A remote screen locking control method and system

Abstract

The application discloses a remote lock screen control method and system, and belongs to the technical field of communication. The method comprises the following steps: collecting historical behavior data, modeling to obtain a bidirectional GRU task behavior model, collecting real-time behavior data, generating a real-time behavior sequence according to a time sequence, constructing a behavior deviation function to identify the deviation of the real-time behavior sequence, outputting a behavior deviation score, inputting a multi-modal signal into a perception fusion model, outputting a physical environment abnormality score, constructing a lock screen scoring function, generating a lock screen score, outputting different lock screen control instructions according to a preset rule, converting the lock screen control instructions into terminal behaviors, and recording a control behavior generation system log. The scheme realizes the linkage optimization of structure-level identification, state-level triggering, path-level pushing and terminal-level feedback of formula change without introducing complex model calculation and system reconstruction.

Description

Technical Field

[0001] This invention belongs to the field of communication technology, and in particular relates to a remote screen lock control method and system. Background Technology

[0002] Existing remote screen lock control methods are mostly based on simple rules or single-dimensional detection, such as locking the screen after idle timeout or manual control by the administrator. Their core flaw lies in the lack of comprehensive anomaly identification capabilities based on user behavior and the physical environment, leading to a high rate of false positives. Specifically, traditional solutions cannot accurately identify whether the user's operation sequence deviates from the standard task path, nor can they verify whether there are signs of unauthorized manipulation such as obstruction or disguise in the terminal's physical environment. When behavioral anomalies and environmental judgments are inconsistent, the system lacks a reasonable fusion and trade-off mechanism, easily affecting terminal security and user experience due to false or missed locks. Therefore, there is an urgent need for a remote screen lock control solution that can accurately judge based on a comprehensive analysis of behavioral deviations and physical environment anomalies.

[0003] Therefore, we propose a remote screen lock control method and system to solve the above problems. Summary of the Invention

[0004] The purpose of this invention is to solve the problem of difficulty in quickly adapting to changing needs in the prior art, and to propose a remote screen lock control method and system.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A remote screen lock control method includes:

[0007] S1: Collect historical behavior data, which is obtained through operating system logs, front-end application logs, and control platform agent service logs; capture event data from the control platform agent service logs, and generate a historical behavior sequence based on the event data in chronological order;

[0008] A bidirectional GRU task behavior model is obtained by modeling the historical behavior sequence using a bidirectional GRU network; the output of the bidirectional GRU task behavior model to the historical behavior sequence is a state vector sequence; the state vector sequence represents the semantic encoding result of the bidirectional GRU task behavior model for each time step in the historical behavior sequence.

[0009] S2: Collect real-time behavioral data and generate real-time behavioral sequences based on time order;

[0010] The real-time behavior sequence is encoded using the bidirectional GRU task behavior model to obtain a real-time state vector sequence; a behavior deviation function is constructed to identify deviations in the real-time behavior sequence and output a behavior deviation score.

[0011] S3: When the behavioral deviation score exceeds the preset threshold, activate the multimodal perception system to collect multimodal signals;

[0012] The multimodal signals are input into the perception fusion model, which outputs a physical environment anomaly score.

[0013] When the physical environment anomaly score is higher than a preset threshold, an anomaly flag is output; otherwise, a normal flag is output.

[0014] S4: Construct a lock screen scoring function, which is obtained based on the behavioral deviation score and the physical environment anomaly score;

[0015] Generate a lock screen score and output different lock screen control commands for different lock screen scores according to preset rules;

[0016] S5: Convert the screen lock control command into terminal behavior and record the control behavior to generate a system log, which includes the terminal execution result and feedback time.

[0017] Preferably, the bidirectional GRU task behavior model structure includes two layers: the first layer is an embedding layer, which encodes discrete operation events into 128-dimensional vectors using a lookup table method; the second layer is a bidirectional GRU network with the hidden state dimension set to 64.

