log is acquired, recording events such as application launch, switching, and shutdown, as well as location information. The raw data of the touch event sequence is cleaned and segmented to identify continuous sliding trajectory segments. For each sliding trajectory segment, numerical features such as average sliding velocity, average sliding acceleration, overall sliding direction, standard deviation of pressure variation, trajectory length, and straightness are calculated to form a sliding trajectory feature vector. The tablet system log is parsed to extract application usage records. Applications are assigned sensitivity ratings based on a pre-set application sensitivity rule library, application usage duration is calculated, and specific application operation sequences are identified using a pre-defined pattern library to construct an application interaction sequence feature vector. Combining the timestamp and location information in the system log, the user's usage frequency in different time periods and locations is counted, temporal regularity and location familiarity are analyzed, and the current usage environment type (home, office, etc.) is identified to form a spatiotemporal usage pattern vector. The trajectory regularity index and pressure stability index in the sliding trajectory feature vector are used to identify fine operation patterns; the sliding velocity change rate and pressure mutation index are used to identify stressful operation patterns; the application interaction sequence feature vector is matched with the sensitive operation feature library to identify sensitive information processing patterns; and the temporal regularity and location familiarity of the spatiotemporal usage pattern vector are used to identify unconventional usage patterns. The determination results of fine operation, stressful operation, sensitive information processing, and unconventional usage behavior patterns are fused with the feature vectors of the sliding trajectory, application interaction sequence, and spatiotemporal pattern, for example, by concatenating them into a single long vector and normalizing them. Dimensionality reduction algorithms such as principal component analysis are applied to the fused vectors to extract the main characteristic components, resulting in the final set of behavioral feature vectors.

[0022] Step S2: extracting the feature information entropy vector and the feature time series correlation vector of the behavior feature vector set; performing dual evaluation weight fusion processing on the feature information entropy vector and the feature time series correlation vector according to the user behavior pattern classification result to obtain a security sensitivity weight matrix;

[0023] In this embodiment of the present invention, the information entropy of each feature dimension is calculated for a set of behavioral feature vectors to quantify the uncertainty of its value distribution. Higher information entropy indicates greater information content. Furthermore, the autocorrelation of each feature dimension in its time series and its cross-correlation with high-risk events, such as the use of sensitive applications, are analyzed to quantify its temporal stability and relevance to risk events. Based on the user behavior pattern classification results, security risk scores are preset for behavioral patterns such as delicate operations, stressful operations, sensitive information processing, and unconventional use. For example, high-risk patterns are assigned high scores. After Min-Max normalization, the feature information entropy and feature temporal correlation are fused through weighted averaging to form basic feature weights. Based on the behavioral pattern risk scores, a risk correlation matrix between behavioral patterns and features is constructed to analyze the importance of each feature under different risk patterns. The risk correlation matrix is ​​used to perform risk-aware adjustments on the basic feature weights, increasing the weights of features with strong correlations with high-risk patterns. Smoothing algorithms, such as exponentially weighted moving averages, are applied to the risk-adjusted weight vector to produce a more stable comprehensive feature weight vector. Finally, the feature comprehensive weight vector is organized into a security sensitivity weight matrix. The matrix elements represent the security sensitivity of each feature dimension of each user. The matrix quantifies the importance of different behavioral features in security identification.

[0024] Step S3: Construct a baseline behavior pattern based on the behavior feature vector set to obtain a user behavior baseline library; calculate the behavior deviation tolerance based on the user behavior baseline library to obtain a behavior deviation tolerance table; set multi-level thresholds based on the behavior deviation tolerance table and the security sensitivity weight matrix to obtain a multi-dimensional abnormality threshold configuration table;

[0025] In an embodiment of the present invention, a behavioral feature vector set constructed using historical user behavior data is used to calculate baseline statistics for each user and each feature dimension, such as the mean and standard deviation. These statistics constitute a user behavior baseline library, and the baseline can be subdivided by dimensions such as time period and application type. Based on the user behavior baseline library and historical system logs, the statistical distribution of the deviations of each feature of the user relative to the baseline in different time periods and different scenarios (such as home and office) is counted to obtain a time period feature deviation table and a scenario feature deviation table, reflecting the inherent fluctuations of the user's behavior in specific situations. The continuity and stability of each feature in the user behavior baseline library over time are analyzed (for example, the standard deviation of the daily average is calculated) to obtain a feature continuity index table. Combined with the sensitivity of the currently used application (high, medium, low) and the operation type (for example, whether it is form filling or password input), a sensitivity adjustment coefficient table is obtained according to preset rules or table lookup. Highly sensitive applications and high-risk operations correspond to lower tolerances. By integrating time period feature deviation, scene feature deviation, feature continuity index, and sensitivity adjustment coefficient, a comprehensive behavioral deviation tolerance value is calculated for each user and each feature dimension in the current context. This creates a behavioral deviation tolerance table. Higher tolerance values ​​indicate greater behavioral deviation allowed in that context. Based on the security sensitivity weight matrix and the baseline standard deviation in the user behavior baseline library, an initial threshold range is calculated for each feature dimension. Higher weights result in smaller initial ranges. The tolerance adjustment factors in the behavioral deviation tolerance table are used to dynamically adjust the initial threshold range to obtain a basic anomaly detection threshold. Based on the basic threshold, intermediate and advanced anomaly detection thresholds are constructed by multiplying the threshold by a tightening coefficient or using a larger baseline standard deviation multiple, forming a multi-level threshold system. These graded thresholds are grouped by feature type (touch dynamics, application usage, spatiotemporal patterns) to create a multi-type feature threshold set. Based on the currently configured privacy protection level (basic, intermediate, advanced), the corresponding privacy protection level adjustment coefficient is applied to adjust the multi-type feature threshold set as a whole, generating an initial multi-dimensional anomaly threshold configuration table. Based on the system's false positive / missed negative feedback on historical anomaly judgments, the thresholds in the configuration table are adaptively fine-tuned to obtain the final multi-dimensional anomaly threshold configuration table.

[0026] Step S4: Determine the abnormality of the current behavior based on the multi-dimensional abnormality threshold configuration table to obtain an abnormality level determination result; select a federated learning participation adjustment strategy based on the abnormality level determination result to obtain a participation adjustment strategy; and execute protection parameter instructions based on the participation adjustment strategy to achieve the privacy protection data optimization task.

[0027] In an embodiment of the present invention, user operation data, such as touch events, application interactions, and location updates, is collected in real time. The real-time data is processed according to the feature extraction method in step S1 to calculate the characteristic values ​​of the user's current behavior, forming a current behavior feature vector. The current behavior pattern and specific sensitive operations are then identified in real time. The current behavior feature vector is compared with the corresponding baseline pattern in the user behavior baseline library, and the deviation of each feature from the baseline is calculated. Based on the multidimensional anomaly threshold configuration table, the basic, medium, and advanced thresholds corresponding to each feature for the current time period and scenario are consulted. The deviation of each feature is compared with the corresponding classification threshold to determine the abnormality level of the current behavior for each feature (normal, mild, moderate, or severe). The anomaly determination results for all features are combined to obtain an overall anomaly level determination result (e.g., taking the highest anomaly level or weighted average to obtain an anomaly score). Based on the anomaly level determination result, combined with the real-time identified behavior pattern and sensitive operation type, a comprehensive risk assessment result is calculated. Based on the comprehensive risk assessment result, a pre-set strategy is consulted or a calculation is performed to determine a federated learning participation adjustment plan, including the data contribution ratio and differential privacy parameters (e.g., epsilon value). Based on the comprehensive risk assessment results and the anomaly level, a feature protection strategy is generated to specify which features need to be blurred or masked. Based on the current operation type, it is determined whether it is a sensitive operation (such as password input). If so, operation regional protection parameters are generated to specify special protection for data in specific areas of the screen. The data contribution adjustment plan, privacy noise parameter plan, feature protection strategy, and operation regional protection parameters are integrated into a federated learning participation adjustment strategy. A federated learning security parameter adjustment instruction containing these adjustment parameters and instructions is generated and sent to the client for execution. For example, the client can reduce the amount of uploaded data, increase differential privacy noise, or suspend the collection and upload of specific data according to the instruction, thereby achieving privacy protection data optimization tasks.

[0028] As an example of the present invention, refer to Figure 2 As shown, in this example, step S1 includes:

[0029] Step S11: extracting sliding trajectory feature vectors from tablet touch dynamic data;

[0030] In this embodiment of the present invention, each user touch event on the screen is collected from the raw data of the tablet touch sensor. The touch point coordinates (x, y), occurrence timestamp (t), and touch pressure value (p) of each event are recorded to form the raw data of the touch event sequence. The raw data of the touch event sequence is initially cleaned to remove invalid or noisy touch points shorter than a set threshold (e.g., 50 milliseconds), and the timestamps are uniformly calibrated. Then, a continuous touch point sequence is identified. If it meets certain temporal and spatial proximity thresholds (e.g., the time interval between adjacent points is less than 100 milliseconds and the distance is less than 50 pixels), it is determined to be a sliding trajectory and extracted from the sequence in segments to form a segmented sliding trajectory set. For each trajectory in the segmented sliding trajectory set, the Euclidean distance between adjacent touch points on the trajectory is calculated and divided by the time difference to obtain the instantaneous velocity, forming the trajectory instantaneous velocity sequence. The trajectory instantaneous velocity sequence is then differentiated and divided by the time difference to obtain the instantaneous acceleration, which is then smoothed using methods such as sliding window averaging to obtain a smoothed acceleration sequence. The angle between the starting and ending points of the sliding trajectory relative to the horizontal direction is calculated as the sliding direction feature. The standard deviation of the pressure values ​​at all touch points on the sliding trajectory is calculated as the pressure change feature, and the difference between the maximum and minimum pressure values ​​is calculated. The sum of the distances between all adjacent touch points on the trajectory is calculated as the trajectory length, and the average distance of the trajectory points relative to the center of their minimum circumscribed rectangle is calculated as the trajectory dispersion. These constitute the trajectory geometric features. The statistics of the trajectory instantaneous velocity sequence (such as average value, maximum value), the statistics of the smoothed acceleration sequence (such as average value), the sliding direction characteristics, the statistics of the pressure change characteristics (such as standard deviation, maximum and minimum value difference), and the trajectory geometric features (such as length and dispersion) are integrated into the sliding trajectory feature vector.

