Method for risk prediction based on mobile terminal device

Abstract

The application relates to the technical field of data security, and discloses a risk prediction method based on a mobile terminal device. The method acquires a historical behavior data set of the mobile terminal device. According to the data set, a dynamic input feature set and a static interference feature set are divided out, the dynamic input feature set is derived from a real-time updated user operation behavior sequence, and the static interference feature set is generated by fusing device state change records and environmental parameter change trajectories. A dynamic risk prediction model is established, the dynamic input feature set is taken as a model input layer, the static interference feature set is taken as a model hidden layer adjustment parameter, and a risk probability value is output by means of a bidirectional feature coupling mechanism. The static interference feature set is segmented and intercepted by adopting a sliding time window, fluctuation periods and frequency distribution rules of interference features are extracted, and an interference feature fluctuation spectrum is generated. Based on spectrum matching of a current interference feature state, a real-time risk early warning signal is generated in combination with the risk probability value.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a risk prediction method based on a mobile terminal device. BACKGROUND

[0002] In today's digital age, mobile terminal devices such as smartphones, tablets, etc. have become an indispensable tool in people's lives. Its popularity is extremely high, almost everyone has one or even more. With the help of mobile terminals, people can conveniently carry out various online activities, covering social communication, online shopping, mobile payment, online office, entertainment and leisure, and many other fields. For example, people can keep in touch with friends and relatives at any time and any place through social software such as WeChat and QQ; use e-commerce platforms such as Taobao and Jingdong to shop, and can choose global goods without leaving home; use Alipay and WeChat payment to achieve convenient online payment, whether it is daily consumption or online transfer can be easily completed; can also use various office software such as Dingding and Tencent Conference to conduct remote office and online meeting, breaking the time and space limit; and watch videos and play games through platforms such as Douyin and iQiyi to enrich leisure time.

[0003] These online activities, while bringing convenience, also come with many risks. Taking online payment as an example, when users are performing payment operations, they may encounter attacks by malicious software. Malicious software may be hidden in some seemingly regular applications, and during the user's payment process, it may steal the user's payment account number, password, verification code and other key information, resulting in the user's funds being stolen. Some unscrupulous people will send phishing links or pretend to be bank customer service, etc. to lure users to click on the link and input payment information, in order to achieve the purpose of cheating money. Mobile terminal devices themselves may also face the risk of being attacked, hackers may use device system vulnerabilities to invade the device and obtain various data stored in the device by the user, such as contact information, photos, documents, etc., causing user data leakage and posing a serious threat to user privacy and property safety.

[0004] In the face of these risks, traditional risk prediction methods have many shortcomings. In terms of data utilization, traditional methods can only analyze a single type of data and cannot fully integrate multi-source data such as user operation behavior sequences, device state change records, and environmental parameter change trajectories. For example, it may only focus on user payment behavior data, while ignoring factors such as the network environment and system state of the device at the time, which affect payment risk. In terms of model construction, traditional models are mostly static models and are difficult to adapt to the complex and changing risk conditions in the mobile terminal usage scenario. The usage scenario of the mobile terminal is changing all the time, users may perform various operations in different locations and different network environments, and risk factors also change constantly, while traditional models cannot capture these dynamic changes in time and make accurate risk predictions.

[0005] With the in-depth application of mobile terminals in people's life and work, the security demand is growing. However, the limitations of traditional risk prediction methods make them difficult to meet the current complex security situation. Therefore, there is an urgent need for a new risk prediction method that can fully utilize multi-source data, comprehensively analyze the use of mobile terminals, and build a dynamic risk prediction model to adapt to the changing risk scenario and effectively protect the security of various online activities of users on mobile terminals. The risk prediction method based on mobile terminal equipment proposed in the present application is based on such background. SUMMARY

[0006] The purpose of the present application is to provide a risk prediction method based on mobile terminal equipment to solve the problems raised in the background art.

[0007] To achieve the above-mentioned purpose, the present application provides a risk prediction method based on mobile terminal equipment, which comprises:

[0008] Obtain a set of historical behavior data of the mobile terminal equipment, which includes a sequence of user operation behaviors, a record of device state changes and a trajectory of environmental parameter changes;

[0009] Divide the dynamic input feature set and the static interference feature set according to the set of historical behavior data, the dynamic input feature set is composed of real-time updated user operation behavior sequences, and the static interference feature set is generated by fusing device state change records and environmental parameter change trajectories;

[0010] Establish a dynamic risk prediction model, take the dynamic input feature set as the input layer of the model, take the static interference feature set as the hidden layer adjustment parameter of the model, and output the risk probability value through the bidirectional feature coupling mechanism;

[0011] Use a sliding time window to segment and intercept the static interference feature set, extract the fluctuation period and frequency distribution law of the interference features in each time window, and generate an interference feature fluctuation spectrum;

[0012] Match the interference feature state at the current time point based on the interference feature fluctuation spectrum, and generate a real-time risk warning signal combined with the risk probability value output by the dynamic risk prediction model.

[0013] Preferably, the set of historical behavior data of the mobile terminal equipment specifically comprises:

[0014] Extract the sequence of user operation behaviors from the device local log, which includes application startup duration, screen touch trajectory and network request frequency;

[0015] The device hardware state change record includes a battery temperature fluctuation curve, a CPU load peak value, and a memory occupancy change interval.

[0016] The environmental parameter change trajectory includes a geographical position offset, an ambient light intensity gradient, and a surrounding wireless signal strength matrix.

[0017] Preferably, the division of the dynamic input feature set and the static interference feature set according to the historical behavior data set includes:

[0018] The user operation behavior sequence is timestamp aligned, and the operation behavior segment corresponding to the abnormal timestamp is removed, and the continuous operation behavior segments are combined into the dynamic input feature set.