[0018] Preferably, the behavior bias function also incorporates task stage weights and abnormal behavior weights; the task stage weights are obtained through pre-training using an attention mechanism; and the abnormal behavior weights are calculated by monitoring the rate of change between adjacent states.

[0019] Preferably, the multimodal signal includes image, audio, heat source, and distance data; the image data is acquired by the terminal camera and used to extract facial, limb, and gaze direction features; the audio data is input by the local microphone and converted into a spectrum through short-time Fourier transform; the heat source data comes from an infrared thermal imager or a TOF ranging sensor and is used to determine whether there is a person present in the operating area or whether there is a disguised object.

[0020] Preferably, the perceptual fusion model is based on a multimodal convolutional perceptual network, which consists of three modal branches. Each branch contains two layers of convolution, normalization and activation operations, and the final result is output after being concatenated and passed through a fully connected layer.

[0021] Preferably, the perception fusion model introduces an image-heat source spatial conflict coefficient, which is a difference factor obtained by spatially aligning the salient regions in the image with the high-temperature regions in the heat source image.

[0022] Preferred, the preset rules are:

[0023] When the lock screen score is higher than a preset threshold, it is judged as a high-risk interaction behavior, and the screen is locked immediately.

[0024] If the lock screen score is lower than or equal to a preset threshold, the process will continue.

[0025] A remote screen lock control system includes:

[0026] The behavior model module is configured to collect historical behavior data, which is obtained through operating system logs, front-end application logs, and control platform agent service logs. Event data is captured from the control platform agent service logs, and the event data is used to generate a historical behavior sequence according to time order. The historical behavior sequence is modeled using a bidirectional GRU network to obtain a bidirectional GRU task behavior model. The output of the bidirectional GRU task behavior model to the historical behavior sequence is a state vector sequence, which represents the semantic encoding result of the bidirectional GRU task behavior model for each time step in the historical behavior sequence.

[0027] An anomaly detection module is configured to collect real-time behavior data and generate a real-time behavior sequence based on time sequence; encode the real-time behavior sequence using the bidirectional GRU task behavior model to obtain a real-time state vector sequence; construct a behavior deviation function to identify deviations in the real-time behavior sequence and output a behavior deviation score.

[0028] An environment verification module is configured to activate a multimodal perception system to collect multimodal signals when the behavior deviation score exceeds a preset threshold; input the multimodal signals into a perception fusion model and output a physical environment anomaly score; output an anomaly label when the physical environment anomaly score is higher than a preset threshold; otherwise, output a normal label.

[0029] The decision generation module is configured to construct a lock screen scoring function, which is based on the behavior deviation score and the physical environment anomaly score; generate lock screen scores and output different lock screen control commands for different lock screen scores according to preset rules;

[0030] An execution recording module is configured to convert the screen lock control command into terminal behavior and record the control behavior to generate a system log, which includes the terminal execution result and feedback time.

[0031] In summary, the technical effects and advantages of this invention are as follows: This solution models historical behavior sequences using a bidirectional GRU network, generates a state vector sequence, and constructs a behavior deviation function by combining task stage weights and local mutation identification terms. This enables accurate identification of structural anomalies in the user's operation process, avoiding misjudgments caused by short-term misoperations or task adjustments. Under the triggering conditions of behavioral anomalies, a multimodal perception system including image, audio, heat source, and distance is activated. By combining the perception fusion model with the image-heat source spatial conflict coefficient, it effectively identifies physical environment risks such as unmanned operation, occlusion and camouflage, and video playback, thereby improving the ability to prevent unauthorized access. Attached Figure Description

[0032] Figure 1 This is a flowchart of the method steps in this invention;

[0033] Figure 2 This is a schematic diagram of the system structure in this invention. Detailed Implementation

[0034] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0035] like Figure 1 As shown, a remote screen lock control method includes:

[0036] S1: Collect historical behavior data, which is obtained through operating system logs, front-end application logs, and control platform agent service logs; capture event data from the control platform agent service logs, and generate a historical behavior sequence based on the event data in chronological order;

[0037] A bidirectional GRU task behavior model is obtained by modeling the historical behavior sequence using a bidirectional GRU network; the output of the bidirectional GRU task behavior model to the historical behavior sequence is a state vector sequence; the state vector sequence represents the semantic encoding result of the bidirectional GRU task behavior model for each time step in the historical behavior sequence.