[0031] Step S12: constructing an application interaction sequence feature vector based on the tablet system log;

[0032] In an embodiment of the present invention, the tablet system log is parsed to extract event records related to the user's application usage, including events such as application startup, application switching to the foreground, application switching to the background, and application shutdown, and the application package name and the corresponding timestamp are recorded. According to a preset application sensitivity rule base, which stores known application package names and their corresponding sensitivity levels (for example, financial applications are marked as high sensitivity, social applications are marked as medium sensitivity, and game applications are marked as low sensitivity), each application identified in the log is given a sensitivity rating. Based on the timestamps of application startup and switching events, the duration that the user stays in the foreground of each application is calculated as the application usage time. By analyzing the system logs or content provider events of specific applications (such as file managers and document editors), the time the user stays on a specific document is identified as the document dwell time. Leveraging a predefined library of specific operation sequence patterns (e.g., including patterns like "launch file manager -> enter Download folder -> open PDF file" or "launch banking app -> enter transfer interface"), a sequence matching algorithm (e.g., based on finite state machines or regular expression matching) is employed to search for matches within the chronological sequence of application interaction events, identifying specific operation sequences and marking them as specific operation sequence identifiers. Information such as the usage duration, sensitivity rating, and identified specific operation sequence identifiers for each application is then constructed into an application interaction sequence feature vector by time window (e.g., one day) or session. This vector can include the cumulative usage duration of applications at each sensitivity level, the number of occurrences of specific sensitive sequences, and so on.

[0033] Step S13: encoding the spatiotemporal usage pattern according to the tablet system log to obtain a spatiotemporal usage pattern vector;

[0034] In an embodiment of the present invention, the timestamps of application usage events are extracted from the tablet system log, and the geographic location information of the same time period is obtained. The geographic location information is obtained by parsing the log of the system LocationManager service or by registering a location listener, including GPS-based longitude and latitude, WiFi-based BSSID list, and cellular network-based Cell ID. A day is divided into 24 time periods (one time period per hour), and the cumulative time that the user has the application active in the foreground in each time period is counted to form a time usage frequency vector. The geographic location information is clustered or discretized. For example, a set of frequently occurring WiFi BSSIDs or cellular Cell IDs is identified as a "place" (e.g., home location, office location), or the GPS longitude and latitude are divided into preset areas using geo-fencing technology. The cumulative usage time of the user in each identified place is counted to form a place usage frequency vector. The variance or information entropy of the user's daily time usage frequency vector is calculated as a temporal regularity index. The smaller the variance or entropy, the stronger the temporal regularity. The current location information (BSSID, Cell ID, or GPS coordinates) is compared with a database of historically frequently used locations, and the similarity between the current location and historically frequently used locations is calculated (for example, the Jaccard similarity coefficient of the WiFi BSSID set, or the Euclidean distance between GPS cluster centers) as the location familiarity index. Based on the currently connected WiFi network name (such as one containing "Home" or "Office"), the list of nearby Bluetooth devices, and GPS environment information (whether within a known home / office geofence), a rule inference or classification model is used to identify the current environment type (home environment, office environment, public place environment, etc.). The time usage frequency vector, location usage frequency vector, time regularity index, location familiarity index, and environment type identifier are integrated into a spatiotemporal usage pattern vector.

[0035] Step S14: classifying the user behavior pattern according to the sliding trajectory feature vector, the application interaction sequence feature vector, and the spatiotemporal usage pattern vector to obtain a user behavior pattern classification result;

[0036] In an embodiment of the present invention, based on the trajectory regularity index (for example, by calculating the average vertical distance of trajectory points relative to the fitted straight line, or by calculating the variance of the angles between adjacent line segments) and the pressure stability index (for example, by calculating the standard deviation of the pressure values ​​during the sliding process) extracted from the sliding trajectory feature vector, if the trajectory regularity index is lower than a specific threshold value T1 and the pressure stability index is lower than a specific threshold value T2, it is determined to be a fine operation mode, and a fine operation feature identifier (for example, a Boolean value or a confidence score) is generated. Based on the sliding speed change rate (for example, by calculating the standard deviation of the difference of the instantaneous speed sequence) and the pressure mutation index (for example, by calculating the maximum value of the instantaneous pressure change rate) in the sliding trajectory feature vector, if the sliding speed change rate is higher than a specific threshold value T3 or the pressure mutation index is higher than a specific threshold value T4, it is determined to be a tense operation mode, and a tense operation feature identifier is generated. A pre-built sensitive operation feature library is used, which contains a list of sensitive applications, sensitive operation sequence patterns (such as entering a short string three times in a row and then pressing Enter), and specific UI element interaction patterns (such as the behavioral characteristics before and after clicking the login button). Match the sensitive operation sequence identified in the application interaction sequence feature vector and the current application sensitivity rating. If the current application is a high-sensitivity application and a matching sensitive operation sequence is detected, or the current operation involves sensitive UI element interaction (for example, input box focus change, keyboard pop-up), it is identified as a sensitive information processing mode and a sensitive operation feature identifier is generated. According to the temporal regularity index and location familiarity index in the spatiotemporal usage pattern vector, if the temporal regularity index is lower than a specific threshold T5 or the location familiarity index is lower than a specific threshold T6, it is determined to be an unconventional usage mode and an unconventional usage identifier is generated. The fine operation feature identifier, the tense operation feature identifier, the sensitive operation feature identifier and the unconventional usage identifier are used as input, and a pre-trained multi-modal classification model (for example, based on a decision tree or a support vector machine) is used to classify the user's current behavior pattern to obtain a user behavior pattern classification result, which can be a vector representing the confidence or probability distribution of the user's current behavior belonging to various patterns.

[0037] Step S15: performing feature fusion and dimensionality reduction on the sliding trajectory feature vector, the application interaction sequence feature vector, and the spatiotemporal usage pattern vector to obtain a behavior feature vector set.

[0038] In an embodiment of the present invention, the sliding trajectory feature vector, the application interaction sequence feature vector, and the spatiotemporal usage pattern vector are spliced ​​to form a long vector containing all the original behavioral features. The spliced ​​long vector is standardized, for example, by using the Z-score standardization method, so that the mean of each feature dimension is 0 and the standard deviation is 1, eliminating the dimension effect. According to the correlation between the preset sensitive behavior pattern (for example, stressful operation, sensitive information processing) and the feature dimension, the feature dimension that is strongly correlated with the sensitive behavior pattern is given a higher initial weight (for example, pressure change characteristics, sensitive application usage time characteristics, specific operation sequence identifiers, etc.) to form a weighted feature vector. The principal component analysis (PCA) algorithm is applied to the weighted feature vector for dimensionality reduction. The PCA algorithm projects the original feature vector onto a set of new orthogonal bases through orthogonal transformation, retaining the directions with the largest variance in the original data as principal components. The covariance matrix is ​​calculated and eigenvalue decomposition is performed, and the eigenvectors corresponding to the first K largest eigenvalues ​​are selected to form the projection matrix W. The weighted feature vector is multiplied by the projection matrix W to obtain the reduced-dimensional behavior feature vector. By selecting an appropriate K value (for example, retaining 95% of the total variance), we can significantly reduce the feature dimensionality while preserving key information. The resulting reduced-dimensionality vector is the feature vector for a single behavior. These vectors from multiple time points or sessions are combined to form a set of behavioral feature vectors used in subsequent steps.

[0039] Preferably, extracting the sliding trajectory feature vector in step S1 includes:

[0040] Perform data preprocessing on the tablet touch dynamic data to obtain the original data of the touch event sequence;

[0041] Perform sliding trajectory recognition and segmentation on the original data of the touch event sequence to obtain a segmented sliding trajectory set;

[0042] Calculate the instantaneous velocity sequence of the trajectory of the segmented sliding trajectory set;

[0043] Extract the sliding acceleration from the instantaneous velocity sequence of the trajectory to obtain a smooth acceleration sequence;

[0044] Extracting sliding direction features of segmented sliding trajectory sets;

[0045] Extract the pressure variation characteristics of the segmented sliding trajectory set;

[0046] Calculate the trajectory geometric characteristics of the segmented sliding trajectory set;

[0047] The sliding trajectory feature vector is obtained by integrating the trajectory instantaneous velocity sequence, smooth acceleration sequence, sliding direction characteristics, pressure change characteristics and trajectory geometric characteristics.

[0048] In an embodiment of the present invention, a raw data stream is received from a flat-panel touch sensor, and detailed information about each touch event is recorded, including the screen coordinates (x, y) of the touch point, the timestamp of the event (t), and the pressure value (p) of the touch. These raw data are arranged in chronological order to form touch event sequence raw data. In order to remove sensor noise or false touches, the touch event sequence raw data is preliminarily cleaned. For example, touch points with extremely short durations (less than 50 milliseconds) or extremely small movement distances (less than 10 pixels) are filtered out. At the same time, the data can be uniformly sampled according to the needs of subsequent processing. For example, one data point is retained every 10 milliseconds to reduce the amount of data and ensure relative consistency of time intervals.

[0049] The pre-processed raw data of the touch event sequence is analyzed to identify the user's sliding operation on the screen. The recognition process scans the continuous touch points in the sequence. If the time interval between two consecutive touch points is less than the set threshold (for example, 150 milliseconds) and the spatial distance is less than the set threshold (for example, 100 pixels), then the two points are considered to belong to the same potential sliding trajectory. Continue to track the continuous points that meet the conditions until the point sequence is interrupted (the time interval or spatial distance exceeds the threshold), extract this continuous touch point sequence, and determine it as a complete sliding trajectory segment. All identified sliding trajectory segments are gathered together to form a segmented sliding trajectory set.

[0050] For each sliding track in the segmented sliding track set, traverse the touch point sequence in the track. For each point in the sequence except the first point, calculate the Euclidean distance between the point and the previous point, that is, sqrt((x_i-x_i-1) 2 +(y_i-y_i-1) 2 ) and calculate the time difference between the two points, i.e., (t_i - t_i - 1). Divide the Euclidean distance by the time difference to obtain the instantaneous velocity within that time interval. Arrange the instantaneous velocities calculated for all pairs of adjacent points in the trajectory in chronological order to form the instantaneous velocity sequence of the sliding trajectory.

[0051] The calculated trajectory instantaneous velocity sequence is processed to extract the sliding acceleration information and smooth it. For each instantaneous velocity value in the trajectory instantaneous velocity sequence (except the first one), the difference between the current instantaneous velocity and its previous instantaneous velocity is calculated and divided by the corresponding time interval (i.e., the current point timestamp minus the previous point timestamp) to obtain the instantaneous acceleration. Because the original acceleration data contains noise, the sliding window averaging method is used to smooth the instantaneous acceleration sequence. A fixed-size window is set (for example, the window size is 5), and the average value of all instantaneous accelerations in the window is calculated. This average value is used as the smoothed acceleration value of the window center point. The sliding window traverses the entire instantaneous acceleration sequence to obtain a smoothed acceleration sequence.