[0019] The device hardware state change record and the environmental parameter change trajectory are superimposed in the time dimension, the mean-to-variance ratio of the superimposed features is calculated, and the features with a variance ratio lower than a threshold value are selected to form the static interference feature set.

[0020] Preferably, the establishment of the dynamic risk prediction model includes:

[0021] A neural network architecture including an input layer, a hidden layer, and an output layer is constructed, the number of input layer nodes is consistent with the dimension of the dynamic input feature set, and the number of hidden layer nodes is dynamically adjusted according to the dimension of the static interference feature set;

[0022] An interference feature attenuation factor is embedded in the hidden layer, and the interference feature attenuation factor adaptively updates the weight according to the fluctuation period of the static interference feature set;

[0023] The risk probability value is calculated through the output layer, and the risk probability value is a nonlinear combination result of the input layer features and the hidden layer adjustment parameters.

[0024] Preferably, the segmented interception of the static interference feature set by using the sliding time window includes:

[0025] A time window with a fixed length is set, and the static interference feature subsets are intercepted along the time axis at a preset step size;

[0026] The frequency domain conversion is performed on each subset, and the period corresponding to the frequency energy distribution peak value is extracted as the interference feature fluctuation period;

[0027] The frequency of the feature value exceeding the historical mean value in each subset is counted, a frequency distribution histogram is generated, and the interference feature frequency distribution rule is marked.

[0028] Preferably, the generation of the interference feature fluctuation spectrum includes:

[0029] The interference characteristic fluctuation period and frequency distribution law are spliced in sequence according to the time window to form a two-dimensional fluctuation time sequence matrix.

[0030] The two-dimensional fluctuation time sequence matrix is normalized to eliminate the dimensional differences of different characteristic dimensions.

[0031] According to the normalization result, a heat map is drawn, the horizontal axis of the heat map is the time window number, the vertical axis is the interference characteristic type, and the color scale represents the fluctuation intensity.

[0032] Preferably, the interference characteristic state matching the current time point based on the interference characteristic fluctuation spectrum comprises:

[0033] Obtain the time window number to which the current time point belongs, and extract the fluctuation intensity vector corresponding to the number from the interference characteristic fluctuation spectrum.

[0034] Calculate the cosine similarity of the fluctuation intensity vector and the historical window vector, and select the historical window with the highest similarity as the matching result.

[0035] The interference characteristic state corresponding to the matching result is marked as the current interference characteristic state.

[0036] Preferably, the risk probability value output by the dynamic risk prediction model is combined to generate a real-time risk warning signal, which comprises:

[0037] Input the current interference characteristic state into the hidden layer of the dynamic risk prediction model to update the hidden layer adjustment parameters.

[0038] Recalculate the risk probability value according to the updated model parameters, and trigger the warning signal when the risk probability value exceeds the dynamic threshold value.

[0039] The dynamic threshold value is determined by the sliding average value of the historical risk probability value and the fluctuation intensity of the current interference characteristic state.

[0040] Preferably, the determination process of the dynamic threshold value comprises:

[0041] Take the risk probability value sequence of the last N time windows, and calculate the exponential weighted moving average value as the reference threshold value.

[0042] Adjust the reference threshold value according to the fluctuation intensity of the current interference characteristic state. The fluctuation intensity increases by a preset unit, and the reference threshold value decreases by a fixed proportion.

[0043] The adjusted reference threshold value is used as the dynamic threshold value of the current time point.

[0044] Preferably, the processing after triggering the warning signal comprises:

[0045] Record the dynamic input feature set and static interference characteristic set snapshot at the moment when the warning signal is triggered.

[0046] The snapshot data is matched with a historical early warning case library, and the historical case number with the highest matching degree is output;

[0047] According to the historical case number, the corresponding treatment strategy is called and loaded into the execution queue of the mobile terminal device.

[0048] Compared with the prior art, the present application has the beneficial effects that:

[0049] The method comprehensively utilizes a historical behavior data set, which includes user operation behavior sequences, device state change records, and environmental parameter change trajectories, and the like. Unlike traditional methods that rely on only a single type of data, the fusion of such multi-source data can more comprehensively and stereoscopically reflect the use state of the mobile terminal device and the environment in which it is located. Taking a user's mobile payment as an example, a traditional method can only focus on the behavior data of the payment operation itself, while the present method can not only analyze the steps, frequency, and the like of the user operation behavior sequence of the payment operation, but also combine the power, network connection state, and the like of the device during payment, as well as the geographic location, surrounding network signal strength, and the like of the environmental parameter change trajectory at that time, to comprehensively judge the risk in the payment process. Through the analysis of these multi-dimensional data, more potential risk factors can be mined, greatly improving the accuracy of risk prediction and more accurately identifying possible security threats.

[0050] The dynamic risk prediction model constructed by the present application is innovative, which effectively fuses the dynamic input feature set and the static interference feature set through a bidirectional feature coupling mechanism. The dynamic input feature set is composed of real-time updated user operation behavior sequences, which can timely reflect the latest operation dynamics of the user; the static interference feature set is generated by fusing device state change records and environmental parameter change trajectories, which reflects the influence of the relative stable state of the device and the environment on the risk. In traditional models, it is often difficult to fully consider the mutual relationship between these dynamic and static factors, resulting in limitations in risk prediction. The bidirectional feature coupling mechanism of the present model enables dynamic features and static features to complement and influence each other. When a user performs a sensitive information transmission operation in different network environments, the model can simultaneously according to the changes in the user operation behavior sequence, as well as the stability, security, and the like of the network environment (part of the static interference feature set), more deeply mine the internal correlations between risk factors, thereby more accurately predicting the risk, greatly improving the accuracy and reliability of the prediction.