[0038] S2: Collect real-time behavioral data and generate real-time behavioral sequences based on time order;

[0039] The real-time behavior sequence is encoded using the bidirectional GRU task behavior model to obtain a real-time state vector sequence; a behavior deviation function is constructed to identify deviations in the real-time behavior sequence and output a behavior deviation score.

[0040] S3: When the behavioral deviation score exceeds the preset threshold, activate the multimodal perception system to collect multimodal signals;

[0041] The multimodal signals are input into the perception fusion model, which outputs a physical environment anomaly score.

[0042] When the physical environment anomaly score is higher than a preset threshold, an anomaly flag is output; otherwise, a normal flag is output.

[0043] S4: Construct a lock screen scoring function, which is obtained based on the behavioral deviation score and the physical environment anomaly score;

[0044] Generate a lock screen score and output different lock screen control commands for different lock screen scores according to preset rules;

[0045] S5: Convert the screen lock control command into terminal behavior and record the control behavior to generate a system log, which includes the terminal execution result and feedback time.

[0046] The specific steps are as follows:

[0047] Step 1: Building a Standard Task Behavior Model

[0048] This step aims to build a standard operational behavior model that can cover typical business task processes. This is to capture the behavioral path under "normal use" and use it as a baseline for determining behavioral deviations in subsequent steps.

[0049] First, historical behavior data is collected. In practice, user operation records on the terminal can be obtained through the following three system-level interfaces:

[0050] Operating system logs (such as Windows system logs or Linux's audiotd module) record window switching, process calls, input events, etc.

[0051] Front-end application logs (such as user behavior logs from browsers, educational software, or office systems) are used to supplement events related to operational intent;

[0052] The control platform agent service captures event data and synchronously reports it to the platform-side data center through injection or daemon processes.

[0053] All events are arranged in chronological order to generate an event sequence:

[0054]

[0055] Historical behavior sequence, representing a sequence of operation events ordered by time;

[0056] : No. Each operation event is collected from the operating system or application logs, such as "clicking a button" or "opening a window".

[0057] :event The corresponding system timestamp is collected from the terminal clock service.

[0058] To standardize the modeling input, all events are encoded as discrete categories and then mapped to fixed-dimensional vectors to form an input sequence for subsequent modeling. A bidirectional GRU network is used to model this behavior sequence. The model structure consists of two layers: the first layer is an embedding layer that encodes discrete operation events into 128-dimensional vectors using a lookup table; the second layer is a bidirectional GRU network with a hidden state dimension of 64. The model training objective is to predict the next operation event, optimized by minimizing the cross-entropy loss function.

[0059]

[0060] The training loss function of the GRU network is used to measure the accuracy of the current model's prediction of the next event.

[0061] Time step The actual operation event tags;

[0062] : Model input before Each operation event serves as the sequence context;

[0063] The conditional probability distribution predicted by the GRU model;

[0064] The bidirectional GRU model structure includes an event embedding layer and a sequence modeling layer, and will be used as a standard task behavior model in the future.

[0065] In practical modeling, to enhance the versatility and structural expressiveness of the behavioral model, the system employs a sliding window mechanism to construct multiple behavioral sub-sequence samples, adapting to task operations of varying durations. Simultaneously, by aggregating similar task data from multiple terminals, common path structures are extracted to support cross-user and cross-role behavioral modeling. For example, in a government office system, a common standard operation is "open document → edit → insert attachment → save → submit for approval." The system models this behavioral path through hundreds of samples to obtain its high-frequency patterns and behavioral sequences.

[0066] After the model training is complete, store the model structure and parameters as follows: The model is periodically deployed to various terminals by the platform. The model processes the input behavior sequence. The output is a sequence of state vectors:

[0067]

[0068] : A sequence of state vectors, representing the semantic encoding result of the model for each time step in the action sequence;

[0069] : GRU network at time step The hidden state output represents the operation context information up to this step.