[0052] For each track in the segmented track set, calculate the overall sliding direction of the track. Based on the coordinates of the track's starting touch point (x_start, y_start) and ending touch point (x_end, y_end), use the inverse tangent function atan2 to calculate the angle between the vector from the starting point to the ending point and the positive X-axis (towards the right side of the screen). This angle represents the overall direction of the track and typically ranges from (-π, π) to [0, 2π]. The calculated angle is used as the sliding direction eigenvalue of the track.

[0053] For each sliding track in the segmented sliding track set, analyze the changes in touch pressure values. Extract the pressure value sequence for all touch points in the track. Calculate the standard deviation of this pressure value sequence. A larger standard deviation indicates greater pressure fluctuations. Calculate the difference between the maximum and minimum pressure values ​​in the track to reflect the magnitude of the pressure change. Also calculate the average rate of change of pressure values ​​over time, i.e., the linear regression slope of the pressure value sequence. Use statistics such as the standard deviation, the difference between the maximum and minimum values, and the average rate of change of the pressure value sequence as pressure change characteristics for the sliding track.

[0054] For each sliding track in the segmented sliding track set, calculate its geometric features. Calculate the sum of the Euclidean distances between all adjacent touch points on the track to get the total length of the track. Calculate the straight-line distance between the starting point and the ending point of the track, that is, sqrt((x_end-x_start) 2 +(y_end-y_start) 2 The straight-line distance from the start point to the end point is divided by the total length of the trajectory to obtain the trajectory's straightness or regularity index. An index close to 1 indicates that the trajectory is nearly straight. The average coordinates of all touch points in the trajectory are calculated as the trajectory center point. The standard deviation of the Euclidean distance from each touch point to this center point is calculated to reflect the trajectory's degree of dispersion. The width and height of the trajectory's minimum bounding rectangle, as well as its aspect ratio, are calculated as the trajectory's size and shape characteristics.

[0055] The key statistics or calculation results extracted from the trajectory instantaneous velocity sequence (e.g., average velocity, maximum velocity, velocity variance), smooth acceleration sequence (e.g., average acceleration, maximum acceleration), sliding direction characteristics, pressure change characteristics (e.g., pressure standard deviation, pressure maximum and minimum difference), and trajectory geometric characteristics (e.g., trajectory length, straightness, discreteness, and circumscribed rectangle size) are combined into a numerical vector. This vector is the sliding trajectory feature vector of the sliding trajectory. For all sliding trajectories within a time window (e.g., a user session or one minute), the average, maximum, minimum, and other statistics of these trajectory feature vectors can be calculated, or the feature vectors of all trajectories can be spliced ​​together to form a set of sliding trajectory feature vectors representing the user's sliding behavior within the time window.

[0056] Preferably, step S14 includes:

[0057] Calculating the trajectory regularity index and the pressure stability index based on the sliding trajectory characteristic vector; making a fine operation judgment based on the trajectory regularity index and the pressure stability index to obtain a fine operation feature identifier;

[0058] Calculate the sliding velocity change rate and pressure mutation index based on the sliding trajectory characteristic vector; determine the tense operation based on the sliding velocity change rate and pressure mutation index to obtain the tense operation characteristic identifier;

[0059] Use the pre-built sensitive operation feature library to match the sensitive operation sequence of the application interaction sequence feature vector; perform sensitive information processing and identification based on the sensitive operation sequence to obtain the sensitive operation feature identifier;

[0060] Analyze time regularity and location familiarity based on the spatiotemporal usage pattern vector; determine irregular usage based on time regularity and location familiarity to obtain irregular usage identification;

[0061] Multi-feature fusion and behavior pattern classification are performed on fine operation feature identifiers, tense operation feature identifiers, sensitive operation feature identifiers and unconventional use identifiers to obtain user behavior pattern classification results.

[0062] In an embodiment of the present invention, a trajectory regularity index (for example, by calculating the average vertical distance from a trajectory point to its least squares fitting straight line, or calculating the standard deviation of the angle formed by the trajectory point and the lines connecting its adjacent points before and after it, the smaller the standard deviation, the more regular the trajectory) and a pressure stability index (for example, by calculating the standard deviation of the pressure values ​​of all touch points in the sliding trajectory, the smaller the standard deviation, the more stable the pressure) are extracted from the sliding trajectory feature vector obtained in step S11. A trajectory regularity threshold Rth and a pressure stability threshold Pth are set. If the calculated trajectory regularity index is less than Rth and the pressure stability index is less than Pth, the current sliding operation is determined to be a fine operation mode, and a fine operation feature identifier is generated. The identifier can be a Boolean value (true / false) or a confidence score between 0 and 1, and the confidence score is negatively correlated with the degree of deviation of the trajectory regularity index and the pressure stability index.

[0063] Based on the sliding trajectory feature vector obtained in step S11, the sliding velocity change rate (e.g., calculating the standard deviation of the difference sequence of the trajectory instantaneous velocity sequence; a larger standard deviation indicates a more dramatic velocity change) and the pressure mutation index (e.g., calculating the maximum value or standard deviation of the trajectory instantaneous pressure change rate sequence) are extracted. A sliding velocity change rate threshold (VCRth) and a pressure mutation index threshold (PTIth) are set. If the calculated sliding velocity change rate is greater than VCRth or the pressure mutation index is greater than PTIth, the current sliding operation is determined to be a stressful operation mode, and a stressful operation feature flag is generated. This flag can also be a Boolean value or a confidence score, with the confidence score positively correlated with the sliding velocity change rate and the pressure mutation index.

[0064] A pre-built sensitive operation feature library is used, which stores a list of known high-risk applications (for example, banking apps, corporate mailboxes, electronic payment tools) and sensitive operation sequence patterns in these applications or general scenarios (for example, "open the file manager->enter the secret folder->open a file with a specific suffix", "start the banking app->click the transfer button->enter the amount", "enter more than 6 digits continuously in a specific app and press Enter"). These patterns are stored in a format that can be recognized by regular expressions, finite state machines, or sequence alignment algorithms. The application interaction sequence feature vector obtained in step S12 (including the order of application use, application sensitivity rating, and specific operation sequence mark) is matched with the pattern in the sensitive operation feature library. If the currently used application is marked as highly sensitive, and a subsequence that matches any sensitive operation sequence pattern in the library is detected in the application interaction sequence (for example, it is detected that the user has started the banking app and then performed frequent clicks and input operations), it is identified as a sensitive information processing mode, and a sensitive operation feature identifier (Boolean value or confidence level) is generated. The confidence level is related to the risk level of the matched sensitive operation sequence.

[0065] Based on the spatiotemporal usage pattern vector obtained in step S13, a temporal regularity index (e.g., the similarity between the time period distribution of the user's tablet use over the past week and the current usage time period distribution; the lower the similarity, the lower the index) and a location familiarity index (e.g., the Jaccard similarity coefficient between the current location's WiFi SSID or cellular Cell ID set and the user's historical frequently used location set; the lower the similarity coefficient, the lower the index). A temporal regularity threshold TRth and a location familiarity threshold PFth are set. If the calculated temporal regularity index is less than TRth or the location familiarity index is less than PFth, the current usage scenario is determined to be an unconventional usage pattern, and an unconventional usage flag (Boolean value or confidence level) is generated. The confidence level is negatively correlated with the degree of deviation of the temporal regularity index and the location familiarity index.

[0066] The fine operation feature identifier, stress operation feature identifier, sensitive operation feature identifier and unconventional use identifier generated in the first four steps of step S14 are used as input features. These identifiers can be Boolean values ​​or confidence scores. These identifiers are combined into a feature vector. A pre-trained multi-feature fusion and behavior pattern classification model is used. The model can be constructed based on classification algorithms such as decision trees, random forests, neural networks or support vector machines. The model receives the above feature vector as input and outputs the classification result of the user's current behavior pattern. The classification result can be a discrete category label (for example, "normal", "fine operation", "stress operation", "sensitive information processing", "unconventional use") or a probability distribution vector, indicating the probability that the current behavior belongs to each pattern. For example, historical behavior data with labels (such as normal operation, abnormal operation, sensitive operation) is used during model training to learn the mapping relationship between different feature identifier combinations and behavior patterns. After training is completed, the model is used to infer the feature identifier vector generated in real time to obtain the classification result of the current user behavior pattern.

[0067] Preferably, step S2 includes:

[0068] Step S21: Calculate the feature information entropy vector of the behavior feature vector set;

[0069] Step S22: performing feature time series correlation analysis on the behavior feature vector set to obtain a feature time series correlation vector;

[0070] Step S23: Performing a behavior pattern security risk assessment on the user behavior pattern classification results to obtain a behavior pattern risk score;

[0071] Step S24: performing dual evaluation weight fusion on the feature information entropy vector and the feature time series correlation vector according to the behavior pattern risk score to obtain a feature comprehensive weight vector;

[0072] Step S25: Construct a security sensitivity weight matrix based on the feature comprehensive weight vector.

[0073] In an embodiment of the present invention, a behavioral feature vector set is constructed based on historical user behavior data. This set contains user behavior feature vectors from multiple time points or multiple sessions. Each row represents a behavior sample (e.g., behavior within a time window), and each column represents a feature dimension (e.g., average scrolling speed, daily usage duration of an application, temporal regularity index, etc.). For each feature dimension in the behavioral feature vector set, its value range is divided into several discrete intervals (e.g., using a histogram or equal-frequency binning). The frequency with which each feature dimension falls into each interval across all behavior samples is counted to estimate the probability distribution p(xi) of the feature value, where xi represents a discrete value or a representative interval value for the feature dimension. According to the definition of information entropy, H(X) = -∑p(xi)log2(p(xi)), where p(xi) is the probability of the feature taking the value xi. The information entropy value reflects the uncertainty or information content of the feature dimension across all samples. The greater the information entropy, the more diverse the value of the feature and the greater its potential value in distinguishing different behavior samples. At the same time, combined with the user behavior pattern classification results of step S14, the conditional entropy H(X|Y) of each feature under a specific behavior pattern (such as a sensitive information processing pattern) is calculated, where X represents the feature dimension and Y represents the behavior pattern. The conditional entropy reflects the uncertainty of the feature under a known behavior pattern. The information gain I(X;Y)=H(X)-H(X|Y) measures the contribution of the feature to the identification of a specific behavior pattern. The information entropy value calculated for each feature dimension and the information gain related to the specific behavior pattern are combined into a feature information entropy vector.