[0051] The static interference feature set is segmented and intercepted by using a sliding time window, and the fluctuation period and frequency distribution rule of the interference feature in each time window is extracted to generate an interference feature fluctuation atlas. This process realizes dynamic analysis of the interference feature, and can capture the change trend of the device state and environmental parameters in real time. When the power consumption of the device appears abnormal fluctuation, or the network signal strength of the environment frequently changes, the interference feature fluctuation atlas can timely present these changes. Based on the atlas matching the interference feature state at the current time point, and combining the risk probability value output by the dynamic risk prediction model, a real-time risk early warning signal can be quickly and accurately generated. Compared with the traditional risk early warning method, this method is no longer simply based on the preset fixed rules for early warning, but can provide more targeted and timely risk prompts for users according to the real-time dynamic changes of the device and the environment, and the risk probability obtained by comprehensive analysis, so that users can take corresponding preventive measures at the first time of risk occurrence, and effectively reduce the loss caused by the risk. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 The working principle diagram of the risk prediction method based on a mobile terminal device is described.

[0053] Figure 2 The flowchart for obtaining the historical behavior data set of the mobile terminal device is described.

[0054] Figure 3 The flowchart for establishing a dynamic risk prediction model is described. DETAILED DESCRIPTION

[0055] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0056] Please refer to Figure 1The application provides a risk prediction method based on a mobile terminal device, which comprises integrating user behavior data, device state and environmental parameters to achieve accurate risk warning. The historical behavior data set of the mobile terminal device is the basic data source of the method, and the historical behavior data set comprises user operation behavior sequence, device state change record and environmental parameter change trajectory. The division of the dynamic input feature set and the static interference feature set is based on data update frequency and influence degree. The dynamic input feature set is composed of real-time user operation behavior sequence, and the static interference feature set is generated by fusing relatively stable device state change record and environmental parameter change trajectory. The architecture design of the dynamic risk prediction model is a bidirectional feature coupling mechanism. The dynamic input feature set is used as the model input layer to transfer the real-time behavior mode, and the static interference feature set is used as the model hidden layer to introduce external interference factors. The application object of the sliding time window is the static interference feature set. The window sliding process intercepts the feature subset and analyzes the fluctuation rule. The generation of the interference feature fluctuation spectrum depends on the period and frequency analysis in the time window. The spectrum visualization presents the historical change mode of the interference feature. The interference feature state matching operation at the current time point is realized based on the similarity calculation of the fluctuation spectrum. The matching result and the risk probability value output by the model are combined to trigger the warning signal.

[0057] Embodiment 1: refer to Figure 2 The historical behavior data set of the mobile terminal device constitutes the data basis of the entire risk prediction method. The integrity and accuracy of the historical behavior data set directly affect the reliability of subsequent feature engineering and model prediction. The data acquisition process starts from systematic scanning and analysis of device local logs. The device local logs serve as the original data warehouse recording user interaction with the device, and contain event records arranged in chronological order. User operation behavior sequence is extracted from these log entries. The extraction logic of the user operation behavior sequence focuses on identifying user interaction events with clear start and end points, such as an application usage session starting from the application icon being clicked to start, and ending when the user switches to other applications or locks the screen. Application startup duration records the duration from startup to exit of each application. Screen touch trajectory captures the user's continuous operation on the touch screen. Screen touch trajectory is stored in the form of time series coordinate points, including press, move and lift events. Network request frequency counts the number of data communication initiated to the server within a certain time interval. Network request frequency is classified according to different network protocol ports and application processes.

[0058] The collection of device hardware state change records relies on the underlying hardware monitoring interfaces provided by the mobile terminal operating system, which read and record the operating parameters of key hardware components at a fixed sampling frequency. The battery temperature fluctuation curve is obtained by continuous measurement of the built-in thermistor, and the battery temperature fluctuation curve data points contain a timestamp and the corresponding Celsius temperature value. The CPU load peak is obtained by reading the system load file, and the CPU load peak records the maximum value of the percentage of the processor in active state per unit time. The memory occupancy change interval is defined by monitoring the change of available system memory, and the memory occupancy change interval records the minimum and maximum values of memory usage in a period of time. The acquisition of the environmental parameter change trajectory requires the invocation of various sensor hardware integrated into the device, and the sensor interface periodically reads data at a preset sampling rate. The geographic position offset is derived from the global positioning system receiver or network base station positioning data, and the geographic position offset calculates the straight-line distance between two consecutive positioning points. The ambient light intensity gradient is measured by a light sensor, and the ambient light intensity gradient calculates the rate of change of ambient light intensity per unit time. The surrounding wireless signal strength matrix is scanned by the wireless network adapter to visible access points, and the surrounding wireless signal strength matrix records the service set identifier and the corresponding signal strength indicator value of each access point.

[0059] The storage of the historical behavior data set adopts a time series database structure, and each data record is accompanied by a high-precision timestamp derived from the device's system clock, ensuring that all data sources have a unified time reference. The preprocessing stage of the user operation behavior sequence includes data cleaning steps, which aim to remove invalid or erroneous records, such as repeated events due to system failures, ghost click events with abnormally short duration, and network request packets that are obviously beyond the reasonable range. The coordinate sequence of the screen touch trajectory is subjected to smoothing filter processing to eliminate coordinate point jitter caused by finger jitter or sensor noise. The data points of the device hardware state change records may have missing samples due to system resource competition, and linear interpolation algorithm is used to fill in these missing data points to maintain the continuity of the time series. The sensor readings of the environmental parameter change trajectory are susceptible to transient interference, such as jumps in geographic position data due to signal obstruction and sudden mutations in ambient light intensity due to temporary obstruction. These abnormal values are identified and corrected by the sliding window statistical method, using the median of the data within the window to replace the obviously deviating peak value.