[0070] These state vectors will be used in the next step to calculate the degree of deviation between the current behavior and the standard behavior.

[0071] This step outputs two core variables:

[0072] : A bidirectional GRU task behavior model trained on the platform;

[0073] This model analyzes historical behavioral sequences. The generated state vector sequence will be used as a reference standard for judging behavioral deviations.

[0074] Step 2: Real-time behavior acquisition and anomaly identification:

[0075] The core task of this step is to perform real-time behavior monitoring on the terminal or at the platform edge, capture operation sequences, and base them on the aforementioned model. The system identifies whether there are significant deviations in the behavior. Real-time collection of behavior sequences still relies on system-level log capture interfaces and front-end event streams from the business system, continuously recording user operations by timestamp to form the current operation sequence. . Indicates real-time operation events. This is the system time. The data structure collected is consistent with that in step 1 to ensure consistency of model input.

[0076] By deploying on terminals or edge nodes Model pair Encode to generate a sequence of state vectors. . Compared with standard behavioral state vector sequence It is a vector stream with consistent structure, which can be used for temporal structure comparison.

[0077] To more accurately measure behavioral deviations, instead of directly using common methods such as Euclidean distance or DTW, we designed a weighted deviation function based on the needs of remote screen locking scenarios, incorporating a task-phase sensitivity term and an abnormal behavior location weight term. The function is defined as follows:

[0078]

[0079] Behavioral deviation score is the main criterion for determining whether the current behavior "deviates from the task";

[0080] , : These are the first and second behaviors of the standard behavior and the current behavior, respectively. A time-series state vector;

[0081] Task phase weights, derived from The task sensitivity score at each time step can be obtained through pre-training with an attention mechanism; the higher the value, the more critical the step is.

[0082] : No. State vector difference at each time step;

[0083] : Represents the most abnormal state jump value in the current behavior (e.g., a sudden change in state, representing a behavior jump), calculated by monitoring the rate of change between adjacent states;

[0084] : Regularization coefficient, used to control whether to pay attention to the impact of local mutation behavior.

[0085] The design of this deviation function creatively introduces two core mechanisms:

[0086] Task Stage Sensitivity: Different task steps have varying degrees of importance. For example, the "document editing" stage and the "sending for approval" stage have different levels of security risk in government systems. The model captures the structural weights of the task stages; the closer to the critical steps, the higher the weight of the bias.

[0087] Local mutation identification item Traditional behavioral bias measurement methods struggle to detect sudden illegal operations (such as rapidly clicking multiple sensitive controls within a short period). This item is used to explicitly detect drastic state jumps in a sequence, preventing short-term malicious behavior from being masked by the "mean".

[0088] For example, in government office scenarios, the normal workflow is "write document → insert attachment → save locally → upload to official document system". However, if users skip "save locally" and send directly, or insert non-task-related browser actions between operations, these deviations will be... Accurately capture and boost weights.

[0089] Behavioral Deviation Score The numerical value will serve as input for subsequent risk level assessment. This design allows each terminal to perform vector comparison calculations locally in real time, without relying on a high-power computing center, thus adapting to semi-offline or edge deployment environments such as traffic control centers and military data centers.

[0090] This step outputs a variable:

[0091] The behavioral deviation score, which is weighted by task stage and has the ability to detect local anomalies, is used to measure the degree of structural and semantic difference between the current behavior and the standard behavior, and is subsequently used to determine whether a high-risk state has been entered.

[0092] Step 3: Physical environment verification based on behavioral anomalies:

[0093] The input for this step is the behavioral deviation score output from the previous step. Its value reflects the current user operation sequence and the standard task behavior model. The degree of semantic structural deviation between them. This value is calculated by the terminal or edge device based on the task stage weights and behavioral mutation factors, and is a quantifiable prior risk assessment indicator. In this step, This will be used to dynamically trigger the physical environment verification process, only when it exceeds the task threshold issued by the platform. Only then will the system further determine whether the terminal is in a physically abnormal usage state, thereby saving computing resources and avoiding redundant interference to users.