[0074] For each feature dimension in the behavioral feature vector set, analyze its correlation in the time series. For each feature dimension, treat its values ​​at different time points as a time series. Calculate the autocorrelation function or autocorrelation coefficient of the time series. For example, calculate the autocorrelation coefficient of the k-th lag to measure the correlation between the feature value at the current moment and the feature value k time steps ago. Feature dimensions with high autocorrelation coefficients indicate that the user's behavior pattern on this feature is relatively stable over time and has good user personalized recognition capabilities. The calculation method can use a sliding window to compare the similarity (such as the Pearson correlation coefficient) of the statistics (such as the mean and variance) of the same feature of the user in adjacent or time-separated windows. In particular, analyze the changes in behavioral characteristics before and after the use event of sensitive applications (applications marked as highly sensitive in step S12). Calculate the cross-correlation between the sensitive application usage flag (Boolean value) and other behavioral characteristics such as sliding trajectory characteristics, pressure change characteristics, and application usage duration. For example, calculate the degree of deviation and correlation between characteristics such as sliding speed and pressure value and the average level one minute before launching the sensitive application and during use. The autocorrelation coefficient of each feature dimension and the cross-correlation coefficient related to the use of sensitive applications are combined into a feature time series correlation vector.

[0075] Based on the user behavior pattern classification results obtained in step S14, preset security risk scores are assigned to the different identified behavior patterns. These scores reflect the degree to which each behavior pattern is associated with potential privacy leaks or security threats. For example, the risk scoring rules are set as follows: Precise operation patterns (e.g., precisely selecting text in a document) receive a medium risk score (e.g., 0.5) because they involve processing important information; stressful operation patterns (e.g., rapid, irregular swiping, large pressure fluctuations) receive a high risk score (e.g., 0.8), indicating that the user is handling sensitive matters in an emergency; sensitive information processing patterns (e.g., entering a password in a banking app, filling out a form in a browser) receive the highest risk score (e.g., 1.0) because they directly involve sensitive data; and unconventional use patterns (e.g., use in unknown locations, at unusual times) receive a high risk score (e.g., 0.9), indicating unauthorized device use. For a user's current behavior, a comprehensive risk score is calculated based on the behavior pattern it is classified into and its confidence level. For example, if the confidence level for the sensitive information processing pattern is 0.9, the risk score for the current behavior is 1.0 × 0.9 = 0.9. These preset pattern risk scores and the comprehensive risk score calculated based on the current behavior pattern classification results are output as the behavior pattern risk score.

[0076] The feature information entropy vector calculated in step S21 and the feature time series correlation vector calculated in step S22 are normalized, for example, using Min-Max normalization to scale the numerical range of each vector to between 0 and 1, to obtain a normalized information entropy vector and a normalized time series correlation vector. These two normalized vectors reflect the relative importance of each feature dimension in terms of information volume and temporal stability. The normalized information entropy vector and the normalized time series correlation vector are weighted and summed to calculate the basic comprehensive weight of each feature dimension. For example, the basic comprehensive weight = W_1×H_norm+W_2×C_norm, where W_1 and W_2 are preset weight parameters, and W_1+W_2=1 (for example, W_1=0.6, W_2=0.4), H_norm is the normalized information entropy, and C_norm is the normalized time series correlation. According to the behavioral pattern risk score in step S23, the risk perception weights of feature dimensions (e.g., stress changes, usage time of specific applications, sensitive operation sequence identifiers) that are highly correlated with high-risk behavioral patterns (e.g., sensitive information processing, stressful operations) are adjusted. Set a risk adjustment factor function f (risk score), which increases monotonically with the increase of the risk score. Final weight = basic comprehensive weight × f (correlation between the behavioral pattern risk score and the feature). For example, f(r) = 1 + β × r, where β is the adjustment coefficient (usually ranging from 0.2 to 0.5), and r is the risk correlation score between the feature and the current behavioral pattern (ranging from 0 to 1). The risk correlation score can be determined by analyzing the value distribution of each feature under different behavioral patterns in historical data. The weights of all feature dimensions after adjustment are combined into a feature comprehensive weight vector.

[0077] The feature-comprehensive weight vector calculated in step S24 is converted into a matrix to construct a security sensitivity weight matrix. The matrix has the dimensions of the number of users × the number of behavioral feature dimensions. Each element W_ij in the matrix represents the security sensitivity weight of the jth behavioral feature dimension for the i-th user. In a multi-user system, a separate feature-comprehensive weight vector can be maintained for each user, or a global feature-comprehensive weight vector can be used. However, the matrix construction process involves expanding the vector into a matrix form. To improve the stability of the weight calculation, the feature-comprehensive weight vector or matrix can be smoothed, for example, using an exponentially weighted moving average, so that the most recently calculated weights have a greater impact on the final result while retaining historical weight information. Furthermore, scenario-specific weight submatrices are constructed based on the environment type identified in step S13 (home, office, public space, etc.) and the current application type identified in step S12 (finance, social, document, etc.). For example, for financial application scenarios, the weights of features related to payment and account operations are increased; for public space scenarios, the weights of features related to location and network environment are increased. These scenario-specific submatrices can be used for more refined threshold adjustments in subsequent steps. Output the constructed security sensitivity weight matrix and the scenario-specific weight sub-matrix set.

[0078] Preferably, step S24 includes:

[0079] Performing feature information normalization processing on the feature information entropy vector and the feature time series correlation vector to obtain a normalized information vector;

[0080] Calculate the basic feature weight vector of the normalized information vector;

[0081] Construct a risk correlation matrix based on the behavior pattern risk score and the basic feature weight vector;

[0082] Adjust the risk perception weight according to the risk correlation matrix to obtain the risk adjustment weight vector;

[0083] The risk-adjusted weight vector is smoothed and stabilized to obtain the feature-comprehensive weight vector.

[0084] In an embodiment of the present invention, the characteristic information entropy vector calculated in step S21 and the characteristic time series correlation vector calculated in step S22 are normalized respectively. The Min-Max normalization method is adopted to linearly scale the values ​​in each vector to the range of [0, 1]. For each element v_i in the vector (i.e., the original characteristic information entropy value or the time series correlation value), its normalized value is (v_i-v_min) / (v_max-v_min), where v_min and v_max are the minimum and maximum values ​​in the vector, respectively. After such processing, the values ​​of information entropy and time series correlation are comparable, forming a normalized information vector.

[0085] The normalized information vector is used as the basis to calculate the basic feature weight for each feature dimension. A weighted average method is used to combine the normalized information entropy and normalized temporal correlation. Each element of the basic feature weight vector, W_base,j, corresponds to the jth feature dimension and is calculated as W_base,j = α × H_norm,j + (1-α) × C_norm,j, where H_norm,j is the normalized information entropy of the jth feature, C_norm,j is the normalized temporal correlation of the jth feature, and α is a preset fusion coefficient between 0 and 1 (e.g., 0.6) that balances the relative importance of information entropy and temporal correlation.

[0086] Construct a basic risk correlation matrix. The dimension of this matrix is ​​the number of behavioral patterns × the number of behavioral feature dimensions, which represents the basic correlation between different behavioral patterns and each feature dimension. Each element R_mj in the matrix represents the correlation or sensitivity between the mth behavioral pattern and the jth behavioral feature dimension. This correlation can be obtained by offline analysis of a large amount of labeled data. For example, statistics are made on which features (such as pressure fluctuations, usage time of specific applications) in the "sensitive information processing" mode have values ​​that deviate significantly from their distribution in the "normal" mode. The correlation value can be between 0 and 1, with 1 indicating a strong correlation. Combine the behavioral pattern risk score of step S23 (a vector, one score for each pattern) with the basic feature weight vector. For the current user's behavioral pattern classification result (for example, a probability distribution vector), calculate the risk correlation between each feature dimension and the current actual behavioral pattern. For example, if the probability that the current behavior is classified as a sensitive information processing mode is p_sensitive, and the probability of an unconventional usage mode is p_unusual, then the risk correlation of a certain feature j can be calculated as: risk correlation j = ∑(p_m×R_m,j), where m represents different behavior modes (such as sensitive information processing, unconventional usage, etc.), p_m is the probability that the current behavior is classified as mode m, and R_m,j is the risk correlation between mode m and feature j. In actual applications, based on the probability distribution of the currently detected behavior mode, the risk correlation of each feature with the current specific behavior is calculated, and these calculation results are combined into the current risk correlation vector (the dimension is the number of features), which represents the risk correlation degree of each feature with the current behavior mode combination.

[0087] Based on the risk correlation matrix and the basic feature weight vector, the risk perception weight is adjusted. For each feature dimension j, its risk-adjusted weight W_risk,j is calculated as W_risk,j = W_base,j × (1 + β × Risk_Correlation_j), where Risk_Correlation_j is the risk correlation between the feature and the current behavior pattern (obtained from the risk correlation matrix), and β is a risk-adjusted gain coefficient that controls the degree to which risk correlation increases the weight. The value range is usually between 0.2 and 1.0 (for example, β = 0.5). The larger the β value, the more significant the impact of risk correlation on the feature weight; the smaller the β value, the milder the impact of risk correlation. The specific value can be adjusted according to the security sensitivity requirements of the application scenario. The adjusted weights of all feature dimensions are combined into a risk-adjusted weight vector.

[0088] The risk-adjusted weight vector is smoothed and stabilized to reduce the impact of short-term fluctuations on the weights and ensure a more stable reflection of the long-term security sensitivity of the feature. The final feature-composite weight vector, W_final,t, is calculated using the exponentially weighted moving average (EWMA) method. The feature-composite weight vector, W_final,t, for the current time step t is calculated as W_final,t = ​​γ × W_risk,t + (1-γ) × W_final,t-1, where W_risk,t is the risk-adjusted weight vector calculated for the current time step, W_final,t-1 is the feature-composite weight vector for the previous time step, and γ is a smoothing factor ranging from 0 to 1 (e.g., 0.1). A smaller γ results in a more pronounced smoothing effect and slower weight changes.

[0089] Obtain the average value or distribution parameters (such as mean and standard deviation) of each behavioral feature dimension of the user in different time periods (for example, 9-12 am on weekdays, 8-10 pm on weekdays, and 2-5 pm on weekends) from the user behavior baseline library. Extract the actual behavioral feature vectors of the user in these time periods from the tablet system log. Calculate the deviation of the user's behavioral characteristics in each specific time period from the baseline characteristics corresponding to the time period (for example, calculate the absolute difference or relative difference between the current feature value and the baseline average, or calculate the KL divergence between the current feature distribution and the baseline distribution). Perform statistics on historical data and calculate the average value or standard deviation of the deviation of each feature for each user in different time periods. These statistics reflect the inherent range of variation of the user's behavior in a specific time period, that is, the tolerance in the time dimension. Store these statistics in the time period feature deviation table.