[0060] The operation of dividing the historical behavior data set into a dynamic input feature set and a static interference feature set is performed at the back end of the data preprocessing pipeline, and the basis for the division is the update frequency of the feature values and their potential impact patterns on the risk events. The user operation behavior sequence is timestamp aligned, and the timestamp alignment processing is based on the millisecond level precision of the system clock, synchronously corrects the timestamps of all data sources, and the correction process considers the possible micro clock drift between different data acquisition modules. The operation behavior segments corresponding to abnormal timestamps are identified and removed, and the judgment criteria for abnormal timestamps include that the timestamp is obviously ahead of or behind the system time, the timestamp sequence appears non-monotonic increasing (i.e. the timestamp of the later occurring event is smaller), and the time interval between adjacent events exceeds the upper limit of the normal human interaction response time (for example, set to 30 seconds). The continuous operation behavior segments are merged into a dynamic input feature set, and the merging logic of the continuous operation behavior segments is based on the time gap threshold between events, and multiple discrete operation events with a time interval less than a set threshold (such as 2 seconds) are aggregated into a meaningful user session segment, which represents the user's real-time, high-frequency changing interaction intention and behavior habit.

[0061] The device state change record and the environmental parameter change trajectory are superimposed and fused in the time dimension, and the superimposition operation aligns the data streams from different physical sources on the time axis to form a multi-dimensional composite feature vector. Each valid time point corresponds to a feature vector, and each dimension in the vector represents a device state or environmental parameter reading. The mean-to-variance ratio of the superimposed features is calculated, and the calculation of the mean-to-variance ratio is performed in a sliding time window, and the window size is set to be sufficient to capture short-term fluctuations of the features. For each feature dimension in the window, the arithmetic mean and the variance of its value are calculated respectively, and then the variance ratio index of the feature is obtained by dividing the variance by the mean. The features with a variance ratio below a preset threshold are selected to form a static interference feature set, and the selection of the threshold is based on statistical analysis of the distribution of historical data, for example, taking the median or a certain percentile of all feature variance ratios as the dividing line. Features with low variance ratios indicate that their values are relatively stable in the time dimension and change slowly, usually corresponding to the basic running state of the device or the relatively constant environment background. Although these static interference feature sets do not directly reflect the user's immediate intention, they have an important modulating effect on the risk probability as context information. The division results of the dynamic input feature set and the static interference feature set are stored in the form of a feature index table, which records the name of each feature variable, the type of the set to which it belongs, the latest data update timestamp, and the statistical quantity used for division. This division process is periodic, and as new data continuously flows in, the feature index table will be updated regularly to ensure that the division of the feature set can adapt to possible long-term drifts in the data distribution.

[0062] Embodiment 2: see Figure 3The dynamic risk prediction model is based on a customized neural network architecture. The design of the neural network architecture needs to handle two different types of data streams: dynamic input feature set and static interference feature set. The neural network architecture includes an input layer, a hidden layer, and an output layer. The number of input layer nodes strictly corresponds to the dimension of the dynamic input feature set. Each input layer node is responsible for receiving the real-time value of a specific feature dimension in the dynamic input feature set. The number of hidden layer nodes is dynamically adjusted by the dimension of the static interference feature set. The adjustment mechanism is realized through a mapping function that converts the vector length of the static interference feature set to the required number of hidden layer nodes. The activation function of the hidden layer is a nonlinear function with saturation characteristics to prevent gradient explosion. An interference feature decay factor is embedded in the hidden layer. The introduction of the interference feature decay factor is to quantify the timeliness of the impact of the static interference feature set on the current risk prediction. The weight update process of the interference feature decay factor is synchronized with the fluctuation period of the static interference feature set. The longer the fluctuation period, the slower the change of the interference feature, and the lower the impact weight at the current time. The weight calculation uses an exponential decay function, and the decay coefficient is inversely proportional to the fluctuation period. The output layer calculates the risk probability value. The calculation process of the risk probability value is the matrix multiplication of the input layer feature vector and the hidden layer parameters modulated by the decay factor. The operation result is mapped to the probability space of zero to one through a logic function. The bidirectional feature coupling mechanism is realized in the forward propagation process of the model. The value of the static interference feature set is not used as a direct input feature, but as an adjustment parameter for modulating the bias of the hidden layer neurons. This makes the same set of dynamic input features produce different risk probability outputs under different static interference backgrounds.

[0063] The model training stage uses labeled historical risk event data, and the training data contains a large number of normal behavior samples and known risk behavior samples. The training process uses the error back propagation algorithm, and the loss function is defined as the cross entropy between the predicted risk probability value and the true label. The model parameter initialization uses random numbers subject to Gaussian distribution, and the number of training iterations is determined according to the performance early stopping strategy on the validation set. The trained dynamic risk prediction model has the ability to handle the cooperative influence of dynamic input feature set and static interference feature set. The model inference stage only needs a single forward propagation calculation to output the risk probability value. The operation of segmenting and intercepting the static interference feature set using a sliding time window is the basis for analyzing the time sequence pattern of the interference feature. The fixed length of the time window needs to consider the data acquisition frequency and the feature change speed. If the window length is too short, it cannot capture the complete fluctuation period, and if the window length is too long, it will introduce too much historical noise. The window length is set to cover hundreds of data sampling points, which is enough to include several typical fluctuation periods. The preset step size slides along the time axis to intercept the static interference feature subset, and the step size is set to be smaller than the window length to generate an overlapping window sequence. The overlapping area ensures smooth transition between consecutive windows to avoid sudden changes. The static interference feature subset intercepted by each window is a two-dimensional matrix, where the rows correspond to time points and the columns correspond to different static interference feature dimensions.