[0094] Current behavioral bias Exceeding the task threshold This indicates that the user's current operation may deviate from the standard procedure, but the deviation itself may be caused by various factors, such as the user adjusting the path, network latency, or temporary task interruption, which do not necessarily constitute a security risk. Therefore, this step introduces a mechanism based on "physical scene signal fusion judgment" to confirm whether the current operation on the terminal is indeed performed by the authorized user and whether there are security risks such as substitution by others, remote control, or idle operation.

[0095] The system in Once the conditions are met, the terminal's multimodal sensing subsystem is activated to collect on-site status data, including images, audio, heat source data, and distance data. Among these, the image stream... Captured by the terminal camera, used to extract features such as facial features, limb features, and gaze direction; audio signals. Input from a local microphone is converted into a spectrum using a short-time Fourier transform; heat source data It comes from an infrared thermal imager or a TOF ranging sensor, used to determine whether there are people or disguised objects in the operating area.

[0096] The acquired multimodal signals are input into the perceptual fusion model. Output physical environment anomaly score Considering the need to prevent false control and obstruction behaviors in scenarios such as government systems, teaching control platforms, and military remote terminals, this invention introduces an innovative item. This is used to model the degree of regional conflict between salient targets in an image and the distribution of heat sources, in order to identify pseudo-interaction scenarios where "the image is visible but the person is not present." The complete formula is as follows:

[0097]

[0098] Final physical anomaly score, ranging from ;

[0099] The basic multimodal convolutional perceptual network consists of three modal branches (image, audio, and heat source). Each branch contains two layers of convolution, normalization, and activation operations. Finally, the concatenation is passed through a fully connected layer to output the main anomaly score.

[0100] Image-heat source spatial conflict coefficient; the larger the value, the less heat source support the target area of ​​the image.

[0101] : Voice activity factor, the larger the value, the more real voice activity is present in the scene;

[0102] Conflict detection weight, a platform preset value, for example, 0.4;

[0103] Voice compensation weight, for example, 0.2.

[0104] in, The difference factor is obtained by spatially aligning the salient regions in the image with the high-temperature regions in the heat source image (e.g., by calculating IoU), and its expression is:

[0105]

[0106] : The salient region in an image defined by saliency detection or face recognition;

[0107] High-heat areas in the heat source map (temperatures above the dynamic threshold) );

[0108] , : These represent the intersection and union operations of regions, respectively.

[0109] The introduction of this feature addresses the typical risks of "obstructing cameras" or "playing recorded videos to simulate presence" in real-world use cases, and is particularly suitable for high-security application scenarios such as military computer room control terminals and remote education examination equipment.

[0110] Simultaneously introduce negative terms As a compensation for false alarms, it addresses the issue of users being misjudged as abnormal when they are present but have no obvious actions. It demonstrates good adaptability, especially in environments requiring static operation, such as conference systems and classroom lectures. This component outputs a speech activity score from a speech activity segment detection model (such as VAD) within the last second.

[0111] Ultimately, when When the value is 0.65, the system will consider the current physical environment to be abnormal and output... Otherwise, the physical environment is deemed reliable, and the output is... This step outputs a boolean variable:

[0112] : Physical environment status flag, 1 indicates the current terminal is in an abnormal environment (no one present, obstructed operation, fake scene, etc.), 0 indicates verification passed. This variable will be used in the next step. Joint decision on whether to trigger remote screen locking.

[0113] Step 4: Multi-dimensional Fusion Judgment and Lock Screen Control Decision Generation: The goal of this step is to fuse the judgment results from two dimensions—behavioral risk and environmental risk—to generate a control command to determine whether to execute remote screen locking. Considering the phase sensitivity and diverse local environments of critical business terminals in government, transportation, and military sectors, simple "threshold judgment" or "single-factor triggering" cannot be used. Therefore, this step employs a multi-factor fusion strategy, combining the current task operation status and the consistency of behavior with the environment, to construct a risk-weighted screen lock scoring function, ultimately generating Boolean-type screen lock control instructions based on the scoring results.