[0090] Obtain the average value or distribution parameter of each behavioral feature dimension of the user in different scenarios (for example, home scenarios, office scenarios, public place scenarios, and scenario identification is based on step S13) from the user behavior baseline library. Extract the actual behavioral feature vectors of the user in these scenarios from the tablet system log (combined with location information). Calculate the deviation between the user's behavioral characteristics in each specific scenario and the baseline characteristics corresponding to the scenario. Perform statistics on historical data and calculate the average value or standard deviation of each feature deviation of each user in different scenarios. These statistics reflect the inherent range of variation of the user's behavior in a specific scenario, that is, the tolerance on the scenario dimension. Store these statistics in the scenario feature deviation table.

[0091] Analyze the long-term change trends of each behavioral feature dimension in the user behavior baseline library over time. For each feature dimension, use a sliding window or time series analysis method (for example, calculating the moving average and standard deviation) to evaluate the degree of its continuous change. For example, calculate the standard deviation of the daily average of a feature (such as the average sliding speed) of the user in the past N days. The smaller the standard deviation, the smoother the change of the feature over time and the better the continuity. Alternatively, perform linear regression on the time series of the feature and analyze the slope and residual. A slope close to 0 and a small residual indicate a gentle change. Store indicators reflecting the degree of continuous change of the feature (such as standard deviation, average daily change) in the feature continuity indicator table.

[0092] The tolerance for behavioral deviation is adjusted based on the application sensitivity (high, medium, low) identified in step S12 and the specific operation type (form filling, password input, file upload, etc.) identified in step S14. For the use of highly sensitive applications, or when specific high-risk operations are detected, the tolerance for behavioral deviation needs to be lowered, and even small deviations from the historical baseline should be more likely to be marked as abnormal. Set a sensitivity adjustment coefficient table that provides an adjustment factor based on the application sensitivity level and operation type (for example, 0.8 for high-sensitivity applications / high-risk operations, 1.0 for medium-sensitivity applications, and 1.2 for low-sensitivity applications). Store these adjustment factors in the sensitivity adjustment coefficient table.

[0093] The time period feature deviation table, scenario feature deviation table, feature continuity index table, and sensitivity adjustment coefficient table are comprehensively calculated and optimized to obtain the final behavior deviation tolerance table. For each user and each feature dimension, a comprehensive behavior deviation tolerance value is calculated based on the current time period, usage scenario, the historical continuity of the feature, the sensitivity of the currently used application, and the operation type. For example, comprehensive tolerance = (time period feature deviation statistics + scenario feature deviation statistics) / 2 × feature continuity index correlation factor × sensitivity adjustment coefficient. The feature continuity index correlation factor is negatively correlated with the feature continuity index (the better the continuity, the higher the tolerance). The sensitivity adjustment coefficient is obtained from the sensitivity adjustment coefficient table. The sensitivity adjustment coefficient is directly proportional to the comprehensive tolerance and is a key multiplier factor in the comprehensive tolerance calculation. The sensitivity adjustment coefficient reflects the security sensitivity of the current application and operation type. A smaller value indicates a higher sensitivity and requires stricter anomaly detection standards. The formula for calculating the comprehensive tolerance is: Comprehensive tolerance = (time period feature deviation statistics + scenario feature deviation statistics) / 2 × feature continuity index correlation factor × sensitivity adjustment coefficient. The sensitivity adjustment coefficient directly affects the final tolerance value: For highly sensitive applications (such as banking apps) or high-risk operations (such as password entry), a smaller sensitivity adjustment coefficient (such as 0.8 or lower) will correspondingly reduce the comprehensive tolerance value, making the system more sensitive to behavioral deviations and more likely to trigger anomaly detection. For less sensitive applications (such as gaming apps), a larger sensitivity adjustment coefficient (such as 1.2) will increase the comprehensive tolerance value, allowing for greater behavioral deviations and reducing false positives. This mechanism ensures that the system dynamically adjusts the sensitivity of anomaly detection based on the security importance of the current operation. Machine learning models (such as regression models) can be used to learn how to predict the optimal tolerance value based on these input indicators to minimize historical false positive and false negative rates. The calculated comprehensive tolerance value is smoothed to produce a behavior deviation tolerance table, which contains the behavior deviation tolerance values ​​for each user and each feature dimension in different scenarios.

[0094] Preferably, the behavior deviation tolerance calculation in step S3 includes:

[0095] Based on the user behavior baseline library and tablet system logs, time dimension feature deviation statistics are performed to obtain a time period feature deviation table;

[0096] Calculate the scene dimension feature deviation statistics based on the user behavior baseline library and tablet system logs to obtain the scene feature deviation table;

[0097] Perform feature continuity change analysis on the user behavior baseline library to obtain a feature continuity index table;

[0098] Adjust application sensitivity and operation type tolerance based on the user behavior baseline library and tablet system logs to obtain a sensitivity adjustment coefficient table;

[0099] The time period feature deviation table, scene feature deviation table, feature continuity index table and sensitivity adjustment coefficient table are comprehensively calculated and optimized to obtain a behavior deviation tolerance table.

[0100] In an embodiment of the present invention, baseline statistics of each behavioral feature of each user (such as average sliding speed, daily usage time of a certain application) in different predefined time periods (for example, weekday commuting time 7-9 o'clock, lunch break time 12-14 o'clock, evening leisure time 20-22 o'clock) are obtained from the user behavior baseline library, which are usually the average value and standard deviation of the feature value in the time period. The actual behavioral feature values ​​of users in these specific time periods over the past period of time (for example, one month) are extracted from the tablet system log. For each user, each feature, and each time period, the statistics of the deviation between the feature value in the historical record and the baseline average value of the time period are calculated, such as calculating the average absolute value or standard deviation of these deviations. These statistics reflect the typical fluctuation range of the feature of the user in the time period, that is, the inherent deviation in the time dimension. These statistics are organized into a time period feature deviation table, and the dimensions of the table are the number of users × number of features × number of time periods.

[0101] Obtain baseline statistics for each user's behavioral feature in different predefined scenarios (for example, home scenarios are identified by connecting to a specific WiFi SSID or being within a specific geofence; office scenarios are identified by connecting to corporate WiFi or being within an office building geofence; public scene scenarios are identified by connecting to public WiFi or being within a non-home, non-office geofence) from the user behavior baseline library. Extract the actual behavioral feature values ​​of users in these specific scenarios over the past period of time (for example, one month) in combination with the scenarios identified by location information from the tablet system log. For each user, each feature, and each scenario, calculate the statistics of the deviation between the feature value in the historical records and the baseline average value of the scenario, such as calculating the average absolute value or standard deviation of these deviations. These statistics reflect the typical fluctuation range of the feature of the user in the scenario, that is, the inherent deviation in the scenario dimension. Organize these statistics into a scenario feature deviation table with the dimensions of number of users × number of features × number of scenarios.

[0102] Analyze the historical time series data of each behavioral feature of each user recorded in the user behavior baseline library to evaluate its continuity and stability over time. For example, for a certain feature (such as the daily average sliding speed), calculate the standard deviation of its daily average value series over the past N days (for example, 30 days). The smaller the standard deviation, the smaller the fluctuation of the daily average value of the feature, and the more continuous and stable the user behavior on this feature. Alternatively, calculate the average absolute value of the change in the average value of the feature for two consecutive days. The smaller the change, the better the continuity. Linear regression can also be used to analyze the long-term trend of the feature. If the trend is not obvious and the residual is small, the continuity is considered good. Indicators reflecting the degree of change in the continuity of the feature (such as standard deviation, average daily absolute value of change) are stored in the feature continuity index table. The dimension of the table is the number of users × the number of features. The higher the indicator value, the worse the continuity and the more drastic the change.

[0103] Based on the application sensitivity ratings recorded in the user behavior baseline library (step S12) and specific operation types identified in real-time or historical data from the tablet system log (step S14), adjustment coefficients for application sensitivity and operation type tolerance are calculated. A preset adjustment rule table is used. For example, high-sensitivity applications (such as banking apps) correspond to an adjustment coefficient of 0.8, medium-sensitivity applications (such as social apps) correspond to 1.0, and low-sensitivity applications (such as gaming apps) correspond to 1.2. Specific operation types such as "password entry" correspond to an adjustment coefficient of 0.5, "form filling" corresponds to 0.7, and "file upload" corresponds to 0.6. The corresponding adjustment coefficient is retrieved from the table for the application currently being used by the user and its operation type. If both sensitive applications and sensitive operations are involved, a product calculation method (i.e., application coefficient × operation coefficient) is preferred. This method more comprehensively reflects the risk-enhancing effect of the combined effects of multiple sensitivity factors. If the product result is too small (less than 0.3), a minimum threshold can be set to ensure a basic level of protection. These coefficients reflect how to tighten or relax the tolerance for behavioral deviations based on different sensitivity levels and operation types. These coefficients are organized into a sensitivity adjustment coefficient table, which can be dynamically generated or consulted based on the current situation.

[0104] The time period feature deviation table, scene feature deviation table, feature continuity index table, and sensitivity adjustment coefficient table are comprehensively calculated and optimized to obtain the final behavior deviation tolerance table. For each user i and each feature j, the behavior deviation tolerance Tol_ijts is comprehensively calculated in the current time period t and scene s. The calculation formula can be a weighted combination or a model-based prediction. For example, it can be calculated as:

[0105] Tol_ijts=w_time×Dev_time,ij,t+w_scene×Dev_scene,ij,s+w_continuity×(1-Ind_cont,ij)+w_sens×Coef_sens,ij,app,op;

[0106] Where Dev_time,ij,t is the deviation statistic for the jth feature of the i-th user in time period t, Dev_scene,ij,s is the deviation statistic for scene s, Ind_cont,ij is the continuity index (which requires normalization or inversion), Coef_sens,ij,app,op is the sensitivity adjustment coefficient for the application app and operation type op, and w_time, w_scene, w_continuity, and w_sens are weight parameters used to balance the influence of various factors. The sum of these weight parameters should be equal to 1 (i.e., w_time + w_scene + w_continuity + w_sens = 1). Typical settings are w_time = 0.3, w_scene = 0.3, w_continuity = 0.2, and w_sens = 0.2, but these can be adjusted depending on the specific application scenario. Alternatively, a regression model can be used to train a function that takes time period, scene, feature continuity, application sensitivity, and operation type as input and outputs a predicted tolerance value. Model training data can be based on historical behavior data and manually annotated or rule-based tolerance labels. The calculated comprehensive tolerance value is smoothed (e.g., a sliding average) to generate a behavior deviation tolerance table. This table contains the behavior deviation tolerance values ​​for each user and each feature dimension in different time periods and scenarios. This value will be used for subsequent threshold adjustments.