[0064] The frequency domain conversion is performed on each subset, and the fast Fourier transform algorithm is used to convert the feature sequence in the time domain to the frequency domain representation. The fast Fourier transform decomposes the time series into different frequency sine wave components, and the output is a complex number sequence, whose modulus represents the energy size of each frequency component. The peak value of the frequency energy distribution corresponds to the interference feature fluctuation period, and the peak detection algorithm scans the frequency energy spectrum to find the local maximum value point. The frequency components corresponding to these maximum value points are converted to time periods. The frequency of the feature value exceeding the historical mean value in each subset is counted, and the historical mean value is calculated based on the entire training data set, representing the long-term average level of the feature. The frequency counting process traverses each time point in the window and counts the number of times the feature value exceeds the historical mean value. The frequency distribution histogram is generated and marked as the interference feature frequency distribution rule. The horizontal axis of the histogram divides the frequency into several equal intervals, and the vertical axis records the number of feature dimensions in each interval. The frequency distribution rule is extracted from the morphological characteristics of the histogram, such as unimodal distribution, bimodal distribution, or uniform distribution, etc. Each mode corresponds to different interference feature behavior characteristics.

[0065] All feature subsets intercepted by the sliding time window constitute a time series sample library, and the sample library stores the analysis results of each window in chronological order. The window sliding process is continuous, and when new data points enter the system, the oldest data points are removed from the window to maintain the timeliness of the data in the window. The analysis results of each window include the interference feature fluctuation period and frequency distribution law, and these intermediate results are stored in the data structure for subsequent atlas generation. The window parameters such as length and step can be adjusted according to the actual application scene, and different parameter settings will affect the granularity of the fluctuation mode analysis. The window sliding mechanism enables the system to continuously track the evolution trend of the static interference feature set, providing a data basis for real-time state matching.

[0066] Embodiment 3: The generation process of the interference feature fluctuation atlas starts from the integration of the sliding time window analysis results, and the interference feature fluctuation period and frequency distribution law are spliced according to the time window order. The splicing operation combines the fluctuation period value and frequency distribution value corresponding to each time window into a feature vector, and the dimension of the feature vector is equal to the number of analyzed static interference feature types. The construction of the two-dimensional fluctuation time series matrix takes the time window number as the row index and the interference feature type as the column index, and each element in the matrix is filled with the fluctuation intensity quantization value of the corresponding window and feature type. The fluctuation intensity quantization value is obtained by comprehensively calculating the significance of the fluctuation period and the deviation degree of the frequency distribution, and the calculation process involves multi-index fusion of the feature sequence in the window.

[0067] Normalization processing is applied to the two-dimensional fluctuation time series matrix to eliminate dimensional differences. The normalization processing adopts the minimum-maximum scaling method to linearly transform each element value in the matrix to the [0, 1] interval. For any element value in the matrix , its normalized value is calculated by the following formula:

[0068]

[0069] Where: represents the original fluctuation intensity value of the jth interference feature in the ith time window, represents the minimum value of the fluctuation intensity value of the jth interference feature in all time windows, represents the maximum value of the fluctuation intensity value of the jth interference feature in all time windows, represents the normalized fluctuation intensity value. The normalized two-dimensional fluctuation time series matrix eliminates the bias caused by different original value ranges of different feature types, making the fluctuation intensity of different features comparable.

[0070] According to the normalization result, a heat map is drawn, the horizontal axis of the heat map is marked with consecutive time window numbers, and the vertical axis lists the names of all static interference feature types. The color scale of the heat map selects a gradient color mapping from cold to warm, with low fluctuation intensity values mapped to blue and high fluctuation intensity values mapped to red. Each pixel block of the heat map corresponds to a specific time window and a specific interference feature normalization fluctuation intensity value, and the color depth intuitively reflects the active degree change pattern of the interference feature at the historical time point. The generated interference feature fluctuation atlas is stored in image file format, while the corresponding normalization matrix data is retained for subsequent numerical calculation. The update mechanism of the interference feature fluctuation atlas is synchronized with the sliding of the sliding time window, and each time a new time window analysis is completed, the atlas is appended with the latest data point and re-rendered.

[0071] The interference feature state matching process at the current time point relies on the query and similarity calculation of the interference feature fluctuation atlas. The time window number to which the current time point belongs is obtained, and the calculation of the time window number is based on the arithmetic operation of the current system timestamp and the sliding window parameter. The calculation rule is to divide the current timestamp by the window step and take the integer part, and the result is the window serial number into which the current time point falls. The fluctuation intensity vector corresponding to the number is extracted from the interference feature fluctuation atlas, and the fluctuation intensity vector is a multidimensional vector whose components represent the normalized fluctuation intensity of each type of interference feature in the current time window. The cosine similarity between the fluctuation intensity vector and the historical window vector is calculated, and the historical window vector refers to the sequence of fluctuation intensity vectors corresponding to all historical time windows earlier than the current window in the interference feature fluctuation atlas.

[0072] The cosine similarity calculation measures the similarity of two vectors in direction, and its value range is [-1, 1], and the closer the value is to 1, the more consistent the direction of the two vectors. For the current fluctuation intensity vector and a certain historical fluctuation intensity vector , the cosine similarity The similarity score is calculated by the dot product of the two vectors and the length of the vectors. The highest similarity score is selected as the matching result, which is a specific historical time window number. The interference feature fluctuation pattern of this window is the closest to the current window. The interference feature state corresponding to the matching result is marked as the current interference feature state, which contains complete state information such as the interference feature fluctuation period and frequency distribution extracted from the matched historical window. After the state matching process is completed, the current interference feature state is packaged into a data structure and input into the hidden layer of the dynamic risk prediction model. The history of the matching operation is saved to track the long-term trend of the matching pattern and evaluate the effectiveness of the matching algorithm. The design of the entire matching process aims to find the most similar interference feature background from the historical data to provide more accurate context information for risk prediction. The maintenance of the interference feature fluctuation atlas includes regular archiving of historical data and controlling the data size of the atlas to ensure that the query efficiency does not decrease over time. The performance optimization of the matching algorithm can be achieved by establishing an index structure for the fluctuation vector, such as using a spatial partition tree to accelerate the nearest neighbor search process. The accuracy of the current interference feature state can be indirectly evaluated by comparing its prediction effect with the occurrence of real risk events.