[0114] Lock screen rating The definition is as follows:

[0115]

[0116] Lock screen rating, in the range of real numbers;

[0117] User's current behavior deviation score (from step 2), the larger the score, the greater the deviation;

[0118] Physical environment anomaly flag (from step 3): 1 indicates a problem with the physical environment, 0 indicates verification passed;

[0119] Risk fusion weight reflects the current system strategy's bias towards behavioral or physical risks. It can be dynamically configured according to business type, such as setting it to 0.8 for approval systems and 0.4 for display systems.

[0120] Risk consistency penalty factor, used to penalize inconsistent situations such as "abnormal behavior but normal physical condition" or the opposite.

[0121] This reflects the degree of difference between the behavior and the physical judgment result; the larger the value, the more contradictory the two judgments are.

[0122] when Exceeding the set threshold (Typically 0.6), the system determines the current behavior as "high-risk interaction" and generates a screen lock control command:

[0123]

[0124] : Screen lock control command, 1 indicates immediate screen lock, 0 indicates continue running.

[0125] The key innovation of this strategy lies in:

[0126] Unify the modeling of behavior and environment judgments, and do not use static priority strategies of "behavior-based" or "physical-based".

[0127] Introducing a consistency penalty term actively suppresses the situation of "judgment dimension splitting" and reduces false locking or missed locking;

[0128] It can be configured and It enables dynamic policy adaptation at the platform level, supporting fine-grained permission hierarchies and policy customization.

[0129] For example: A user is processing documents on a government affairs terminal, and their actions involve significant jumps in their behavior. However, the camera verification confirmed that the user was legitimate. The system is for an approval scenario. , ,but:

[0130]

[0131] at this time The system determines not to lock the screen to avoid accidental activation of the control mechanism due to short-term misoperation. If the next step continues to be abnormal, the score accumulates, and control is triggered when the score rises, balancing sensitivity and fault tolerance. This step outputs a boolean variable:

[0132] : Screen lock control command. A value of 1 indicates that the screen will be locked immediately, and a value of 0 indicates that the screen will not be locked temporarily.

[0133] Step 5: Remote screen lock execution and feedback loop:

[0134] This step is responsible for determining the results. This is actually translated into a terminal screen-locking behavior, and the entire process is recorded to form a complete control loop. If The system constructs control command packets through the platform control channel:

[0135]

[0136] : Control packets encrypted with signatures;

[0137] : Unique identifier for the terminal;

[0138] Trigger time;

[0139] The platform-generated encrypted signature ensures the legitimacy of the instructions.

[0140] The control packet is sent to the terminal via a local daemon or MQTT channel. The terminal then calls an operating system interface (such as LockWorkStation()) to lock the current user session. After the operation is complete, the terminal returns an execution status code. To the platform.

[0141] To record this control action in a closed loop, the system generates a log object:

[0142]

[0143] The terminal execution result has a value of 0 (failure) or 1 (success).

[0144] Feedback time;

[0145] Other variables are system or previous outputs, the meanings of which have been explained above.

[0146] For example: If a certain teaching terminal has a serial number trigger The platform will then send the instruction package. The command was sent, and the terminal executed it successfully and returned a response. The system generates a complete log. Recorded in the backend policy database. This step outputs two variables:

[0147] The actual execution state of the screen lock operation on the terminal;

[0148] : A complete remote control behavior log object, used for subsequent auditing or review.