[0107] Preferably, the multi-level threshold setting in step S3 includes:

[0108] Calculate the initial threshold value of feature weight for each feature dimension of each user based on the security sensitivity weight matrix and the user behavior baseline library to obtain the feature initial threshold table;

[0109] Calculate the tolerance adjustment factor table for different scenarios and times based on the behavior deviation tolerance table;

[0110] Construct a basic level threshold matrix based on the feature initial threshold table and tolerance adjustment factor table;

[0111] Construct a mid-level threshold matrix based on the basic-level threshold matrix;

[0112] Build an advanced threshold matrix based on the basic threshold matrix and user behavior baseline library;

[0113] Calculating thresholds for different types of features based on a basic threshold matrix, a mid-level threshold matrix, and an advanced threshold matrix to obtain a multi-type feature threshold set, wherein the multi-type feature threshold set includes touch dynamic features, application usage features, and spatiotemporal pattern features;

[0114] Calculate the privacy protection level threshold adjustment parameters for the multi-type feature threshold set to obtain the privacy protection threshold adjustment parameters;

[0115] Generate an initial multi-dimensional anomaly threshold configuration table based on the privacy protection threshold adjustment parameters and the multi-type feature threshold set;

[0116] The threshold values ​​of the initial multi-dimensional anomaly threshold configuration table are dynamically updated to obtain a multi-dimensional anomaly threshold configuration table.

[0117] In this embodiment of the present invention, for the security sensitivity weight matrix (output in step S25), its element W_ij represents the security sensitivity weight of the jth feature of the i-th user. Baseline statistics for each feature dimension of each user are obtained from the user behavior baseline library (output in step S31), such as the baseline mean μ_ij and baseline standard deviation σ_ij. Based on the security sensitivity weight and baseline statistics, an initial threshold is calculated for each feature dimension of each user. For example, the initial threshold can be set as a deviation range from the baseline mean. The size of this range is negatively correlated with the security sensitivity weight (the higher the weight, the smaller the allowed deviation and the stricter the threshold). The calculation formula can be: Initial Threshold Range = C × σ_ij / W_ij, where C is a constant (typically 2 to 3, representing the allowed standard deviation multiple), σ_ij is the baseline standard deviation of the jth feature of the i-th user, and W_ij is the security sensitivity weight. For unilateral anomaly detection (for example, only focusing on whether a feature value is too high or too low), the threshold is set to μ_ij ± one side of the initial threshold range, where μ_ij is the baseline mean. For bilateral anomaly detection, the threshold is set to [μ_ij - initial threshold range, μ_ij + initial threshold range]. The calculated initial threshold (or threshold range) for each feature dimension of each user is stored in the feature initial threshold table.

[0118] Based on the behavior deviation tolerance table (output in step S35), which records the behavior deviation tolerance value Tol_ijts for each user in different time periods and scenarios, representing the tolerance for the i-th user and the j-th feature in time period t and scenario s, a tolerance adjustment factor table is calculated. The tolerance adjustment factor is a multiplier used to adjust the initial threshold. The higher the tolerance, the larger the adjustment factor, making the threshold more relaxed; the lower the tolerance, the smaller the adjustment factor, making the threshold more stringent. For example, the tolerance adjustment factor Adj_ijts = 1 + k × (Tol_ijts - Tol_avg), where Tol_avg is the average tolerance, k is an adjustment coefficient (typically ranging from 0.5 to 2.0 to control the sensitivity of the adjustment), and Tol_ijts is the tolerance for the j-th feature of the i-th user in time period t and scenario s. Alternatively, the normalized tolerance value can be directly used as the adjustment factor. The tolerance adjustment factors for each user and each feature dimension in different time periods and scenarios are stored in the tolerance adjustment factor table.

[0119] Based on the feature initial threshold table and tolerance adjustment factor table, a basic-level anomaly detection threshold matrix is ​​constructed. The basic-level threshold is used to identify slightly abnormal behaviors. For each user i and each feature j, in a specific time period t and scenario s, the basic-level threshold Threshold_base,ijts is calculated as the initial threshold Initial_Threshold_ij multiplied by the corresponding tolerance adjustment factor Adj_ijts. For example, if the initial threshold is a range, the basic-level threshold range = initial threshold range × Adj_ijts. If the initial threshold is an upper and lower bound, both the upper and lower bounds are multiplied by Adj_ijts. The calculated basic-level thresholds (or threshold ranges) for each user and each feature dimension in different time periods and scenarios are stored in the basic-level threshold matrix. This is a four-dimensional matrix with the dimensions of number of users × number of features × number of time periods × number of scenarios.

[0120] Based on the basic threshold matrix, a medium-level anomaly detection threshold matrix is ​​constructed. The medium-level threshold is used to identify moderate abnormal behavior and is stricter than the basic threshold. The medium-level threshold can be multiplied by a fixed tightening coefficient (for example, 0.8) on the basis of the basic threshold, or set based on the baseline value with a larger standard deviation multiple. For example, the medium-level threshold range = the basic threshold range × C_mid, where C_mid<1. Alternatively, the medium-level threshold is set to [μ_ij-M_mid×σ_ij,μ_ij+M_mid×σ_ij], where M_mid is a constant (usually 1.5 to 2, indicating the allowed standard deviation multiple), and M_mid is less than the constant C used to calculate the initial threshold. The calculated medium-level thresholds for each user and each feature dimension in different time periods and scenarios are stored in the medium-level threshold matrix.

[0121] The intermediate threshold matrix is ​​constructed based on the basic threshold matrix. The intermediate threshold is used to identify moderately abnormal behavior and is stricter than the basic threshold. There are two main methods to construct the intermediate threshold matrix:

[0122] 1. Tightening method based on the base threshold: A tightening factor is applied directly to the base threshold. The calculation formula is: Intermediate threshold range = Base threshold range × C_mid. C_mid is the tightening factor. A value less than 1 (for example, 0.8) indicates tightening the base threshold by 20%. For a two-sided threshold [μ_ij - range, μ_ij + range], both sides are multiplied by C_mid to reduce the allowable deviation range.

[0123] 2. Method directly based on baseline statistics: does not rely on the basic level threshold, but directly uses a more stringent standard deviation multiple. The calculation formula is: intermediate level threshold = [μ_ij-M_mid×σ_ij,μ_ij+M_mid×σ_ij]; where M_mid is the intermediate level standard deviation multiple, the value is usually 1.5 to 2, and must be less than the constant C used to calculate the basic level threshold to ensure that the intermediate level threshold is stricter than the basic level threshold.

[0124] In practical applications, the system can select an appropriate construction method based on the feature type and user behavior pattern. The calculated intermediate thresholds for each user and each feature dimension in different time periods and scenarios are stored in an intermediate threshold matrix, which has the same dimensional structure as the basic threshold matrix (number of users × number of features × number of time periods × number of scenarios).

[0125] Based on the basic threshold matrix and the user behavior baseline library, an advanced anomaly detection threshold matrix is ​​constructed. Advanced thresholds are used to identify severe abnormal behavior and are more stringent than medium thresholds. Advanced thresholds are often set within unconventional ranges. For example, they can be set based on the baseline value with a larger standard deviation multiple, and this multiple is much larger than the multiple used for the medium threshold. For example, the advanced threshold is set as [μ_ij - M_high × σ_ij, μ_ij + M_high × σ_ij], where M_high is a constant (usually 1.0 to 1.5, smaller than M_mid, indicating a stricter standard deviation multiple). In some cases, the advanced threshold can even be set outside the extreme value range of the user's historical behavior. The calculated advanced thresholds for each user and each feature dimension in different time periods and scenarios are stored in the advanced threshold matrix.

[0126] The threshold information in the basic threshold matrix, intermediate threshold matrix, and advanced threshold matrix is ​​grouped and organized by feature type to obtain a multi-type feature threshold set. The multi-type feature threshold set contains thresholds at three levels: basic, intermediate, and advanced, corresponding to touch dynamic features (such as sliding speed and pressure changes), application usage features (such as application usage duration and frequency of specific application usage), and spatiotemporal pattern features (such as time period usage frequency and location familiarity). For each user, this set contains the graded thresholds for all their features in different time periods and scenarios.

[0127] Based on the preset privacy protection level (basic, medium, high), the parameters used to adjust the threshold are calculated. For example, a privacy protection level adjustment coefficient table is set. The basic privacy protection level corresponds to an adjustment coefficient of 1.0. The medium privacy protection level corresponds to an adjustment coefficient C_privacy_mid (for example, 0.9), indicating that when medium protection is implemented, the threshold should be tightened by 10%. The high privacy protection level corresponds to an adjustment coefficient C_privacy_high (for example, 0.7), indicating that when high protection is implemented, the threshold should be tightened by 30%. These adjustment coefficients are stored in the privacy protection threshold adjustment parameters.

[0128] The calculated privacy-preserving threshold adjustment parameters are applied to the multi-type feature threshold set to generate an initial multidimensional anomaly threshold configuration table. For each user, feature, level, time period, and scenario threshold, Threshold_level,ijts, the final initial threshold, Threshold_initial,level,ijts = Threshold_level,ijts × C_privacy_level, is calculated based on the current privacy protection level, PrivacyLevel, where C_privacy_level is the adjustment coefficient corresponding to the current privacy protection level, as found in the privacy-preserving threshold adjustment parameters. All these initial thresholds are organized into a multidimensional table or data structure, namely the initial multidimensional anomaly threshold configuration table.

[0129] Dynamically update the initial multi-dimensional anomaly threshold configuration table. Based on the user behavior data and anomaly detection results (including false positives and missed negatives) monitored by the system in real time, fine-tune the threshold periodically (for example, daily or weekly). If a feature frequently triggers low-level anomaly alarms in a specific scenario but is confirmed to be normal behavior (false positives) through user feedback or subsequent analysis, the corresponding level threshold of the feature in that scenario is appropriately relaxed (for example, multiplying it by a fine-tuning factor greater than 1). If a feature fails to trigger an alarm at the corresponding level (missed negative) when a known abnormal event occurs, the corresponding level threshold of the feature in that scenario is appropriately tightened (for example, multiplying it by a fine-tuning factor less than 1). An adaptive algorithm based on gradient descent or reinforcement learning can be used to automate the threshold adjustment process, with the goal of minimizing the false positive rate and missed negative rate. The dynamically updated threshold configuration table is used as the final multi-dimensional anomaly threshold configuration table.