[0073] In Embodiment 4, the risk probability value output by the dynamic risk prediction model is combined with the current interference feature state to generate a real-time risk warning signal. The current interference feature state is input into the hidden layer of the dynamic risk prediction model, and the hidden layer adjustment parameters are updated according to the fluctuation period and frequency distribution data contained in the current interference feature state. The update operation modifies the bias weight of the hidden layer neurons, and the adjustment amplitude of the bias weight is proportional to the fluctuation intensity of the current interference feature state. The risk probability value is recalculated according to the updated model parameters. The recalculation process performs a complete forward propagation, and the values of the dynamic input features are transmitted through the input layer, processed by the adjusted hidden layer, and finally produce a new risk probability value in the output layer. When the risk probability value exceeds the dynamic threshold, a warning signal is triggered. The triggering condition of the warning signal is a Boolean logic judgment, which compares the real-time calculated risk probability value with the value of the dynamic threshold. The dynamic threshold is determined by the sliding average of the historical risk probability value and the fluctuation intensity of the current interference feature state. The adaptive mechanism of the dynamic threshold enables the warning system to maintain stable performance under different interference backgrounds.

[0074] The determination process of the dynamic threshold includes historical data statistics and real-time parameter adjustment. The risk probability value sequence of the last N time windows is taken, and the value of the number N of time windows affects the response speed of the threshold to recent trends. The smaller the value of N, the more sensitive the threshold is to the change of risk probability. The risk probability value sequence is retrieved in chronological order from the model output log, and the sequence data contains all risk probability values output by the model in the last N continuous time windows. The exponentially weighted moving average of the sequence data is calculated as the baseline threshold. The exponentially weighted moving average calculation gives more weight to recent data, and the weight decay factor λ controls the decay speed of historical data. The baseline threshold represents the average level of risk probability in the recent window and is the basis value for calculating the dynamic threshold. The baseline threshold is adjusted according to the fluctuation intensity of the current interference feature state. The fluctuation intensity is directly read from the current interference feature state data, and the fluctuation intensity is a normalized scalar value. The baseline threshold is adjusted by a fixed percentage for every increase of a preset unit in the fluctuation intensity. The preset unit is set to 0.1, and the fixed percentage is set to 5% of the baseline threshold. The adjusted baseline threshold is used as the dynamic threshold at the current time point. The dynamic threshold is calculated immediately after the completion of the risk probability comparison judgment. For specific parameter configuration of the dynamic threshold adjustment process, refer to Table 1.

[0075] Table 1: Dynamic threshold adjustment parameter configuration

[0076] Parameter name Parameter symbol Value Parameter description Number of time windows N 20 Number of consecutive time windows used to calculate the reference threshold Weight decay factor λ 0.3 Weight coefficient of recent data in the exponentially weighted moving average calculation Unit of volatility intensity ΔI 0.1 Basic adjustment unit of volatility intensity Threshold reduction ratio η 5% Reduction ratio of the reference threshold per unit of volatility intensity increase Minimum threshold lower limit [TECHNICAL FIELD] min ]] 0.2 Minimum numerical lower limit of the dynamic threshold allowed setting

[0077] The processing flow after the warning signal is triggered includes signal generation and transmission. The content structure of the warning signal includes signal type, trigger timestamp, risk level assessment, and associated feature summary. The signal type distinguishes between instantaneous warning and continuous warning. The instantaneous warning is for a single threshold crossing event, and the continuous warning is for multiple consecutive time windows of threshold crossing. The risk level assessment is divided according to the amplitude of the risk probability value exceeding the dynamic threshold. The greater the exceeding amplitude, the higher the risk level. The associated feature summary records the key feature values in the dynamic input feature set and the static interference feature set when the warning is triggered. These feature values are helpful for subsequent analysis of the cause of the warning. The warning signal is transmitted to the user interface layer and the decision module through the message queue mechanism of the mobile terminal device. The message queue ensures the reliability and sequence of signal transmission. The user interface layer presents visual or auditory alerts to the user according to the preset display strategy after receiving the warning signal, and the decision module may trigger automatic protection measures such as temporary restriction of certain sensitive operations.

[0078] The generation frequency of real-time risk warning signals is consistent with the calculation period of the dynamic risk prediction model. A complete risk assessment and warning check process is performed at the end of each time window. The warning history data is stored persistently, and the storage format includes complete context information for subsequent audit and analysis. The false alarm filtering mechanism of the warning signal is realized by comparing the warning states of consecutive time windows. Isolated single threshold exceeding may be marked as an observed state rather than triggering an active warning immediately. The sensitivity of the warning system can be calibrated by adjusting the parameters in the dynamic threshold calculation, adapting to different application scenarios and safety requirements. The warning response time is a key performance indicator. The entire processing flow from data collection to warning signal generation needs to be completed within the specified time delay, ensuring the real-time identification and response of risks. The expiration date management of the warning signal ensures that the expired warning state can be cleared in time to avoid unnecessary alert state of the system. The warning feedback mechanism allows users to evaluate the accuracy of the warning, and these evaluation data are used to optimize the dynamic threshold algorithm and model parameters.