[0149] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages: This solution uses structural modeling to parse the formula expression into a semantic structure graph and a triple intermediate representation, identifying variable dependencies and computational paths, laying the foundation for subsequent refined difference comparison; when the structure changes, incremental extraction is performed only on meaningful structural subgraphs, and difference fingerprints are established by combining historical versions and structural reusability, significantly reducing duplicate push content. A state variable awareness mechanism is introduced, combining the real-time state of business variables at the current moment to determine whether structural changes have actual impact and push value, thereby achieving accurate and dynamic push triggering; in the push decision stage, the push target is dynamically evaluated based on terminal capabilities and subscription relationships, ensuring execution only on necessary terminals while also considering performance constraints. This solution, without introducing complex model calculations and system reconstruction, achieves coordinated optimization of structure-level identification, state-level triggering, path-level push, and terminal-level feedback for formula changes, making it suitable for complex business system environments requiring high-frequency logic updates, heterogeneous terminal distribution, and limited communication resources.

[0150] This application also provides a remote screen lock control system, such as... Figure 2 As shown, it includes:

[0151] The behavior model module is configured to collect historical behavior data, which is obtained through operating system logs, front-end application logs, and control platform agent service logs. Event data is captured from the control platform agent service logs, and the event data is used to generate a historical behavior sequence according to time order. The historical behavior sequence is modeled using a bidirectional GRU network to obtain a bidirectional GRU task behavior model. The output of the bidirectional GRU task behavior model to the historical behavior sequence is a state vector sequence, which represents the semantic encoding result of the bidirectional GRU task behavior model for each time step in the historical behavior sequence.

[0152] An anomaly detection module is configured to collect real-time behavior data and generate a real-time behavior sequence based on time sequence; encode the real-time behavior sequence using the bidirectional GRU task behavior model to obtain a real-time state vector sequence; construct a behavior deviation function to identify deviations in the real-time behavior sequence and output a behavior deviation score.

[0153] An environment verification module is configured to activate a multimodal perception system to collect multimodal signals when the behavior deviation score exceeds a preset threshold; input the multimodal signals into a perception fusion model and output a physical environment anomaly score; output an anomaly label when the physical environment anomaly score is higher than a preset threshold; otherwise, output a normal label.

[0154] The decision generation module is configured to construct a lock screen scoring function, which is based on the behavior deviation score and the physical environment anomaly score; generate lock screen scores and output different lock screen control commands for different lock screen scores according to preset rules;

[0155] An execution recording module is configured to convert the screen lock control command into terminal behavior and record the control behavior to generate a system log, which includes the terminal execution result and feedback time.

[0156] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A remote screen locking control method, characterized by, Comprise: S1: collect historical behavior data, the historical behavior data is obtained by operating system log, front-end application log, control platform agent service log; capture event data from the control platform agent service log, generate historical behavior sequence according to time sequence; the historical behavior sequence is modeled by bidirectional GRU network to obtain bidirectional GRU task behavior model;The output of the bidirectional GRU task behavior model for the historical behavior sequence is state vector sequence;The state vector sequence represents the semantic encoding result of each time step in the bidirectional GRU task behavior model for the historical behavior sequence; S2: collect real-time behavior data, generate real-time behavior sequence according to time sequence;Real-time state vector sequence is obtained by encoding real-time behavior sequence through the bidirectional GRU task behavior model;A behavior deviation function is constructed to identify the deviation of real-time behavior sequence, and a behavior deviation score is output;The behavior deviation function is as follows: ； is the behavior deviation score, which is the main criterion of whether the current behavior deviates from the task; , are the first time sequence state vectors of the standard behavior and the current behavior, respectively; is the task stage weight, which is derived from the task sensitivity score at each time step, which can be obtained by pre-training through attention mechanism, and the larger the value, the more critical the step; is the state vector difference at the first time step; represents the most abnormal state jump value in the current behavior, which is calculated by monitoring the change rate between adjacent states; is the regularization coefficient, which is used to regulate whether to focus on the impact of local mutation behavior; S3: when the behavior deviation score exceeds the preset threshold, activate the multi-modal perception system to collect multi-modal signals;The multi-modal signal is input into the perception fusion model, and the physical environment abnormal score is output;When the physical environment abnormal score is higher than the preset threshold, an abnormal mark is output; Otherwise, output normal mark; S4: construct a lock screen score function, the lock screen score function is obtained based on the behavior deviation score and the physical environment abnormal score; Generate lock screen score, and output different lock screen control instructions according to preset rules; S5: the lock screen control instruction is converted into terminal behavior, and system log is recorded, which includes terminal execution result and feedback time.