[0130] Preferably, step S4 includes the following steps:

[0131] Step S41: Collect user operation data; calculate the current behavior feature vector based on the user operation data;

[0132] Step S42: Compare the current behavior feature vector with the baseline behavior pattern of the user behavior baseline library to obtain the behavior deviation; perform behavior anomaly judgment based on the multi-dimensional anomaly threshold configuration table and the behavior deviation to obtain an anomaly level judgment result;

[0133] Step S43: Selecting a federated learning participation adjustment strategy based on the abnormality level judgment result to obtain a participation adjustment strategy;

[0134] Step S44: Generate a federated learning security parameter adjustment instruction according to the participation adjustment strategy;

[0135] Step S45: Send the federated learning security parameter adjustment instruction to the federated learning client for instruction execution and feedback to achieve the privacy protection data optimization task.

[0136] In this embodiment of the present invention, real-time data streams of user actions on the tablet are collected, including touch events (coordinates, timestamps, and pressure), application launch / switch / close events (application package name and timestamp), and system status changes (screen on / off, network connection status, and location updates). These raw data streams are continuously monitored and captured by a system service or background process. Using the feature extraction method in step S1, features of the user's current behavior are extracted from the real-time collected raw data. For example, when a sequence of sliding touch events is detected, sliding trajectory features such as sliding speed and pressure change are calculated; when an application switch event is detected, the application package name and time are recorded; and when a location update is detected, the current location information is recorded. To meet real-time requirements, feature calculation can use a sliding time window, for example, calculating behavioral feature statistics for the past five seconds every five seconds to form a current behavior feature vector. Simultaneously, using the method in step S14, the user's current behavior pattern (delicate operations, stressful operations, sensitive information processing, unconventional use, etc.) and specific sensitive operations (form filling, password entry, file upload, etc.) are identified in real time from the current behavior feature vector, generating corresponding identifiers or confidence levels.

[0137] The current behavior feature vector calculated in step S41 is compared with the baseline behavior pattern corresponding to the user in the user behavior baseline library (output of step S31) to calculate the behavior deviation. For each feature dimension, calculate the deviation between the current feature value and the baseline average value, for example, calculate its absolute difference |feature_current-μ_baseline| or relative difference |feature_current-μ_baseline| / σ_baseline, where feature_current is the current feature value, μ_baseline is the baseline average value, and σ_baseline is the baseline standard deviation. For the vector as a whole, the Euclidean distance, Manhattan distance or cosine similarity between the current behavior feature vector and the baseline feature vector can be calculated. These distances or similarity values ​​reflect the degree of deviation of the current behavior from the user's habitual baseline. According to the multidimensional anomaly threshold configuration table (output of step S38), the table provides three levels of anomaly judgment thresholds for each user and each feature dimension in the current time period and scenario: basic, intermediate and advanced. Compare the calculated behavior deviation of each feature dimension with the corresponding grading threshold in the configuration table. If the deviation of a certain feature exceeds the basic level threshold, it is marked as a slight anomaly; if it exceeds the medium level threshold, it is marked as a moderate anomaly; if it exceeds the advanced level threshold, it is marked as a severe anomaly. The anomaly judgment results of all features are combined. For example, if multiple features show slight anomalies, or a key feature shows moderate anomalies, the overall anomaly level judgment result is determined to be a moderate anomaly. The key features here refer to the features that rank in the top 20% of the weight values ​​in the security sensitivity weight matrix, or specific predefined high-sensitivity features (such as password input-related features, financial application usage features, etc.). These features have a higher indicative value for security risk judgment. The anomaly level judgment result can be an enumeration value (normal, slight, moderate, severe) or an anomaly score.

[0138] Based on the abnormality level judgment result obtained in step S42 and the user behavior pattern identifier and sensitive operation identifier identified in real time in step S41, the corresponding federated learning participation adjustment strategy is selected. A policy rule base is set up to correspond to different participation adjustment schemes according to different abnormality levels, behavior patterns and sensitive operation combinations. For example:

[0139] Normal behavior: Maintain the default federated learning participation method, such as uploading model updates normally.

[0140] Minor anomalies: Take mild protection measures, such as reducing the data contribution by 20%, or adding a small amount of differential privacy noise to the model update.

[0141] Moderate anomalies (e.g., stressful operating modes or unusual usage patterns): Take moderate protection measures, such as reducing data contributions by 50%, significantly enhancing differential privacy noise, or blurring sensitive features.

[0142] Severe anomalies (for example, sensitive information processing patterns or detection of high-risk operations): Take the most stringent protection measures, such as suspending data uploads, stopping model updates, and masking data in areas involving sensitive data.

[0143] Specific high-risk operations (for example, password input): Regardless of the overall abnormality level, the highest level of targeted protection policy is immediately triggered, such as temporarily blocking the upload of data related to the password input area.

[0144] According to the current judgment result, the corresponding participation adjustment plan is found from the policy rule library as the participation adjustment strategy.

[0145] Based on the participation adjustment strategy selected in step S43, generate security parameter adjustment instructions that the federated learning client needs to execute. These instructions are specific technical parameters or operation commands. For example:

[0146] Data contribution adjustment plan: If the strategy is to reduce data contribution by 50%, an instruction is generated to require the client to use only 50% of its local data for training in the next round of federated learning training, or to scale according to the data amount when uploading model updates.

[0147] Differential privacy parameter calculation: If the strategy is to enhance differential privacy noise, a new differential privacy budget epsilon value is calculated based on the degree of enhancement (the smaller the value, the stronger the privacy protection), or the noise variance parameter σ is directly specified (the larger the value, the more noise), and instructions are generated to require the client to add differential privacy noise of the specified parameter to the model update.

[0148] Feature protection policy: If the policy includes obfuscating or masking sensitive features, generate instructions to specify which feature dimensions need to be processed before uploading (for example, adding noise to location-related features, generalizing sensitive application identifiers in application usage sequences).

[0149] Operational regional protection parameters: If the policy includes protection for specific sensitive areas (such as password input boxes), generate instructions to instruct the client to suspend the collection or upload of related data when the user interacts with these areas.

[0150] All generated parameters and instructions are packaged to form federated learning security parameter adjustment instructions.

[0151] The federated learning security parameter adjustment instruction generated in step S44 is sent to the federated learning client running on the tablet computer through a secure channel. After receiving the instruction, the client immediately adjusts its federated learning participation behavior according to the instruction. For example, modify the data loading logic of local training to reduce the amount of data, adjust the parameters of differential privacy noise in the model update calculation, or suspend the synchronization of model parameters with the server. After the client performs the adjustment, it feeds back the execution results or status (for example, the actual amount of data used, the privacy parameter value of the application, whether to suspend the update) to the server so that the server can record and monitor. At the same time, a security parameter adjustment effect evaluation mechanism is established, for example, recording the impact of each adjustment on the model convergence speed, model accuracy and the degree of privacy protection enhancement perceived by the user, and analyzing whether new false positives or false negatives occur during the adjustment process. Based on the evaluation results, the policy rule library of step S43 and the parameter generation logic of step S44 can be optimized to form a closed-loop adaptive adjustment system to continuously optimize the performance of the privacy protection data optimization task.

[0152] Preferably, step S43 includes:

[0153] Calculate the comprehensive risk level score based on the abnormal level judgment results to obtain the comprehensive risk assessment results;

[0154] Calculate the data contribution adjustment based on the comprehensive risk assessment results and obtain a data contribution adjustment plan;

[0155] Calculate the differential privacy parameters based on the comprehensive risk assessment results and obtain the privacy noise parameter scheme;

[0156] Generate feature protection strategies based on comprehensive risk assessment results and abnormality level judgment results;

[0157] Obtain the current operation type and perform sensitive operation type judgment on the current operation type to obtain the operation regional protection parameters;

[0158] Generate a participation adjustment strategy based on the data contribution adjustment scheme, privacy noise parameter scheme, feature protection strategy and operation regional protection parameters.

[0159] In an embodiment of the present invention, a comprehensive risk assessment result is calculated based on the abnormality level judgment result (normal, mild, moderate, severe), combined with the user behavior pattern identifier (delicate operation, nervous operation, sensitive information processing, unconventional use, etc.) and the sensitive operation identifier (form filling, password input, file upload, etc.). A risk scoring function or table lookup rule is set. For example, the abnormality level is mapped to the basic risk score: normal = 0, mild = 0.3, moderate = 0.6, severe = 1.0. The basic risk score is then weighted or superimposed according to the behavior pattern and sensitive operation. For example, if the behavior pattern is "sensitive information processing", the risk score is directly increased to 1.0; if the behavior pattern is "nervous operation", the risk score is increased by 0.2 on the basic score; if the "password input" operation is detected, the risk score is forcibly set to the highest value of 1.0. Taking into account the risk weights of the abnormality level, behavior pattern and sensitive operation, a comprehensive risk assessment result between 0 and 1 is calculated, with 1 representing the highest risk.

[0160] Based on the calculated comprehensive risk assessment results, calculate the data contribution adjustment plan. The higher the risk, the lower the data contribution should be to reduce the potential risk of privacy leakage. Set a data contribution adjustment function, which inputs the comprehensive risk assessment result and outputs a data contribution ratio (between 0 and 1, 1 indicates normal contribution, 0 indicates suspended contribution). For example, contribution ratio = 1-comprehensive risk assessment result. Or use a piecewise function: if the risk is less than 0.3, contribution ratio = 1.0; if the risk is between 0.3 and 0.6, contribution ratio = 0.7; if the risk is between 0.6 and 0.9, contribution ratio = 0.3; if the risk is greater than 0.9, contribution ratio = 0. The calculated data contribution ratio is the data contribution adjustment plan.

[0161] Based on the comprehensive risk assessment results, calculate the differential privacy parameter scheme. The higher the risk, the stronger the differential privacy protection should be, meaning the smaller the differential privacy budget epsilon should be, or equivalently, the greater the noise added to the model update. A differential privacy parameter calculation function is set up that takes the comprehensive risk assessment result as input and outputs the differential privacy budget epsilon value or noise ratio. For example, ε = ε_base × (1 - comprehensive risk assessment result), where ε_base is the base differential privacy budget. Alternatively, a piecewise function can be used: if the risk is less than 0.3, ε = ε_base; if the risk is between 0.3 and 0.6, ε = 0.7 × ε_base; if the risk is between 0.6 and 0.9, ε = 0.4 × ε_base; if the risk is greater than 0.9, ε = 0.1 × ε_base. The calculated differential privacy parameter (e.g., epsilon value) is the privacy noise parameter scheme.

[0162] Generate a feature protection strategy based on the comprehensive risk assessment results and the abnormality level judgment results. This strategy specifies which behavioral feature dimensions require additional protection or processing during the federated learning process. For example:

[0163] If the anomaly level is moderate or severe and involves touch dynamic features (such as sliding speed and pressure), the strategy requires more refined quantization of these features or adding additional noise before uploading.