[0079] In embodiment 5, the dynamic input feature set and the static interference feature set snapshot record operation are started immediately when the warning signal is triggered. The dynamic input feature set snapshot captures the instantaneous state of all active user operation behavior sequences at the current time point, including but not limited to the list of running applications, the coordinate sequence of the current screen touch trajectory, the network request type and target address in the last minute. The static interference feature set snapshot records the real-time readings of device hardware state change records and environmental parameter change trajectories, such as the current value of the battery temperature, the instantaneous load percentage of each CPU core, the available memory capacity, the GPS positioning coordinates, the ambient light sensor value, and the list of all Wi-Fi signal strengths scanned. Snapshot data is stored in a structured binary format, and each snapshot file contains a fixed-length file header that writes the snapshot generation timestamp, mobile terminal device unique identifier, snapshot version number, and data checksum. The body part of the snapshot file stores various feature values in the order of predetermined fields. Numerical features use fixed-point number format to save storage space, and categorical features use dictionary encoding compression storage.

[0080] The historical early warning case library is a pre-constructed risk event database. Each record of the historical early warning case library contains complete feature snapshot data, risk event label, disposal strategy code and disposal result feedback. The construction of the case library is completed by collecting historical safety event data. Each case represents a confirmed risk scenario and its response plan. The case data comes from multiple channels, including verified threat events reported by mobile terminal devices, attack test data simulated by security laboratories, and security event records of real users after desensitization. Snapshot data is matched with the historical early warning case library. The matching algorithm combines all feature values of the current snapshot into a high-dimensional feature vector, and each case in the historical early warning case library is also represented as a feature vector of the same dimension. The feature matching process calculates the Euclidean distance between the current snapshot feature vector and each historical case feature vector. The smaller the distance value, the higher the similarity of the two feature vectors. The highest matching degree of the historical case number is output. The matching degree is calculated by the reciprocal of the distance value. The conversion formula ensures that the matching degree value domain is between zero and one. Different feature dimensions are weighted during the matching degree calculation process. The weighting coefficient is dynamically adjusted according to the importance of the feature in the historical risk identification. Important features are given higher weights to improve matching accuracy.

[0081] The historical case number calls the corresponding treatment strategy, and the treatment strategy is stored in the form of executable scripts in the strategy library. The strategy library adopts version management, and each treatment strategy corresponds to a unique strategy identifier and version number. The content of the treatment strategy is designed according to the risk type and severity, including but not limited to process termination instructions, network connection blocking rules, user authentication enhancement requirements, system setting modification commands and security scanning trigger conditions. The treatment strategy is loaded into the execution queue of the mobile terminal device, and the execution queue is a priority task scheduling system, and the high-risk treatment strategy is executed first. The execution queue management module monitors the strategy execution state, records the execution log for the successfully executed strategy, and starts the retry mechanism or the degradation scheme for the failed strategy. The interaction channel with the user is maintained during the strategy execution process, and the user needs to confirm before the major treatment action can be executed, so as to avoid the decline of user experience caused by excessive automation. The specific example is as follows: assuming that a mobile terminal device triggers an early warning signal at 10:05:23 am, at this time, the dynamic input feature set snapshot records that the user is frequently switching between bank applications and social applications, the screen touch track presents an abnormal fast sliding mode, and the network request frequency is significantly higher than the daily level and the target address involves multiple overseas IPs. The static interference feature set snapshot shows that the device battery temperature is at a high level of 45 degrees Celsius, the CPU load is continuously over 80%, the available memory space is less than 100MB, the device is located in an unusual activity area, and the surrounding Wi-Fi signal strength fluctuates dramatically. The system immediately combines these snapshot data into a feature vector, and calculates the similarity with the 500 known risk cases in the historical early warning case library. After processing by the matching algorithm, it is found that the current features have a similarity of 0.93 with case number CASE-2023-0478, which records a similar phishing attack event that occurred last year. The system automatically calls the treatment strategy associated with case number CASE-2023-0478, and the strategy content includes immediately terminating suspicious network connections, forcing the use of two-factor authentication, and popping up a security warning window to prompt the user of the current risk. These treatment strategies are loaded into the high priority position of the execution queue and start to be executed in sequence within 200 milliseconds. During the execution process, the system continuously monitors the strategy execution effect, and if it is detected that the user's normal operation is excessively blocked, the strategy strength is automatically adjusted or manual intervention is requested.

[0082] The processing flow after the early warning signal trigger contains a complete closed-loop management mechanism, and each processing link generates detailed operation logs. The operation logs record snapshot data storage paths, input and output parameters of feature matching calculation, treatment policy loading time and execution result status code. Log data is used for subsequent analysis of the accuracy and timeliness of early warning processing, supporting continuous optimization of the system. The update mechanism of the case library allows the inclusion of newly confirmed risk events and their treatment experience, ensuring that the system can respond to new threats. The dynamic loading mechanism of the treatment policy supports remote updates, and the security team can deploy new protection strategies in a timely manner without the need for terminal application version upgrades. The entire processing flow design takes into account the resource constraints of mobile terminal devices, snapshot data uses differential compression technology to reduce storage occupancy, feature matching algorithms optimize computational complexity to control energy consumption, and the strategy execution introduces a timeout interrupt mechanism to prevent resource deadlock. In the multi-terminal collaborative scenario, the early warning processing results of a single device can be safely shared to other devices under the same user account, forming a joint defense and control security protection system.

[0083] It should be noted that, in this text, relational terms such as first and second are used only to distinguish one entity or operation from another, and do not necessarily require or imply there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device.