2. The remote lock screen control method of claim 1, wherein, The structure of the bidirectional GRU task behavior model comprises two layers: the first layer is an embedding layer, which encodes discrete operation events into 128-dimensional vectors by table lookup method;The second layer is a bidirectional GRU network, and the hidden state dimension is set to 64.

3. The remote lock screen control method of claim 1, wherein, Task stage weight and abnormal behavior weighting item are also introduced in the behavior deviation function;The task stage weight is obtained by pre-training through attention mechanism;The abnormal behavior weighting item is calculated by monitoring the change rate between adjacent states.

4. The remote lock screen control method of claim 1, wherein, The multi-modal signal includes image, audio, heat source and distance data;The image data is collected by terminal camera, which is used to extract face, limb and gaze direction features;The audio data is input by local microphone, which is converted into frequency spectrum by short-time Fourier transform;The heat source data comes from infrared thermal imager or TOF ranging sensor, which is used to judge whether there is a person in the operation area or whether there is a disguised object.

5. The remote lock screen control method of claim 1, wherein, The perception fusion model is a basic multi-modal convolution perception network, which consists of three modal branches, each branch contains 2 layers of convolution, normalization and activation operation, and finally spliced through a layer of full connection to output the result.

6. The remote lock screen control method of claim 1, wherein, An image and heat source spatial conflict coefficient is introduced in the perception fusion model, which is obtained by the difference factor of spatial alignment between the saliency region in the image and the high temperature region in the heat source image.

7. The remote lock screen control method of claim 1, wherein, The preset rule is: When the lock screen score is higher than the preset threshold, it is determined that the high-risk interaction behavior is executed immediately, and the lock screen is executed; When the lock screen score is lower than or equal to the preset threshold, the running continues.

8. A remote lock screen control system, characterized by, Comprise: The behavior model module is set to collect historical behavior data, and the historical behavior data is obtained by operating system log, front-end application log and control platform agent service log; the event data is captured from the control platform agent service log, and the historical behavior sequence is generated according to the time sequence; the historical behavior sequence is modeled by bidirectional GRU network to obtain bidirectional GRU task behavior model; the output of the bidirectional GRU task behavior model to the historical behavior sequence is state vector sequence; the state vector sequence represents the semantic coding result of each time step in the historical behavior sequence of the bidirectional GRU task behavior model; The abnormality identification module is set to collect real-time behavior data and generate real-time behavior sequence according to time sequence; the real-time behavior sequence is coded by the bidirectional GRU task behavior model to obtain real-time state vector sequence; the behavior deviation function is constructed to identify the deviation of real-time behavior sequence, and the behavior deviation score is output; the behavior deviation function is as follows: ； is the behavior deviation score, which is the main criterion of whether the current behavior deviates from the task; , are the first time sequence state vectors of the standard behavior and the current behavior, respectively; is the task stage weight, which is derived from the task sensitivity score at each time step, which can be obtained by pre-training through attention mechanism, and the larger the value, the more critical the step; is the state vector difference at the first time step; represents the most abnormal state jump value in the current behavior, which is calculated by monitoring the change rate between adjacent states; is the regularization coefficient, which is used to regulate whether to focus on the impact of local mutation behavior; The environment verification module is set to activate the multi-modal perception system to collect multi-modal signals when the behavior deviation score exceeds the preset threshold; the multi-modal signals are input into the perception fusion model, and the physical environment abnormal score is output; when the physical environment abnormal score is higher than the preset threshold, the abnormal mark is output; Otherwise, output normal mark; The decision generation module is set to construct a lock screen score function, which is based on the behavior deviation score and the physical environment abnormal score; Generate lock screen score, output different lock screen control instructions according to different preset rules; The execution record module is set to convert the lock screen control instruction into terminal behavior, and record the control behavior generation system log, which includes terminal execution result and feedback time.

Images