[0164] If the behavior pattern is identified as "sensitive information processing" and involves application usage characteristics (such as the duration of use of a specific application, a specific operation sequence), the policy requires that these characteristics be generalized (for example, only recording the application category instead of the specific application name, and only recording the number of operations instead of the specific sequence).

[0165] If the risk of unusual usage patterns is high and involves spatiotemporal pattern features (e.g., location information), the strategy requires a coarser-grained representation of the location information or the addition of spatial perturbations.

[0166] The feature protection strategy can be a list of feature dimensions that require special processing and the corresponding processing methods (fuzzification, generalization, encryption, etc.).

[0167] Get the current operation type identified in real time in step S41 (for example, the user is interacting with the input box on the screen, clicking a button, or sliding a list). Perform a sensitive operation type judgment on the current operation type. Sensitive operation types include but are not limited to form filling (identifying changes in input box focus, keyboard pop-ups, and continuous character input), password input (identifying input boxes specifically marked as passwords, pressing Enter after entering characters), and file uploads (identifying file selector pop-ups, upload progress bars, and system calls related to file uploads). If the current operation is judged to be a sensitive operation type, operation regional protection parameters are generated. For example, for a password input operation, the parameters specify temporary shielding or the highest intensity differential privacy protection for data such as touch coordinates and input content related to the current input area. For form filling, the parameters can specify stricter protection for interactive data within the form area. These parameters are protection instructions that take effect for specific areas of the screen or specific interactive events.

[0168] The data contribution adjustment scheme, privacy noise parameter scheme, feature protection strategy, and operation regional protection parameters are integrated into a complete federated learning participation adjustment strategy. This strategy is a structured data object that contains all security-related instructions and parameters that the client needs to follow in the next round or the current federated learning process. For example, it includes: local data usage ratio = 0.5, differential privacy epsilon = 0.5, list of features to be obfuscated = [location features, sensitive application usage time], sensitive area protection rules = [{area coordinates: (x1, y1, x2, y2), protection level: highest}, {operation type: password input, protection action: mask data}]. This structured strategy is used as the final participation adjustment strategy output for subsequent generation of specific client instructions.

[0169] The present invention is therefore intended to be illustrative and non-restrictive in all respects, with the scope of the invention being defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the application documents are intended to be embraced therein.

[0170] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is to be construed in the widest possible manner consistent with the principles and novel features disclosed herein.

Claims

1. A tablet user privacy protection data optimization method based on federated learning, characterized in that: The following steps are involved: Step S1: obtaining tablet touch dynamic data and tablet system logs; extracting sliding trajectory feature vectors from the tablet touch dynamic data; Analyze user behavior patterns based on sliding trajectory feature vectors and tablet system logs to obtain user behavior pattern classification results and behavior feature vector sets; Step S2: extracting the feature information entropy vector and the feature time series correlation vector of the behavior feature vector set; performing dual evaluation weight fusion processing on the feature information entropy vector and the feature time series correlation vector according to the user behavior pattern classification result to obtain a security sensitivity weight matrix; Step S3: constructing a baseline behavior pattern based on the behavior feature vector set to obtain a user behavior baseline library; calculating a behavior deviation tolerance based on the user behavior baseline library to obtain a behavior deviation tolerance table; Multi-level threshold settings are performed based on the behavior deviation tolerance table and the security sensitivity weight matrix to obtain a multi-dimensional abnormal threshold configuration table; Step S4: The current behavior is judged as abnormal according to the multi-dimensional abnormal threshold configuration table to obtain the abnormal level judgment result; the federated learning participation adjustment strategy is selected according to the abnormal level judgment result to obtain the participation adjustment strategy; the protection parameter instruction is executed according to the participation adjustment strategy to achieve the privacy protection data optimization task.

2. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: extracting sliding trajectory feature vectors from tablet touch dynamic data; Step S12: constructing an application interaction sequence feature vector based on the tablet system log; Step S13: encoding the spatiotemporal usage pattern according to the tablet system log to obtain a spatiotemporal usage pattern vector; Step S14: classifying the user behavior pattern according to the sliding trajectory feature vector, the application interaction sequence feature vector, and the spatiotemporal usage pattern vector to obtain a user behavior pattern classification result; Step S15: performing feature fusion and dimensionality reduction on the sliding trajectory feature vector, the application interaction sequence feature vector, and the spatiotemporal usage pattern vector to obtain a behavior feature vector set.

3. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 1, characterized in that: Extracting the sliding trajectory feature vector in step S1 includes: Perform data preprocessing on the tablet touch dynamic data to obtain the original data of the touch event sequence; Perform sliding trajectory recognition and segmentation on the original data of the touch event sequence to obtain a segmented sliding trajectory set; Calculate the instantaneous velocity sequence of the trajectory of the segmented sliding trajectory set; Extract the sliding acceleration from the instantaneous velocity sequence of the trajectory to obtain a smooth acceleration sequence; Extracting sliding direction features of segmented sliding trajectory sets; Extract the pressure variation characteristics of the segmented sliding trajectory set; Calculate the trajectory geometric characteristics of the segmented sliding trajectory set; The sliding trajectory feature vector is obtained by integrating the trajectory instantaneous velocity sequence, smooth acceleration sequence, sliding direction characteristics, pressure change characteristics and trajectory geometric characteristics.

4. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 2, characterized in that: Step S14 includes: Calculating the trajectory regularity index and the pressure stability index based on the sliding trajectory characteristic vector; making a fine operation judgment based on the trajectory regularity index and the pressure stability index to obtain a fine operation feature identifier; Calculate the sliding velocity change rate and pressure mutation index based on the sliding trajectory characteristic vector; determine the tense operation based on the sliding velocity change rate and pressure mutation index to obtain the tense operation characteristic identifier; Use the pre-built sensitive operation feature library to match the sensitive operation sequence of the application interaction sequence feature vector; perform sensitive information processing and identification based on the sensitive operation sequence to obtain the sensitive operation feature identifier; Analyze time regularity and location familiarity based on the spatiotemporal usage pattern vector; determine irregular usage based on time regularity and location familiarity to obtain irregular usage identification; Multi-feature fusion and behavior pattern classification are performed on fine operation feature identifiers, tense operation feature identifiers, sensitive operation feature identifiers and unconventional use identifiers to obtain user behavior pattern classification results.

5. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: Calculate the feature information entropy vector of the behavior feature vector set; Step S22: performing feature time series correlation analysis on the behavior feature vector set to obtain a feature time series correlation vector; Step S23: Performing a behavior pattern security risk assessment on the user behavior pattern classification results to obtain a behavior pattern risk score; Step S24: performing dual evaluation weight fusion on the feature information entropy vector and the feature time series correlation vector according to the behavior pattern risk score to obtain a feature comprehensive weight vector; Step S25: Construct a security sensitivity weight matrix based on the feature comprehensive weight vector.

6. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 5, characterized in that: Step S24 includes: Performing feature information normalization processing on the feature information entropy vector and the feature time series correlation vector to obtain a normalized information vector; Calculate the basic feature weight vector of the normalized information vector; Construct a risk correlation matrix based on the behavior pattern risk score and the basic feature weight vector; Adjust the risk perception weight according to the risk correlation matrix to obtain the risk adjustment weight vector; The risk-adjusted weight vector is smoothed and stabilized to obtain the feature-comprehensive weight vector.

7. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 1, characterized in that: The behavior deviation tolerance calculation in step S3 includes: Based on the user behavior baseline library and tablet system logs, time dimension feature deviation statistics are performed to obtain a time period feature deviation table; Calculate the scene dimension feature deviation statistics based on the user behavior baseline library and tablet system logs to obtain the scene feature deviation table; Perform feature continuity change analysis on the user behavior baseline library to obtain a feature continuity index table; Adjust application sensitivity and operation type tolerance based on the user behavior baseline library and tablet system logs to obtain a sensitivity adjustment coefficient table; The time period feature deviation table, scene feature deviation table, feature continuity index table and sensitivity adjustment coefficient table are comprehensively calculated and optimized to obtain a behavior deviation tolerance table.

8. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 1, characterized in that: The multi-level threshold setting in step S3 includes: Calculate the initial threshold value of feature weight for each feature dimension of each user based on the security sensitivity weight matrix and the user behavior baseline library to obtain the feature initial threshold table; Calculate the tolerance adjustment factor table for different scenarios and times based on the behavior deviation tolerance table; Construct a basic level threshold matrix based on the feature initial threshold table and tolerance adjustment factor table; Construct a mid-level threshold matrix based on the basic-level threshold matrix; Build an advanced threshold matrix based on the basic threshold matrix and user behavior baseline library; Calculating thresholds for different types of features based on a basic threshold matrix, a mid-level threshold matrix, and an advanced threshold matrix to obtain a multi-type feature threshold set, wherein the multi-type feature threshold set includes touch dynamic features, application usage features, and spatiotemporal pattern features; Calculate the privacy protection level threshold adjustment parameter for the multi-type feature threshold set to obtain the privacy protection threshold adjustment parameter; Generate an initial multi-dimensional anomaly threshold configuration table based on the privacy protection threshold adjustment parameters and the multi-type feature threshold set; The threshold values ​​of the initial multi-dimensional anomaly threshold configuration table are dynamically updated to obtain a multi-dimensional anomaly threshold configuration table.

9. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: Collect user operation data; calculate the current behavior feature vector based on the user operation data; Step S42: Compare the current behavior feature vector with the baseline behavior pattern of the user behavior baseline library to obtain the behavior deviation; perform behavior anomaly judgment based on the multi-dimensional anomaly threshold configuration table and the behavior deviation to obtain an anomaly level judgment result; Step S43: Selecting a federated learning participation adjustment strategy based on the abnormality level judgment result to obtain a participation adjustment strategy; Step S44: Generate a federated learning security parameter adjustment instruction according to the participation adjustment strategy; Step S45: Send the federated learning security parameter adjustment instruction to the federated learning client for instruction execution and feedback to achieve the privacy protection data optimization task.

10. The method for optimizing tablet computer user privacy protection data based on federated learning according to claim 9, characterized in that: Step S43 includes: Calculate the comprehensive risk level score based on the abnormal level judgment results to obtain the comprehensive risk assessment results; Calculate the data contribution adjustment based on the comprehensive risk assessment results to obtain a data contribution adjustment plan; Calculate the differential privacy parameters based on the comprehensive risk assessment results and obtain the privacy noise parameter scheme; Generate feature protection strategies based on comprehensive risk assessment results and abnormality level judgment results; Obtain the current operation type and perform sensitive operation type judgment on the current operation type to obtain the operation regional protection parameters; A participation adjustment strategy is generated based on the data contribution adjustment scheme, privacy noise parameter scheme, feature protection strategy and operation regional protection parameters.

Images