[0084] Although embodiments of the present application have been shown and described, it will be understood by those having ordinary skill in the art that various changes, modifications, alternatives and variations can be made thereto without departing from the principles and spirit of the application, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A risk prediction method based on a mobile terminal device, characterized by, The method comprises the following steps: acquiring a historical behavior data set of a mobile terminal device, the historical behavior data set containing a user operation behavior sequence, a device state change record, and an environment parameter change trajectory; dividing a dynamic input feature set and a static interference feature set according to the historical behavior data set, the dynamic input feature set being composed of a real-time updated user operation behavior sequence, and the static interference feature set being generated by fusing the device state change record and the environment parameter change trajectory; establishing a dynamic risk prediction model, taking the dynamic input feature set as an input layer of the model, taking the static interference feature set as an adjustment parameter of a hidden layer of the model, and outputting a risk probability value through a bidirectional feature coupling mechanism; adopting a sliding time window to segmentally intercept the static interference feature set, extracting fluctuation periods and frequency distribution rules of interference features in each time window, and generating an interference feature fluctuation spectrum; matching an interference feature state at a current time point based on the interference feature fluctuation spectrum, and generating a real-time risk warning signal in combination with the risk probability value output by the dynamic risk prediction model; the establishing of the dynamic risk prediction model comprises: constructing a neural network architecture containing an input layer, a hidden layer, and an output layer, the number of nodes of the input layer being consistent with the dimension of the dynamic input feature set, and the number of nodes of the hidden layer being dynamically adjusted according to the dimension of the static interference feature set; embedding an interference feature attenuation factor in the hidden layer, the interference feature attenuation factor being adaptively updated in weight according to the fluctuation period of the static interference feature set; calculating a risk probability value through the output layer, the risk probability value being a nonlinear combination result of input layer features and hidden layer adjustment parameters.

2. The mobile terminal device based risk prediction method of claim 1, wherein, the acquiring of the historical behavior data set of the mobile terminal device specifically comprises: extracting a user operation behavior sequence from a device local log, the user operation behavior sequence containing an application startup duration, a screen touch trajectory, and a network request frequency; collecting a device hardware state change record, the device hardware state change record including a battery temperature fluctuation curve, a CPU load peak value, and a memory occupancy rate change interval; acquiring an environment parameter change trajectory through a sensor interface, the environment parameter change trajectory covering a geographic position offset, an ambient light intensity gradient, and a surrounding wireless signal strength matrix. 3.The mobile terminal device based risk prediction method of claim 2, wherein, the dividing of the dynamic input feature set and the static interference feature set according to the historical behavior data set comprises: performing timestamp alignment processing on the user operation behavior sequence, eliminating operation behavior segments corresponding to abnormal timestamps, and combining continuous operation behavior segments into the dynamic input feature set; superimposing the device hardware state change record and the environment parameter change trajectory according to a time dimension, calculating a mean-to-variance ratio of superimposed features, and screening features with a variance ratio lower than a threshold value to form the static interference feature set. 4.The mobile terminal device based risk prediction method of claim 1, wherein, the segmentally intercepting of the static interference feature set by adopting the sliding time window comprises: setting a time window of a fixed length, and segmentally intercepting a static interference feature subset along a time axis at a preset step length; performing frequency domain conversion on each subset, extracting a period corresponding to a frequency energy distribution peak value as an interference feature fluctuation period; counting a frequency of a feature value exceeding a historical mean value in each subset, generating a frequency distribution histogram, and marking the frequency distribution histogram as an interference feature frequency distribution rule. 5.The mobile terminal device based risk prediction method of claim 4, wherein, the generating of the interference feature fluctuation spectrum comprises: The interference characteristic fluctuation period and frequency distribution law are spliced in sequence according to the time window to form a two-dimensional fluctuation time sequence matrix; The two-dimensional fluctuation time sequence matrix is normalized to eliminate the dimensional differences of different characteristic dimensions; According to the normalization result, a heat map is drawn, the horizontal axis of the heat map is the time window number, the vertical axis is the interference characteristic type, and the color scale represents the fluctuation intensity. 6.The mobile terminal device based risk prediction method of claim 5, wherein, The interference characteristic state matching the current time point based on the interference characteristic fluctuation spectrum includes: Obtain the time window number to which the current time point belongs, and extract the fluctuation intensity vector corresponding to the number from the interference characteristic fluctuation spectrum; Calculate the cosine similarity of the fluctuation intensity vector and the historical window vector, and select the historical window with the highest similarity as the matching result; Mark the interference characteristic state corresponding to the matching result as the current interference characteristic state. 7.The mobile terminal device based risk prediction method of claim 6, wherein, The risk probability value output by the dynamic risk prediction model is combined to generate a real-time risk warning signal, including: Input the current interference characteristic state into the hidden layer of the dynamic risk prediction model to update the hidden layer adjustment parameters; Recalculate the risk probability value according to the updated model parameters, and trigger the warning signal when the risk probability value exceeds the dynamic threshold value; The dynamic threshold value is determined by the sliding average value of the historical risk probability value and the fluctuation intensity of the current interference characteristic state. 8.The mobile terminal device based risk prediction method of claim 7, wherein, The determination process of the dynamic threshold value includes: Take the risk probability value sequence of the last N time windows, and calculate the exponential weighted moving average value as the baseline threshold value; Adjust the baseline threshold value according to the fluctuation intensity of the current interference characteristic state, and the baseline threshold value decreases by a fixed proportion for every increase of the preset unit of the fluctuation intensity; The adjusted baseline threshold value is used as the dynamic threshold value of the current time point. 9.The mobile terminal device based risk prediction method of claim 8, wherein, The processing after triggering the warning signal includes: Record the dynamic input feature set and static interference feature set snapshot at the moment when the warning signal is triggered; Match the snapshot data with the historical warning case library to output the historical case number with the highest matching degree; According to the historical case number, the corresponding disposal strategy is called and loaded into the execution queue of the mobile terminal device.

Images